News
New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

Check Point Research reports that Emotet Trojan launched a new campaign last month to evade Microsoft’s macro block, sending spam emails containing malicious OneNote files. Meanwhile Ahmyth was the most prevalent mobile malware and Log4j took top spot once again as the most exploited vulnerability

Check Point® Software Technologies, a leading provider of cybersecurity solutions globally, has published its Global Threat Index for March 2023. Last month, researchers uncovered a new malware campaign for Emotet Trojan, which rose to become the second most prevalent malware.
As reported earlier this year, Emotet attackers have been exploring alternative ways to distribute malicious files since Microsoft announced they will block macros from office files. In the latest campaign, the attackers have adopted a new strategy of sending spam emails containing a malicious OneNote file.
Once opened, a fake message appears to trick the victim into clicking the document, which downloads the Emotet infection. Once installed, the malware can gather user email data such as login credentials and contact information. The attackers then use the gathered information to expand the reach of the campaign and facilitate future attacks.
“While big tech companies do their best to cut off cybercriminals at the earliest point, it’s near impossible to stop every attack from bypassing the security measures. We know that Emotet is a sophisticated Trojan and it is no surprise to see it has managed to navigate Microsoft’s latest defenses.
The most important thing people can do is make sure they have appropriate email security in place, avoid downloading any unexpected files and adopt heathy skepticism about the origins of an email and its contents” said Maya Horowitz, VP Research at Check Point Software.
CPR also revealed that “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.
Top malware families
Globally, Qbot was the most prevalent malware last month with an impact of more than 10% on worldwide organizations respectively, followed by Emotet and Formbook with a 4% global impact.
In Nigeria, Qbot was the most prevalent malware last month with an impact of more than 32.36%, followed by Expiro with 19.35% and BlackCat with a 9.68% impact.
- Qbot – Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a user’s banking credentials or keystrokes and is often distributed via spam emails. Qbot employs several anti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.
- Expiro – Expiro is a polymorphic file infector first seen in 2010. It inserts its malicious code into executable files on the infected host. These files lead to new infections when they are run on other machines. Expiro steals user and system information from Windows, as well as FTP credentials.
- BlackCat – BlackCat (aka ALPHV) operates in a ransomware-as-a-service (RaaS) business model. BlackCat ransomware is highly customizable ransomware that allows for attacks on a wide range of corporate environments. It targets both Linux and Windows systems, and is coded in Rust.
Top Attacked Industries in Africa
Last month, Manufacturing remained the most attacked industry globally, followed by Consultant and then Leisure/Hospitality.
- Manufactoring
- Consultant
- Leisure/Hospitality
Top exploited vulnerabilities
Last month, “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.
- ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↑ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
- ↑MVPower DVR Remote Code Execution – A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
Top Mobile Malwares
Last month, Ahmyth moved to the top spot as the most prevalent mobile malware, followed by Anubis and Hiddad.
- AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera.
- Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
- Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, the intelligence and research Arm of Check Point Software Technologies.
News
Experts Reveal a Steady Decline of High-severity Incidents Over the Years

According to the ‘Anatomy of a Cyber World: Global Report by Kaspersky Security Services’, there has been a noticeable decline in the percentage of high-severity incidents over the past few years.

While 2021 recorded the highest proportion at 14.3%, 2025 experienced the lowest in six years at just 3.8%. This trend indicates that many attack attempts were quickly detected and effectively mitigated by Kaspersky MDR experts, preventing their severity from escalating beyond medium levels.
High-severity incidents are defined as attacks involving direct human involvement that result in a significant impact on the customer’s IT infrastructure. In 2025, the number of such incidents detected by Kaspersky MDR decreased by 19% compared to 2024, highlighting improvements in early detection capabilities and more effective remediation efforts among Kaspersky MDR clients.
A detailed analysis of the root causes of these incidents in 2025 reveals the following insights:
Human-driven attacks accounted for approximately 23% of high-severity incidents. Although this represents a slight decrease from 2024, they continue to be the primary cause of serious breaches.
Kaspersky detected such attacks in nearly 21% of customers, demonstrating that motivated adversaries persist in bypassing automated defences. Despite advancements in automated detection tools, these highly skilled attackers still find ways to evade security measures.
Confirmed cyber exercises like Red Teaming made up over 23% of incidents. When activity is verified as part of security testing, it’s often classified as infrastructure false positives, though customers frequently report them as incidents.
Social engineering ranked third, responsible for over 15% of high-severity attacks and affecting nearly 18% of organisations. These are classified as high-severity when successful and not automatically remediated, often leading to security awareness recommendations.
Security policy violations constituted just under 14% of all cases, involving legitimate accounts performing suspicious actions like data exfiltration. Malware incidents represented less than 12%, while artifacts from past attacks, or APT traces, were found in over 7% of cases. Vulnerability detection, though not core focus for Kaspersky MDR, was reported in fewer than 5% of incidents.
“The decline in high-severity incidents highlights the critical importance of adopting a proactive cybersecurity strategy. Human-led solutions such as Managed Detection and Response (MDR) and Incident Response remain essential in combating sophisticated, human-driven threats.
To further enhance the effectiveness and efficiency of in-house security teams, organisations should incorporate advanced, automated solutions like Extended Detection and Response (XDR), which provide improved visibility and enable faster responses.
Additionally, leveraging SOC consulting services can assist in building a robust Security Operations Center from the ground up or optimising an existing one for maximum performance.
An integrated approach to hybrid security operations empowers organisations to detect threats early, contain them swiftly, and ultimately prevent severe breaches from occurring,” comments Sergey Soldatov, Head of Security Operations at Kaspersky.
News
Google, UpSkill Universe Relaunch Hustle Academy to Bring Free AI Skills to Africans

