E-Business
HP Threat Research Shows Attackers Exploiting Zero-Day Vulnerability Before Enterprises Can Patch
HP Inc. has released its latest global HP Wolf Security Threat Insights Report, providing analysis of real-world cybersecurity attacks. By isolating threats that have evaded detection tools and made it to user endpoints, HP Wolf Security has a unique insight into the latest techniques being used by cybercriminals.
The HP Wolf Security threat research team found evidence that cybercriminals are mobilizing quickly to weaponize new zero-day vulnerabilities.
Exploits of the zero-day CVE-2021-40444 – a remote code execution vulnerability that enables exploitation of the MSHTML browser engine using Microsoft Office documents – were first captured by HP on September 8, a week before the patch was issued on September 14.
By September 10 – just three days after the initial threat bulletin – the HP threat research team saw scripts designed to automate the creation of this exploit being shared on GitHub.
Unless patched, the exploit enables attackers to compromise endpoints with very little user interaction. It uses a malicious archive file, which deploys malware via an Office document.
Users don’t have to open the file or enable any macros, viewing it in File Explorer’s preview pane is enough to initiate the attack, which a user often will not know has happened. Once the device is compromised, attackers can install backdoors to systems, which could be sold on to ransomware groups.
Other notable threats isolated by the HP Wolf Security threat insight team include a rise in cybercriminals using legitimate Cloud and web providers to host malware, JavaScript malware slipping past detection tools, and targeted campaign found posing as the Ugandan National Social Security fund. The team also that switching to HTA files spreads malware in a single click.
“The average time for a business to apply, test and fully deploy patches with the proper checks is 97 days, giving cybercriminals an opportunity to exploit this ‘window of vulnerability’.
While only highly capable hackers could exploit this vulnerability at first, automated scripts have lowered the bar for entry, making this type of attack accessible to less knowledgeable and resourced threat actors.
This increases the risk to businesses substantially, as zero-day exploits are commoditized and made available to the mass market in venues like underground forums,” explains Alex Holland, Senior Malware Analyst, HP Wolf Security threat research team, HP Inc.
“Such novel exploits tend to be effective at evading detection tools because signatures may be imperfect and become obsolete quickly as the understanding of the scope of an exploit changes.
“We expect threat actors to adopt CVE-2021-40444 as part of their arsenals, and potentially even replace common exploits used to gain initial access to systems today, such as those exploiting Equation Editor.”
“We are also seeing major platforms like OneDrive allowing hackers to conduct ‘flash in the pan’ attacks.
While malware hosted on such platforms are generally taken down quickly, this does not deter attackers because they can often achieve their objective of delivering malware in the few hours the links are live,” Holland continues. “Some threat actors are changing the script or file type they are using every few months.
“Malicious JavaScript and HTA files are nothing new, but they are still landing in employee inboxes, putting the enterprise at risk. One campaign deployed Vengeance Justice Worm, which can spread to other systems and USB drives.”
The findings are based on data from the millions of endpoints running HP Wolf Security. HP Wolf Security tracks malware by opening risky tasks in isolated, micro Virtual Machines (micro VMs) to understand and capture the full infection chain, helping to mitigate threats that have slipped past other security tools.
This has let customers click on over 10 billion email attachments, web pages, and downloads with no reported breaches. By better understanding the behavior of malware in the wild, HP Wolf Security researchers and engineers can bolster endpoint security protection and overall system resilience.
“We can’t keep relying on detection alone. The threat landscape is too dynamic and, as we can see from the analysis of threats captured in our VMs, attackers are increasingly adept at evading detection,” comments Dr. Ian Pratt, Global Head of Security for Personal Systems, HP Inc.
“Organizations must take a layered approach to endpoint security, following zero trust principles to contain and isolate the most common attack vectors like email, browsers, and downloads. This will eliminate the attack surface for whole classes of threats, while giving organizations the breathing room needed to coordinate patch cycles securely without disrupting services.”
Coinbase forecast a hit of between $180m and $400m from a cyberattack that breached account data of a “small subset” of its customers, the crypto exchange said in a regulatory filing on Thursday.
The company received an anonymous email on May 11, claiming to have information about certain customer accounts as well as internal documents.
While some data — including names, addresses and emails — was stolen, the hackers did not get access to login credentials or passwords, Coinbase said.
Still, it will reimburse customers who were tricked into sending funds to the attackers.
Hackers had paid multiple contractors and employees working in support roles outside the US to collect information.
The company has fired those involved, it said.
Separately, the New York Times reported that the US Securities and Exchange Commission (SEC) was investigating whether the company had misstated its user numbers.
Coinbase shares extended losses after the report and were last down 6.5%.
“This is a hold-over investigation from the prior administration about a metric we stopped reporting two-and-a-half years ago, which was fully disclosed to the public,” said Paul Grewal, Coinbase’s chief legal officer.
“While we strongly believe this investigation should not continue, we remain committed to working with the SEC to bring this matter to a close.”
The SEC declined to comment.
The latest developments come days before the company is set to join the benchmark S&P 500 index, casting a shadow over what was expected to be a landmark moment for the crypto industry.
Security remains a challenge for the crypto industry despite its growing mainstream acceptance.
In February, Bybit disclosed a hack in which about $1.5bn worth of digital tokens were stolen — widely described the biggest crypto heist ever.
“The cyberattack may push the industry to adopt stricter employee vetting and introduce some reputational risks,” said Bo Pei, an analyst at US Tiger Securities.
Funds stolen by hacking crypto platforms amounted to $2.2bn in 2024, according to a report from Chainalysis, a US-based blockchain analysis firm.
