News
New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files
Check Point Research reports that Emotet Trojan launched a new campaign last month to evade Microsoft’s macro block, sending spam emails containing malicious OneNote files. Meanwhile Ahmyth was the most prevalent mobile malware and Log4j took top spot once again as the most exploited vulnerability
Check Point® Software Technologies, a leading provider of cybersecurity solutions globally, has published its Global Threat Index for March 2023. Last month, researchers uncovered a new malware campaign for Emotet Trojan, which rose to become the second most prevalent malware.
As reported earlier this year, Emotet attackers have been exploring alternative ways to distribute malicious files since Microsoft announced they will block macros from office files. In the latest campaign, the attackers have adopted a new strategy of sending spam emails containing a malicious OneNote file.
Once opened, a fake message appears to trick the victim into clicking the document, which downloads the Emotet infection. Once installed, the malware can gather user email data such as login credentials and contact information. The attackers then use the gathered information to expand the reach of the campaign and facilitate future attacks.
“While big tech companies do their best to cut off cybercriminals at the earliest point, it’s near impossible to stop every attack from bypassing the security measures. We know that Emotet is a sophisticated Trojan and it is no surprise to see it has managed to navigate Microsoft’s latest defenses.
The most important thing people can do is make sure they have appropriate email security in place, avoid downloading any unexpected files and adopt heathy skepticism about the origins of an email and its contents” said Maya Horowitz, VP Research at Check Point Software.
CPR also revealed that “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.
Top malware families
Globally, Qbot was the most prevalent malware last month with an impact of more than 10% on worldwide organizations respectively, followed by Emotet and Formbook with a 4% global impact.
In Nigeria, Qbot was the most prevalent malware last month with an impact of more than 32.36%, followed by Expiro with 19.35% and BlackCat with a 9.68% impact.
- Qbot – Qbot AKA Qakbot is a banking Trojan that first appeared in 2008. It was designed to steal a user’s banking credentials or keystrokes and is often distributed via spam emails. Qbot employs several anti-VM, anti-debugging and anti-sandbox techniques to hinder analysis and evade detection.
- Expiro – Expiro is a polymorphic file infector first seen in 2010. It inserts its malicious code into executable files on the infected host. These files lead to new infections when they are run on other machines. Expiro steals user and system information from Windows, as well as FTP credentials.
- BlackCat – BlackCat (aka ALPHV) operates in a ransomware-as-a-service (RaaS) business model. BlackCat ransomware is highly customizable ransomware that allows for attacks on a wide range of corporate environments. It targets both Linux and Windows systems, and is coded in Rust.
Top Attacked Industries in Africa
Last month, Manufacturing remained the most attacked industry globally, followed by Consultant and then Leisure/Hospitality.
- Manufactoring
- Consultant
- Leisure/Hospitality
Top exploited vulnerabilities
Last month, “Apache Log4j Remote Code Execution” was the most exploited vulnerability, impacting 44% of organizations globally, followed by “HTTP Headers Remote Code Execution” with 43% of organizations worldwide and “MVPower DVR Remote Code Execution” with a global impact of 40%.
- ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↑ HTTP Headers Remote Code Execution (CVE-2020-10826,CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.
- ↑MVPower DVR Remote Code Execution – A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request.
Top Mobile Malwares
Last month, Ahmyth moved to the top spot as the most prevalent mobile malware, followed by Anubis and Hiddad.
- AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera.
- Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
- Hiddad – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the OS.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, the intelligence and research Arm of Check Point Software Technologies.
Joint Admissions and Matriculation Board (JAMB) has called for radical and urgent interventions to curb the rising wave of sophisticated digital examination fraud in Nigeria.
JAMB warned that the trend can cause long-term damage to the country’s education system.
Prof. Is-haq Oloyede, JAMB Registrar, made this call during a recent event in Abuja, as reported in the JAMB Bulletin published Monday.
Oloyede described the evolving tactics employed by fraudsters during the 2025 Unified Tertiary Matriculation Examination (UTME) as “worrisome, highly sophisticated, and capable of jeopardising national development.”
“Malpractice is not only compromising learning and research, it is endangering our collective future,” Oloyede warned.
“There is an urgent need for decisive action on these new and disturbing developments. The public must not treat this menace with levity.”
He lamented that instead of addressing the growing problem, “some people are dissipating their energies on spreading unhelpful conspiracy theories and hatred, while our future is being jeopardised by a new crop of sophisticated digital fraudsters.”
The registrar detailed how high-level examination malpractices were uncovered during the 2025 UTME, leading to the withdrawal of some results and the arrest of several culprits nationwide.
