Telecom
Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds

Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.

Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.
After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.
While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.
“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.
“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.
“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.
“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”
Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.
While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.
In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.
Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.
Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.
However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.
“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.
“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.
To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).
For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.
Telecom
Compensation for Poor Service Quality is Automatic- NCC

Nigerian Communications Commission (NCC) has said that compensation of subscribers for poor service quality, such as persistent network outages or failed calls is automatic.

This initiative aims to ensure fairness by mandating that operators provide automatic compensation, such as airtime credits, for failing to meet regulatory Quality of Service Key Performance Indicators (KPIs).
According to the NCC, operators are required and mandated to identify affected subscribers and provide compensation directly.
In a framework for compensation of consumers published on its website, NCC said that it has directed Mobile Network Operators (MNOs) to compensate subscribers affected by prolonged or repeated poor quality of service experience within specific Local Government Areas where operators fail to meet regulatory Quality of Service Key Performance Indicators (KPIs).
The NCC also stated that the directive does not replace existing consumer protection mechanisms.
The NCC, said the directive adds a direct compensation mechanism for affected subscribers and aligns with measures set in existing legislations such as the Consumer Code of Practice Regulations 2024 and the Quality of Service Regulations 2024.
This directive applies to only Mobile Network Operators licensed and operating in Nigeria that have failed to meet their Key Performance Indicators on Quality of Service. For Internet Service Providers (ISPs) operating in Nigeria, a compensation framework is already in place.
To be eligible to receive compensation
. You experienced poor network service in an affected Local Government Area; and
- You made at least one outgoing revenue generating event (billed call, SMS, or data session) during the relevant period.
The compensation covers service failures affecting voice, data, or SMS services.
Operators are required and mandated by existing regulations to monitor their network performance across locations and service disruptions against Quality of Service KPIs.
This enables them to identify affected subscribers without the need for individual complaints.
Only service failures that fall below the defined thresholds set by the Quality of Service Regulations issued by the NCC will qualify for compensation.
Short, isolated interruptions and immediately remedied interruptions may not qualify
Compensation will be provided in the form of airtime credits.
This airtime credit will not have utilisation restrictions, and subscribers will be able to use it for voice calls, USSD sessions, data subscriptions, etc on the operators’ network.
Telecom
FG Moves to Strengthen Cybersecurity Coordination as NDPC Probes Alleged Data Breach

Federal Government has announced plans to deepen collaboration with private sector players and other stakeholders in a bid to strengthen Nigeria’s cybersecurity architecture and response systems.

NDPC
Minister of Communications, Innovation and Digital Economy, Bosun Tijani, disclosed this in a recent press statement, noting that the government is considering the establishment of a Cybersecurity Coordination Council.
According to the minister, the proposed council is aimed at enhancing national cyber resilience and ensuring a more coordinated response to emerging cyber threats across public and private institutions.
Tijani emphasised that cybersecurity must be treated as a collective responsibility involving government, industry, and civil society.
“Cybersecurity is a shared national responsibility. Protecting Nigeria’s digital economy requires strong partnerships, trusted collaboration, and collective vigilance across government, industry, and civil society,” he said.
He added that through sustained collaboration, Nigeria would strengthen its capacity to detect cyber threats early, respond effectively, and build a resilient and trusted digital ecosystem.
The minister also called for increased stakeholder participation in shaping a sustainable, partnership-driven cybersecurity framework capable of deterring cybercriminal activities and safeguarding citizens, businesses, and critical digital infrastructure.
Meanwhile, the Nigeria Data Protection Commission (NDPC) has commenced an investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank, and other entities.
In a statement signed by its Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, the commission said notices of investigation were issued to relevant parties on April 1, 2026.
The NDPC noted that affected organisations and individuals are currently providing information to aid its inquiry into the incident.
“The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures,” the statement read.
It added that the probe would examine the types of personal data involved, the scope and nature of the alleged breach, potential risks to data subjects, and mitigation steps taken where breaches are confirmed.
The commission further disclosed that its National Commissioner and Chief Executive Officer, Vincent Olatunji, has directed a broader review of organisations operating digital payment systems.
According to the NDPC, entities found to be non-compliant with provisions of the Nigeria Data Protection Act, 2023, particularly regarding technical and organisational safeguards, would be scrutinised as part of efforts to maintain the integrity of the nation’s data protection ecosystem.
Telecom
Bharti Airtel Crosses 650m Users

Sunil Mittal led Bharti Airtel has crossed the 650-million customer mark globally, fortifying its position as the world’s second-largest telecom operator by mobile subscriber base, as per a regulatory filing by the telecom operator.

“According to GSMA Intelligence, Bharti Airtel is ranked second globally by mobile customer base, with operations spread across India and Africa,” the filing said.
Commenting on this milestone, Gopal Vittal, executive vice chairman, Bharti Airtel, said: “Achieving the milestone of 650 million customers to be the second largest operator globally is a great responsibility for us to serve our customers better every day,”
He added that the telco strives to raise the bar on innovation, reliability, and experience so that every customer interaction is an opportunity to earn trust and deliver value connection.
Currently, Airtel India serves around 368 million mobile customers, meanwhile over 179 million users have been plugged into its subsidiary Airtel Africa spread across 14 countries.
Its mobile money platform, Airtel Money reached more than 52 million customers.
Additionally, the telco serves around 13 million homes with high-speed internet services and over 15 million through its Digital TV offering.
With operations spanning 15 countries and network coverage reaching over two billion people, analysts say that the latest milestone is a testimony to the natural curve of evolving from a telecom operator into a broader digital services provider.
General News3 days agoFG, Others Say Nigeria Wastes 38m Tonnes of Food Annually
E-Financial3 days agoCBN, Banks, Fintechs Launch PSPC to Boost Nigeria’s Payment System
News3 days agoNITDA Strengthens Collaboration with NIPSS to Drive Digital Innovation, Orange Economy Growth
E-Financial2 days agoN4.65 Trillion in the Vault, but is the Real Economy Locked Out?
E-Financial3 days agoCycleFlow, IFC Launch Supply Chain Finance Platform in Nigeria
E-Financial3 days agoAnchor Gets Nigerian, Canadian Licences as Transactions Crosses $2.5Bn
General News2 days agoUnion Bank Looted: How Former Directors Gambled with Billions and Nearly Destroyed a National Bank
E-Financial3 days agoEcobank Assures of Seamless Easter Banking Services



















