News
New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files
Check Point Research reports that Emotet Trojan launched a new campaign last month to evade Microsoft’s macro block, sending spam emails containing malicious OneNote files. Meanwhile Ahmyth was the most prevalent mobile malware and Log4j took top spot once again as the most exploited vulnerability
Check Point® Software Technologies, a leading provider of cybersecurity solutions globally, has published its Global Threat Index for March 2023. Last month, researchers uncovered a new malware campaign for Emotet Trojan, which rose to become the second most prevalent malware.
As reported earlier this year, Emotet attackers have been exploring alternative ways to distribute malicious files since Microsoft announced they will block macros from office files. In the latest campaign, the attackers have adopted a new strategy of sending spam emails containing a malicious OneNote file.
Once opened, a fake message appears to trick the victim into clicking the document, which downloads the Emotet infection. Once installed, the malware can gather user email data such as login credentials and contact information. The attackers then use the gathered information to expand the reach of the campaign and facilitate future attacks.
“While big tech companies do their best to cut off cybercriminals at the earliest point, it’s near impossible to stop every attack from bypassing the security measures. We know that Emotet is a sophisticated Trojan and it is no surprise to see it has managed to navigate Microsoft’s latest defenses.
The most important thing people can do is make sure they have appropriate email security in place, avoid downloading any unexpected files and adopt heathy skepticism about the origins of an email and its contents” said Maya Horowitz, VP Research at Check Point Software.
CPR also revealed that “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.
Top malware families
Globally, Qbot was the most prevalent malware last month with an impact of more than 10% on worldwide organizations respectively, followed by Emotet and Formbook with a 4% global impact.
In Nigeria, Qbot was the most prevalent malware last month with an impact of more than 32.36%, followed by Expiro with 19.35% and BlackCat with a 9.68% impact.
- Qbot – Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a user’s banking credentials or keystrokes and is often distributed via spam emails. Qbot employs several anti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.
- Expiro – Expiro is a polymorphic file infector first seen in 2010. It inserts its malicious code into executable files on the infected host. These files lead to new infections when they are run on other machines. Expiro steals user and system information from Windows, as well as FTP credentials.
- BlackCat – BlackCat (aka ALPHV) operates in a ransomware-as-a-service (RaaS) business model. BlackCat ransomware is highly customizable ransomware that allows for attacks on a wide range of corporate environments. It targets both Linux and Windows systems, and is coded in Rust.
Top Attacked Industries in Africa
Last month, Manufacturing remained the most attacked industry globally, followed by Consultant and then Leisure/Hospitality.
- Manufactoring
- Consultant
- Leisure/Hospitality
Top exploited vulnerabilities
Last month, “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.
- ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↑ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
- ↑MVPower DVR Remote Code Execution – A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
Top Mobile Malwares
Last month, Ahmyth moved to the top spot as the most prevalent mobile malware, followed by Anubis and Hiddad.
- AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera.
- Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
- Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, the intelligence and research Arm of Check Point Software Technologies.
Nigerian Maritime Administration and Safety Agency (NIMASA) and the Bank of Industry (BOI) have initiated discussions on strategies for capacity building in the maritime industry.
Dr. Dayo Mobereola, Director General of NIMASA, represented by the Executive Director of Maritime Labour and Cabotage Services, Mr. Jibril Abba disclosed this during a visit by the management of the bank led by Executive Director of Large Enterprises, Mrs. Ifeoma Uz’Okpala.
Osagie Edward, the agency’s Head of Public Relations, said in a statement that in addition to safety, security and maritime labour, the agency’s mandate encompasses capacity development aimed at growing the sector.
Also, Mobereola explained that NIMASA’s commitment to collaboration was a vital tool for achieving its mandate.
He said: “The aim is to actualise the vision of the Federal Government to reposition the maritime sector, especially with the creation of the Ministry of Marine and Blue Economy.”
Also, Uz’Okpala affirmed the bank’s readiness to support NIMASA, emphasising the importance of collaboration in implementing a robust capacity-building initiative that would contribute to economic growth in Nigeria.
She noted: “Bank of Industry Limited is Nigeria’s oldest and largest Development Finance Institution (DFI) currently in operation. It is owned by the Ministry of Finance Incorporated (MOFI) Nigeria (94.80 per cent), the Central Bank of Nigeria (CBN) (5.19 per cent) and private shareholders (0.01 per cent).
The federal government’s aggregate receipt of the Value Added Tax (VAT) in Q2 2024, stood at N1.56 trillion, indicating a growth rate of 9.11 per cent on a quarter-on-quarter (QoQ) basis from N1.43 trillion in Q1 2024.
The figure represents a 99.82 per cent increase compared to the N781.35 billion collected in the corresponding quarter of last year.
According to numbers released by the Nigeria Bureau of Statistics (NBS), On a quarter-on-quarter basis, the Q2 VAT rose by 9.11 per cent from N1.43 trillion in Q1 2024.
The data showed that local VAT payments recorded were N792.58 billion, foreign VAT payments stood at N395.74 billion, while import VAT contributed N372.95 billion in Q2 2024.
Analysis of the NBS numbers showed that human health and social work activities recorded the highest growth rate with 98.44 per cent, followed by agriculture, forestry and fishing with 70.26 per cent, and water supply, sewerage, waste management and remediation activities with 59.75 per cent.
Contrarily, activities of households as employers, undifferentiated goods- and services-producing activities of households for own use had the lowest growth rate with –46.84 per cent, followed by real estate activities with –42.59 per cent.
