Connect with us

Telecom

Sophos Research Reveals that Attackers Are Using Log4Shell Vulnerability to Deliver Backdoors to Virtual Servers

Published

on

Kindly share this post

Sophos, a global leader in next-generation cybersecurity, has released findings on how attackers are using the Log4Shell vulnerability to deliver backdoors and profiling scripts to unpatched VMware Horizon servers, paving the way for persistent access and future ransomware attacks. A new technical paper, “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers,” details the tools and techniques used to compromise the servers and deliver three different backdoors and four cryptominers. The backdoors are possibly delivered by Initial Access Brokers.

Log4Shell is a remote code execution vulnerability in the Java logging component, Apache Log4J, which is embedded in hundreds of software products. It was reported and patched in December 2021.

“Widely used applications such as VMware Horizon that are exposed to the internet and need to be manually updated, are particularly vulnerable to exploitation at scale,” said Sean Gallagher, senior security researcher at Sophos. “Sophos detections reveal waves of attacks targeting Horizon servers, starting in January, and delivering a range of backdoors and cryptominers to unpatched servers, as well as scripts to collect some device information. Sophos believes that some of the backdoors may be delivered by Initial Access Brokers looking to secure persistent remote access to a high value target that they can sell on to other attackers, such as ransomware operators.”

The multiple attack payloads Sophos detected using Log4Shell to target vulnerable Horizon servers include:

·         Two legitimate remote monitoring and management tools, Atera agent and Splashtop Streamer, likely intended for malicious use as backdoors

·         The malicious Sliver backdoor

·         The cryptominers z0Miner, JavaX miner, Jin and Mimu

·         Several PowerShell-based reverse shells that collect device and backup information

Sophos’ analysis revealed that Sliver is sometimes delivered together with Atera and PowerShell profiling scripts and is used to deliver the Jin and Mimu variants of the XMrig Monero miner botnet.

According to Sophos, the attackers are using several different approaches to infect targets. While some of the earlier attacks used Cobalt Strike to stage and execute the cryptominer payloads, the largest wave of attacks that began in mid-January 2022, executed the cryptominer installer script directly from the Apache Tomcat component of the VMware Horizon server. This wave of attacks is ongoing.

“Sophos’ findings suggest that multiple adversaries are implementing these attacks, so the most important protective step is to upgrade all devices and applications that include Log4J with the patched version of the software. This includes patched versions of VMware Horizon if organizations use the application in their network,” said Gallagher.

“Log4J is installed in hundreds of software products and many organizations may be unaware of the vulnerability lurking in within their infrastructure, particularly in commercial, open-source or custom software that doesn’t have regular security support. And while patching is vital, it won’t be enough if attackers have already been able to install a web shell or backdoor in the network. Defense in depth and acting upon any detection of miners and other anomalous activity is critical to avoid falling victim to such attacks.”

For further information read the article “Horde of Miner Bots and Backdoors Leveraged Log4J to Attack VMware Horizon Servers” on Sophos News.

Sophos has closely monitored attack activity related to the Log4Shell vulnerability and has published a number of in depth technical and advisory reports, including  Log4Shell Hell – Anatomy of an Exploit Outbreak, Log4Shell Response and Mitigation Recommendations, Inside the Code: How the Log4Shell Exploit Works, and Log4Shell: No Mass Abuse, But No Respite, What Happened?

Additional Resources

·  Sophos endpoint products, such as Intercept X, protect users by detecting the actions and behaviors of attackers

. Further details on the evolving cyberthreat landscape can be found in the Sophos 2022 Threat Report

. Tactics, techniques, and procedures (TTPs) and more for different types of threats are available on SophosLabs Uncut, which provides Sophos’ latest threat intelligence

. Information on attacker behaviors, incident reports and advice for security operations professionals is available on Sophos News SecOps

. Learn more about Sophos’ Rapid Response Service that contains, neutralizes and investigates attacks 24/7
The four top tips for responding to a security incident  from Sophos Rapid Response and the Managed Threat Response Team

 

 

 
 
 

Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Telecom

Telecoms Subscribers to Petition National Assembly Over Controversial 5% Tax

Published

on

Kindly share this post

The National Association of Telecoms Subscribers (NATCOMS) has announced plans to petition the National Assembly over the Federal Government’s renewed push to impose a 5% excise duty on telecommunications services.

The association, representing millions of telecom users in Nigeria, is set to meet on Wednesday to finalize its petition, urging lawmakers to halt any legislative approval of the proposed tax while a court case challenging its implementation is ongoing.

The case, currently before the Lagos Division of the Federal High Court, has been adjourned to March 13, 2025. NATCOMS President, Adeolu Ogunbanjo, told The newsmen on Monday that the petition is necessary to prevent the National Assembly from unknowingly passing the tax into law.

“We are meeting this Wednesday to finalize the arrangement to write the National Assembly. If we don’t inform them that there is a pending court case, the Assembly might unknowingly pass the bill into law. That would be disastrous for subscribers and the industry,” Ogunbanjo said.

NATCOMS has consistently criticized the proposed excise duty as excessive and detrimental to telecom users. Ogunbanjo noted that telecom services are already subject to over 40 different taxes, and adding another levy would significantly increase the financial burden on subscribers. The association’s National Secretary and Legal Adviser, Bayo Omotubora, described the tax as double taxation and unconstitutional.