According to him, JAMB discovered that certain Computer-Based Test (CBT) centres and school proprietors had colluded with hackers to gain remote access to candidates’ systems and submit pre-programmed answers to local servers at compromised centres.
Oloyede also highlighted the use of AI-enabled photo blending to impersonate candidates, noting that many of the impersonators were current undergraduates. Other fraudulent tactics included:
He said they also include registration with combined fingerprints through the combination of fingerprints from multiple persons for a single candidate’s registration.
He cited the extension of local area networks from some dubious centres to remote “strong rooms” as well as the pairing of candidates with professional mercenaries to gain access to the examination hall.
He revealed that over 3,000 candidates have been identified as either accomplices or beneficiaries of these crimes, stressing that many of them are university students already enrolled in institutions.
Socio-Economic Rights and Accountability Project (SERAP) has filed a lawsuit against the Nigerian National Petroleum Company (NNPC) Limited over its failure to account for the alleged missing ₦500 billion, which the company reportedly failed to remit to the Federation Account between October and December 2024.
SERAP’s legal action comes after allegations made by the World Bank, which revealed that out of the ₦1.1 trillion generated from crude sales and other income sources in 2024, NNPC only remitted ₦600 billion.
This left a deficit of ₦500 billion, which remains unaccounted for.
According to the lawsuit filed at the Federal High Court in Lagos on Friday, the organisation is demanding that NNPC explain the whereabouts of this missing amount.
The suit, number FHC/L/MSC/553/2025, seeks to compel NNPC to account for the missing funds.
In the legal documents, SERAP is asking for an order of mandamus to direct NNPC to account for the alleged missing ₦500 billion.
The organisation also wants the court to instruct NNPC to invite appropriate anti-corruption agencies to investigate the spending and whereabouts of the funds.
Furthermore, SERAP requests that those responsible for the missing money be identified, held accountable, and handed to relevant authorities for investigation and prosecution.
The lawsuit follows NNPC’s response to SERAP’s Freedom of Information (FoI) request, where the company argued that the FoI Act does not apply to it.
NNPC’s lawyers, Afe Babalola and Co, claimed that the company is exempt from the FoI Act.
SERAP, however, argues that the NNPC must comply with the Nigerian Constitution and the Freedom of Information Act, along with international human rights and anti-corruption standards, in exercising its statutory functions.
In the suit, SERAP emphasizes that the missing funds have significantly contributed to Nigeria’s economic instability, including the country’s high deficit spending and crippling debt crisis.
The organisation argues that the NNPC’s failure to remit these funds has worsened an already precarious economic situation.
SERAP also stresses that the missing oil revenues reflect a broader failure in NNPC’s accountability and transparency. The organisation highlights that the company’s continuing disregard for these principles damages the country’s economic well-being and governance systems.
The lawsuit also references a recent Supreme Court ruling, which declared that the Freedom of Information Act applies to public records in the Federation, including those kept by NNPC. SERAP calls on the court to enforce the application of this ruling in the case at hand.
The suit filed on behalf of SERAP by its lawyers, Kolawole Oluwadare, Ms Oluwakemi Oni, and Ms Valentina Adegoke, read in part, “Nigerians continue to bear the brunt of these missing public funds from the NNPCL meant for the economic development of the country.”
“There is a legitimate public interest in providing the details sought. The NNPC has a legal responsibility to account for and explain the whereabouts of the missing oil money.”
“The country’s oil wealth ought to be used solely for the benefit of the Nigerian people, and for the sake of the present and future generations.”
“Without the full recovery and remittance of the missing ₦500 billion oil revenues, the dire economic situation may worsen and Nigerians will continue to be denied access to basic public goods and services.”
“Nigerians have the right to know why the NNPCL failed to remit the subsidy removal savings to the Federation Account, and why the NNPCL is deliberately denying states and local governments their allocations from the Account, contrary to the provisions of the Nigerian Constitution.”
“The failure by the NNPCL to remit the money to the Federation Account is a grave violation of the public trust and the provisions of the Nigerian Constitution, national anticorruption laws, and the country’s anticorruption obligations.”
“Despite the country’s enormous oil wealth, ordinary Nigerians have derived minimal benefit from oil money primarily because of widespread grand corruption, and the entrenched culture of impunity of perpetrators.”
“Combating the corruption epidemic in the oil sector would alleviate poverty, improve access of Nigerians to basic public goods and services, and enhance the ability of the government to meet its human rights and anti-corruption obligations.”
“The Nigerian Constitution, Freedom of Information Act, and the country’s anti-corruption and human rights obligations rest on the principle that citizens should have access to information regarding the spending of their commonwealth.”