“As our nascent industry grows rapidly, it draws the eye of bad actors, who are becoming increasingly sophisticated in the scope of their attacks,” said Nick Jones, founder of crypto firm Zumo.
Coinbase has refused to pay a ransom of $20m demanded by the attackers and is working with law enforcement agencies. Instead it has established a $20m reward for information on the hackers.
The company is also opening a new support hub in the US and taking other measures to prevent such cyberattacks, it said.
The Nigeria Internet Registration Association (NiRA) presents its report on .ng domain name registration and renewal statistics for the first quarter of 2025, highlighting the continued expansion of Nigeria’s digital footprint. The data underscores a consistent and significant adoption of the nation’s Country Code Top-Level Domain (ccTLD), reinforcing its pivotal role in the burgeoning Nigerian digital economy.
During the period spanning January to March 2025, a total of 40,791 .ng domain names were recorded. This figure comprises 22,236 new registrations and 18,555 renewals, indicating a healthy balance between the acquisition of new digital identities and the sustained commitment of existing domain name holders to their online presence.
Analysis of the registration trends within the quarter reveals a notable upward trajectory, with a 13.92% increase in domain name registrations observed between February and March 2025.
This growth signifies an increasing recognition of the importance of a localized online identity by a diverse range of stakeholders, including individuals, startups, Small and Medium-sized Enterprises (SMEs), and larger organizations.
Notably, the .com.ng extension continues to be the dominant choice, accounting for over 60% of both new registrations and renewals. This reaffirms its status as the preferred domain name extension for Nigerian businesses seeking to establish a credible and locally relevant online brand presence while maintaining global accessibility. The sustained popularity of .com.ng underscores its perceived value among Nigerian entrepreneurs and enterprises seeking to secure their digital real estate.
This upward trajectory isn’t happening by chance. The Nigeria Internet Registration Association (NiRA) has remained intentional in its drive for digital inclusion and domain adoption. Through public education, training via the .ng Academy, outreach campaigns, and partnerships with stakeholders across the tech ecosystem, NiRA has consistently advocated for the importance of owning a local domain. The current standing of .ng as the second most registered ccTLD in Africa reflects the efficacy of these efforts.
Digital adoption in Nigeria is no longer just about being online—it’s about owning your digital identity. And with a .ng domain, Nigerians are better positioned to assert that identity, connect with local and international audiences, and gain better control over their digital footprints.
As we look toward the rest of 2025, the Q1 results serve as a strong signal: more people are embracing the digital future, and the .ng domain is increasingly becoming their first step.
National Identity Management Commission (NIMC) of Nigeria has launched a new digital identity verification tool called the NIN Authentication (NINAuth) application.
The initiative, which forms part of President Bola Tinubu’s Renewed Hope Agenda, aims to strengthen the country’s national digital identity management framework.
The launch builds upon Nigeria’s comprehensive unified digital identity system that has been transforming access to financial services and government programs.
The NINAuth application introduces several key features focused on data security and privacy.
The platform requires explicit user consent before sharing identity information for Know Your Customer (KYC) processes, giving individuals greater control over their personal data.
The system provides seamless access to various government services, including SIM card registration, immigration applications, passport processing, tax filings, and financial transactions.
The development follows significant investment in Nigeria’s digital identity infrastructure, including a $45.5 million support from the World Bank as part of the Digital Identification for Development (ID4D) project.
As the official service for integration with NIMC’s backend infrastructure, NINAuth enables secure verification processes across ministries, departments, and agencies (MDAs).
The application is available for download on both the Google Play Store and Apple iOS App Store for users of the National Identification Number (NIN).
The rollout represents a significant milestone in Nigeria’s ongoing efforts to digitize government services and strengthen identity verification processes.
“NINAuth is a cutting-edge suite of services including web, API, and mobile verification designed to enhance data security, protect privacy, and simplify access to government services,” said Dr. Kayode Adegoke, Head of Corporate Communications at NIMC.
“The platform introduces a robust layer of protection, empowering individuals with greater control over their personal information.”
The implementation supports the objectives of the recently established Nigeria Digital Identification for Development Project Ecosystem Steering Committee, which oversees the country’s digital identity initiatives.
President Bola Ahmed Tinubu has approved the launch of the NINAuth app and directed its use for verification and authentication across all MDAs.
The application provides a secure single sign-on solution for accessing government services and social protection programs while maintaining strict data privacy controls.
The centralized approach to digital identity management represents a significant step forward in Nigeria’s digital transformation journey and its commitment to modernizing government services.
Telcos Worry over Possible 5 Percent Tax Return
FirstBank Hikes SMS Alert Fee from N4 to N6
IFC Invests $5m in Husk Nigeria to Build 108 Solar Mini Grids
Why and How Banks Fail in Nigeria by CIoD Chair
NFIU Warns Against Use of BNBEX over False Claims
Broadcasting2 days ago5 Things You Absolutely Need to Know About BBNaija Season 10
Telecom2 days agoNigerians May Pay More for Calls, Data as Senate Okays 5 Percent Excise Duty
E-Financial2 days agoW’Bank Says Cash Transfer Missed Millions of Needy Nigerians
E-Business2 days agoNCC to Checkmate $3Bn Digital Piracy Market
E-Business2 days agoNIMC Launches NINAuth Digital Identity Verification App for Govt Services
General News2 days agoEFCC Tells Nigerians to Shun Ponzi Schemes Like CBEX, Others
Telecom2 days agoMastercard Report Reveals Top Travel Trends Shaping Africa in 2025
E-Financial2 days agoCBN, NIBSS Unveil BVN Platform for Diaspora Nigerians