“The case is before the Lagos High Court and has been adjourned to March 13, 2025. Until a decision is made, implementing this tax would be illegal and unconstitutional. The Federal Government must respect the judicial process,” Omotubora said.

The 5% excise duty is part of a broader tax reform initiative outlined in the proposed “Nigeria Tax Act.” The bill seeks to consolidate tax laws and impose taxes on various transactions, including telecom services regulated by the Nigerian Communications Commission.

Introduced in 2022 under former President Muhammadu Buhari, the tax faced public backlash, leading to its suspension in July 2023 by President Bola Tinubu. However, the government has recently revived the plan to boost revenue amidst economic challenges.

NATCOMS emphasized that the government must wait for the court’s decision before proceeding with the tax. “We are not just fighting for the legality of this tax but also to protect millions of Nigerians who rely on affordable telecom services,” Omotubora added.

The association’s petition to the National Assembly will highlight the ongoing legal battle and the economic implications of the proposed tax. “The Federal Government must respect the judicial process and suspend any action on this tax until the matter is resolved in court,” Ogunbanjo said.

NATCOMS has called on stakeholders to join its fight against the tax, describing it as an unnecessary burden on telecoms subscribers and the industry.


Kindly share this post
Continue Reading

Telecom

Airtel Directors Win Honours @ CIO Awards

Published

on

Kindly share this post

Airtel Nigeria’s leadership team has demonstrated outstanding excellence in innovation and technology as two of its directors were honoured with three prestigious awards at the 5th edition of the CIO & C-Suite Awards, held on Saturday, 30th November 2024, at the Civic Centre, Victoria Island, Lagos.

The annual awards, organized by CIO Club Africa, celebrates outstanding achievements in technology and innovation leadership across 11 African nations, recognizing individuals and organizations shaping the future of the tech industry.

During the event, Harmanpreet Dhillon, Chief Technology Officer, Airtel Nigeria was recognised as Overall Tech Champion of the Year and also received the Gold Award as an Innovative Leader in the Telecommunications Sector. Also, the Director of Information and Technology, Airtel Nigeria, Kemi Ariyo, was recognized with the Silver Award as an Innovative  Leader in the same category, highlighting her significant contributions to the sector.

While expressing his gratitude for the recognition, Mr. Harmanpreet Dhillon dedicating the awards to the efforts of the Airtel team.

“At Airtel, we are fully committed to continuous innovation and excellence and I must say this is a reflection of the relentless efforts and dedication of the entire Airtel Nigeria team. These awards inspire us to continue breaking barriers and achieving excellence through innovative technology,” he said.

The event brought together technology leaders, including Chief Technology Officers (CTOs), Chief Information Officers (CIOs), tech visionaries, security experts, and innovation pioneers who share a united goal of shaping the future of technology and driving transformative progress across industries.

In her remarks at the event, Kemi Ariyo also emphasised the importance of professional honours in encouraging innovation across the industry, stating, “Awards like these are a motivation to keep contributing meaningfully to the industry and to push the boundaries of what is possible in technology and telecommunications.”

These achievements reflect the brand’s commitment to excellence, innovation, and setting new benchmarks in the telecommunications industry.


Kindly share this post
Continue Reading

Telecom

Interswitch and CeBIH Join Forces to Promote Payment System Vision 2030

Published

on

Kindly share this post

Interswitch Group, a leading integrated payments and digital commerce company in Africa, has been unveiled as key Sponsor of the Committee of e-Business Industry Heads (CeBIH) 2024 Conference.

The conference which started yesterday at the Eko Convention Centre, Victoria Island, Lagos, explores the theme “Payment System Vision 2030: Navigating Contemporary Issues in Driving Future Growth.”

CeBIH is made up of top-tier electronic business practitioners from all banks in Nigeria, with the primary objective of promoting electronic banking services that align with global best practices.

The CeBIH 2024 Conference will play a pivotal role in advancing the goals of Payment System Vision (PSV) 2030 by evaluating progress, highlighting key milestones, and addressing challenges within the payment ecosystem.

The PSV 2030 is a strategic framework developed by the Central Bank of Nigeria (CBN) to guide the evolution of the country’s payment systems over the next decade. Building on the success of previous initiatives like the Payment System Vision 2020, PSV 2030 aims to further advance financial inclusion, drive innovation in the payments sector, and support the broader digital economy in Nigeria.

In a keynote address titled, “The Impact of Globalization and the Gig Economy on Inclusive Payment Systems in Nigeria”, Mitchell Elegbe, Founder and Group Managing Director, Interswitch, stated: “We are proud to support CeBIH and the 2024 CeBIH annual conference as it aligns perfectly with our vision of building seamless, secure, and future-ready payment systems for Africa.

“This partnership highlights Interswitch’s commitment to drive innovation and advance the payments ecosystem.

“Together, we aim to address the evolving challenges in digital payments and contribute to the development of a robust, inclusive, and sustainable digital economy across Africa.”

The conference which ends today will generate policy recommendations aimed at creating a supportive environment for the growth and sustainability of Nigeria’s payment ecosystem.

Interswitch’s sponsorship of the 2024 CeBIH annual conference underlines its ongoing commitment to drive innovation and shape the future of payments in Nigeria.


Kindly share this post
Continue Reading

Trending