“The Auditor-General of the Federation and Nigeria Extractive Industries Transparency Initiative (NEITI) have for many years documented reports of disappearance of oil money from the NNPCL.”
“The World Bank recently disclosed that out of the N1.1tn revenue from crude sales and other income in 2024, the NNPCL only remitted N600bn, leaving a deficit of ₦500bn unaccounted for.”
“The revenue and other income were expected to be paid into the Federation Account and shared by all levels of government but the NNPCL reportedly failed to do so.”
“SERAP notes that Section 15(5) of the Nigerian Constitution requires public institutions to abolish all corrupt practices and abuse of power.”
“Section 13 of the Nigerian Constitution imposes clear responsibility on the NNPCL to conform to, observe and apply the provisions of Chapter 2 of the Constitution.”
“Nigeria has made legally binding commitments under the UN Convention against Corruption to ensure accountability in the management of public resources. Articles 5 and 9 of the UN Convention against Corruption also impose legal obligations on the NNPCL to ensure proper management of public affairs and public funds.”
“These commitments ought to be fully upheld and respected.”
“The missing oil revenue has also impeded Nigerians’ ability to enjoy their economic and social rights, and denied them access to essential public goods and services, especially at the time of the cost of living crisis in the country.”
“Had the NNPCL accounted for and remitted the alleged missing ₦500 billion to the Federation Account, it is likely that more funds would have been allocated to the fulfilment of economic and social rights, such as increased spending on public goods and services.”
“The Freedom of Information Act, Section 39 of the Nigerian Constitution, article 9 of the African Charter on Human and Peoples’ Rights and article 19 of the International Covenant on Civil and Political Rights guarantee to everyone the right to information on the whereabouts of the missing ₦500 billion of oil revenue.”
No date has been fixed for the hearing of the suit.
The leadership of Computer Village, Ikeja, has begun a biometric registration and enumeration exercise to sanitise the market, curb criminal activity, and restore investor confidence.
In a statement, Abisola Azeez, Iyaloja, described the initiative as part of a broader rebranding effort to address issues like phone snatching, fraudulent technicians, and substandard goods.
It stated, “The market’s leadership announced the move after a recent security incident led the Lagos State Task Force to consider a complete shutdown. However, market representatives intervened to safeguard legitimate traders. Under the new rules, only registered vendors with ID cards displayed at their stalls will be allowed to operate.
Approved street setups will be limited to plastic chairs, show glasses, and umbrellas, while wooden structures and open flames are banned to reduce fire hazards.”
Adeniyi Olasoji, baba Oja, noted the market’s damaged image, emphasising new security measures like CCTV, emergency alert systems, and increased collaboration with law enforcement.
“Other leaders, including Prince Tony Nwakeze, Ralph Chibuzor, Ben Onuorah, Nofiu Akinsanya, and Ikani Tony, affirmed the move as essential for transforming Computer Village into a structured, globally competitive digital hub.
The registration will be completed within two months, after which only verified traders will be allowed to operate.
Meanwhile, Fidelix Ezeugwu, executive secretary of the Ikeja Market Board, emphasised the market’s unified leadership, comprising representatives from four major ethnic groups, and the importance of updated data to align with global standards.
He said, “Additional upgrades include installation of walkie-talkies for improved communication, enhanced street lighting, and CCTV cameras to monitor activity.
“These improvements aim to position Computer Village as a world-class market, comparable to international hubs like Dubai and Singapore.”
JAMB Waxes Worriedly over Rising Digital Exam Fraud
9mobile Nigeria Inks Agreement to Roam with MTN
Banks, Telcos to Start Deducting USSD Charges from Airtime Today
NIMC Plans to Register 95 Percent Nigerians by December
IHS Nigeria Moves to Enhance G4S Secure Solutions Site Patrols and Increase Operational Efficiency with Patrol Vehicles
E-Business2 days agoFarmers to Get Identity Card for Loans, Inputs
Telecom2 days agoARCON Probes 9mobile over Alleged N1Bn Advertising Debt
News2 days agoSERAP Sues NNPC over Alleged Missing ₦500Bn, Seeks Accountability
News2 days agoFirst Asset Management Receives 2024 Fund Manager Award
E-Business2 days agoDyna.Ai Launches Operations in Nigeria
General News2 days agoNigeria Relaunches National Talent Export Programme to Unlock $1 Trillion Global Outsourcing Market
Telecom2 days agoNiRA Holds 17th AGM, Elects New Leadership to Propel .ng Domain Growth
News2 days agoIkeja Computer Village Begins Biometrics Registration to Tackle Crime