In terms of sectoral contributions, the top three largest shares in Q2 2024 were manufacturing with 11.78 per cent; information and communication with 9.02 per cent; and mining and quarrying with 8.79 per cent.
“Nevertheless, activities of households as employers, undifferentiated goods- and services-producing activities of households for own use recorded the least share with 0.00 percent, followed by activities of extraterritorial organisations and bodies with 0.01 per cent; and water supply, sewerage, waste management and remediation activities with and Real Estate Services 0.04 per cent each.
“However, on a year-on-year basis, VAT collections in Q2 2024 increased by 99.82 per cent from Q2 2023,” NBS stated.
Partners for the eighth annual conference of the Guild of Corporate Online Publishers (GOCOP) have begun to emerge with the Nigerian Content Development and Monitoring Board (NCDMB), Emadeb Group and Dangote Group leading the train of partners for the event slated for Thursday, October 3, 2024 at the Reverton Hotel, GRA Lokoja, Kogi State.
The chairman of the 2024 Conference Planning Committee, Danlami Nmodu, mni, also listed other partners to include Nigeria Civil Aviation Authority (NCAA), Setraco Nigeria Limited, United Bank for Africa (UBA) and Nigerian Communications Commission (NCC), according to a statement by
GOCOP Publicity Secretary, Sir Remmy Nweke.
Nmodu was also quoted as saying that the eighth conference would center on the theme: “Nigeria: Tackling Insecurity, Power Deficit, and Transitioning to Digital Economy” and will hold on Thursday, October 3, 2024 from 10am. The keynote will be delivered by former governor of Cross River State, Senator Liyle Imoke.
Read Also: Imoke, Buratai, Maida, others to headline GOCOP 2024 conference in Kogi
Additional partners for 2024, he said, comprised the Nigerian Safety Investigation Bureau, Access Bank plc, Zenith Bank plc, First City Monument Bank (FCMB), Fidelity Bank plc, Sovereign Trust Insurance Plc (STI), Nigerians in Diaspora Commission (NIDCOM) and National Film and Video Censors Board (NFVCB).
A major highlight of this year’s conference, Nmodu said, is a business luncheon with GOCOP partners on Wednesday, 2 October, at the same venue, while the conference itself would hold on Thursday, October 3.
Nmodu noted that the 8th edition would be chaired by former Nigeria’s Ambassador to Spain, Alhaji Yusuf Mamman, with the former Nigerian Chief of Army Staff, Lt-General Tukur Yusuf Buratai (Retd) and the Executive Vice Chairman, Nigerian Communications Commission (NCC), Dr. Aminu Maida as Guest Speakers, while a Professor of Political Science at the Federal University Lokoja, Prof. Rotimi Ajayi and an edutainment communicator and veteran broadcaster, Ms Debrah M. Ogazuma are panellists.
Nmodu recalled that GOCOP conference 2023 was chaired by the JAMB Registrar and Chief Executive, Prof Ishaq Olarenwaju Oloyede, while the first Nigerian Professor of Capital Market, Prof. Uchenna Joseph Uwaleke was the keynote speaker.
Previous speakers at the annual conference consisted of Rev. Matthew Hassan Kukah, the Bishop of the Catholic Diocese of Sokoto who delivered the 2019 lecture on “Economy, Security and National Development: The Way Forward.”
In 2021, Mr. Boss Mustapha, Secretary to the Government of the Federation, keynoted the Conference in his capacity as Chairman of the Presidential Task Force on Covid-19. He spoke on: “Post Covid-19 Pandemic: Recovery and Reconstruction in Nigeria.”
In 2022, Professor Mahmood Yakubu, Chairman, Independent National Electoral Commission, delivered the keynote entitled “2023 Elections: Managing the Process for Credible Outcome.”
GOCOP was established to ensure that online publishers uphold the tenets of journalism.
Membership of the Guild is a constellation of editors and senior journalists who, having distinguished themselves in their various positions in the print and electronic media, ventured into online publishing which is both the present and future of journalism globally.
The Guild has over 104 corporate publishers as members.
SEC Says 50 Crypto Exchanges have Applied for Licenses
CBN Orders PoS Operators to Route all Transactions through NIBSS or UPSL
Reps Panel Asks GTBank to Remit VAT on Remita Transactions to FG
Big Larry, Nollywood Actor is Dead
NIMASA, BOI Partner to Grow Capacity In Maritime Sector
NDIC Plans to Liquidate 87 Microfinance Banks, Others
Introducing TECNO POP9: The Smartphone That Redefines Affordability
NIN: NCC Tightens Loose Ends, Introduce Self-Help Measure
SMEDAN Inks MoU with NIPOST to Offer 15% Logistics Discount to SMEs
ALX Nigeria Moves Over 12,000 Youths Closer to Jobs in Six Months
E-Financial1 day agoSEC Says 50 Crypto Exchanges have Applied for Licenses
E-Business2 days agoFour Nigerian Start-ups Selected for NBA Africa Startup Accelerator’ Demo Day
News2 days agoSiBAN Sacks Obinna Iwuno, Its National President Over Abuse of Power
Telecom2 days ago15Wins Ventures Embarks on ₦5bn Fundraising to Empower Nigerian Startups
E-Financial2 days agoCBN Directs Payment Service Providers to Tracking POS Transactions
E-Financial1 day agoCBN Orders PoS Operators to Route all Transactions through NIBSS or UPSL
- Broadcasting1 day ago
Big Larry, Nollywood Actor is Dead
E-Financial2 days agoCBN Tightens Grip on Electronic Transactions with New Rules for PoS