Google and UpSkill Universe, Sub-Saharan Africa’s leading AI and business skills training partner, have announced a major redesign of the Google Hustle Academy programme.

For the first time, the free training initiative is open to everyone, not just business owners. The new curriculum is focused on equipping individuals and entrepreneurs with practical AI skills.
Small businesses are the engine of Africa’s economy, creating over 80% of jobs on the continent. To help them grow, the Hustle Academy was launched in 2022, providing bootcamp-style training on business strategy, digital skills, AI, and leadership. The program has since trained over 18,000 SMEs, with many reporting increased revenue and job creation.
Now, as AI reshapes the job market, the program is evolving. The 2026 edition is built for anyone in Sub-Saharan Africa, including employees, students, and jobseekers, who wants to use AI to advance their career.
To meet the needs of a diverse audience, the new format includes short, 60-minute webinars and more immersive, high-impact bootcamps. These sessions are laser-focused on putting AI to work immediately in areas like digital commerce, marketing, and growth strategy.
Speaking about the academy, Gori Yahaya, Founder & CEO UpSkill Universe said “The 2026 Hustle Academy is designed to close the AI Skills gap with hands-on training that is short, focused, and immediately useful. AI is reshaping how businesses win and how careers are built, right across this continent.
“We’re excited to renew our partnership, now in its fifth year with Google, combining their global AI leadership with our deep regional AI expertise. The next wave of AI leaders will come from this continent. We are making sure they are ready.”
The Hustle Academy initiative has strengthened digital competitiveness across emerging African economies by enabling SMEs to move beyond AI awareness to practical implementation, positioning them for sustained growth in an increasingly AI-driven business environment.
“We believe that the future of Africa’s digital economy lies in the hands of individuals and entrepreneurs alike. Our new strategy focuses on scaling reach by training individuals in the latest AI-centered tools and techniques,” said a Google representative.
News
Lagos Govt Drags Top Firms to Court Over Billion-Naira Tax Debts

Lagos State has dragged 45 individuals and firms, including Bi-Courtney Aviation, DAAR Communications and Leaders & Company, to revenue court for tax debts running into billions of naira.

Lagos Govt
Bi-Courtney, operators of Murtala Muhammed Airport Terminal Two, faces N38.7 million claim; DAAR, behind Africa Independent Television, owes N22.4 million; ThisDay publishers Leaders & Company allegedly skip N67.1 million.
GMT Energy Resources tops corporates at N145.8 million, followed by Sheriff Deputies at N132.1 million; others like Heyden Petroleum, AA Rescue, BRT operator Primero also listed.
Individuals owe N13.5 million to N35 million each.
Attorney-General Lawal Pedro said suits followed ignored notices, aiming to enforce laws and fund infrastructure.
More defendants: IENG Nigeria, James Fisher, V Care Diagnostics, Venture Garden, Saro Africa, Barry Callebaut, Native Media, First Consulting, Eyowo Payments.
Compliant taxpayers post-notice escaped prosecution; defaulters risk penalties, interest, jail.
Pedro urged prompt filings and payments.
E-Financial2 days agoSee Key Changes in BVN Rule from May 1 by CBN
E-Financial2 days agoHow Sterling Bank Is Empowering 1m Women with ₦500Bn
E-Financial2 days agoPaga Group Rejigs Leadership as Oviosu, Founder Becomes Group CEO
Broadcasting2 days agoINEC Warns Broadcasters against Misinformation ahead of 2027 Polls
E-Financial2 days agoReputation: The Real Currency Powering Fintechs
E-Business2 days agoJumia Expands Nationwide Footprint, Deepens Reach Across Underserved Nigerian Cities
News2 days agoGoogle, UpSkill Universe Relaunch Hustle Academy to Bring Free AI Skills to Africans
Telecom2 days agoTruecaller Targets Global Market with Powerful New Business Chat Push


















