Connect with us

Telecom

Sophos’ Active Adversary Playbook 2022 Reveals 36% Increase in Dwell Time Attackers

Published

on

Kindly share this post

Sophos, a global leader in next-generation cybersecurity, has released the “Active Adversary Playbook 2022,” detailing attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021.

John Shier, senior security advisor at Sophos

The findings show a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 days in 2020.

The report also reveals the impact of ProxyShell vulnerabilities in Microsoft Exchange, which Sophos believes some Initial Access Brokers (IABs) leveraged to breach networks and then sell that access to other attackers.

“The world of cybercrime has become incredibly diverse and specialized. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. “In this increasingly dynamic, specialty-based cyberthreat landscape, it can be hard for organizations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralize attacks as fast as possible.”

Sophos’ research also shows that intruder dwell time was longer in smaller organizations’ environments. Attackers lingered for approximately 51 days in organizations with up to 250 employees, while they typically spent 20 days in organizations with 3,000 to 5,000 employees.

“Attackers consider larger organizations to be more valuable, so they are more motivated to get in, get what they want and get out. Smaller organizations have less perceived ‘value,’ so attackers can afford to lurk around the network in the background for a longer period. It’s also possible these attackers were less experienced and needed more time to figure out what to do once they were inside the network. Lastly, smaller organizations typically have less visibility along the attack chain to detect and eject attackers, prolonging their presence,” said Shier. “With opportunities from unpatched ProxyLogon and ProxyShell vulnerabilities and the uprise of IABs, we’re seeing more evidence of multiple attackers in a single target. If it’s crowded within a network, attackers will want to move fast to beat out their competition.”

Additional key findings in the playbook include:

  • The median attacker dwell time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources. The median dwell time for organizations hit by ransomware was 11 days. For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. Organizations in the education sector or with fewer than 500 employees also had longer dwell times
  • Longer dwell times and open entry points leave organizations vulnerable to multiple attackers. Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously
  • Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020
  • Common tool combinations used in attacks provide a powerful warning signal of intruder activity. For example, the incident investigations found that in 2021 PowerShell and malicious non-PowerShell scripts were seen together in 64% of cases; PowerShell and Cobalt Strike combined in 56% of cases; and PowerShell and PsExec were found in 51% of cases. The detection of such correlations can serve as an early warning of an impending attack or confirm the presence of an active attack
  • Fifty percent of ransomware incidents involved confirmed data exfiltration – and with the available data, the mean gap between data theft and the deployment of ransomware was 4.28 days. Seventy-three percent of incidents Sophos responded to in 2021 involved ransomware. Of these ransomware incidents, 50% also involved data exfiltration. Data exfiltration is often the last stage of the attack before the release of the ransomware, and the incident investigations revealed the mean gap between them was 4.28 days and the median was 1.84 days
  • Conti was the most prolific ransomware group seen in 2021, accounting for 18% of incidents overall.REvil ransomware accounted for one in 10 incidents, while other prevalent ransomware families included DarkSide, the RaaS behind the notorious attack on Colonial Pipeline in the U.S. and Black KingDom, one of the “new” ransomware families to appear in March 2021 in the wake of the ProxyLogon vulnerability. There were 41 different ransomware adversaries identified across the 144 incidents included in the Of these, around 28 were new groups first reported during 2021. Eighteen ransomware groups seen in incidents in 2020 had disappeared from the list in 2021

“The red flags that defenders should look out for include the detection of a legitimate tool, combination of tools, or activity in an unexpected place or at an uncommon time,” said Shier. “It is worth noting that there may also be times of little or no activity, but that doesn’t mean an organization hasn’t been breached. There are, for instance, likely to be many more ProxyLogon or ProxyShell breaches that are currently unknown, where web shells and backdoors have been implanted in targets for persistent access and are now sitting silently until that access is used or sold. Defenders need to be on the alert for any suspicious signals and investigate immediately. They need to patch critical bugs, especially those in widely used software, and, as a priority, harden the security of remote access services. Until exposed entry points are closed and everything that the attackers have done to establish and retain access is completely eradicated, just about anyone can walk in after them, and probably will.”

The Sophos Active Adversary Playbook 2022 is based on 144 incidents in 2021, targeting organizations of all sizes, in a wide range of industry sectors, and located in the U.S., Canada, the U.K., Germany, Italy, Spain, France, Switzerland, Belgium, Netherlands, Austria, the United Arab Emirates, Saudi Arabia, the Philippines, the Bahamas, Angola, and Japan. The most represented sectors are manufacturing (17%), followed by retail (14%), healthcare (13%), IT (9%), construction (8%), and education (6%).

The aim of Sophos’ report is help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on the network. To learn more about attacker behaviors, tools and techniques, read the Sophos Active Adversary Playbook 2022 on Sophos News.


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Continue Reading
Advertisement
Comments

Telecom

Minister Claims Bandits Exploit Poor Network, Bounce Calls Off Multiple Towers

Published

on

Kindly share this post

Bosun Tijani, minister of Communications, Innovation and Digital Economy, yesterday claimed that bandits and terrorists are able to communicate and coordinate their activities with ease because they exploit gaps in the country’s telecommunications network.

Minister Claims Bandits Exploit Poor Network, Bounce Calls Off Multiple Towers

Bosun Tijani, minister of Communications, Innovation and Digital Economy,

Tijani, who spoke  Politics Today, a Channels Television’s programme, on Friday, Tijani said the criminals exploit gaps in the country’s telecommunications network.

He also claimed the bandits use advanced technology to bounce calls across multiple towers in areas with poor connectivity.

“They weren’t using the normal towers; they bounced calls off multiple towers, which is why they favor areas that are largely unconnected,” he said.

When asked about reports that unregistered or fraudulently registered SIM cards are still in use despite the Bank Verification Number (BVN) and the National Identification Number (NIN)–Subscriber Identity Module linkage policies, Tijani said the issue is technically complex and the reports are not fully verified.

“Whether it’s fact or not, I do not know where you’re getting that from, and I do not know who has evidence that there are people with unregistered SIMs,” he added.

The minister stated that the federal government is investing in telecom towers in underserved regions, upgrading the country’s communication satellites to improve coverage, and expanding fiber-optic networks to strengthen the country’s digital infrastructure.

“If our towers are not working, our satellites will work. Nigeria is the only country in West Africa with communication satellites, and we are bringing new satellites to upgrade their capabilities,” Tijani said.

He added that these initiatives aim to ensure better connectivity for Nigerians while closing loopholes that criminals exploit, thereby enhancing national security.

The minister’s comments come amid rising concerns over insecurity in several parts of the North, where banditry, kidnapping, and terrorism have escalated in recent years.

There are also reports of bandits flaunting ransom payments on social media platforms such as TikTok, raising alarm among authorities and the public


Kindly share this post
Continue Reading

Telecom

Sophos XDR Achieves its Best-Ever Results in the MITRE ATT&CK Enterprise 2025 Evaluation

Published

on

Kindly share this post

Sophos, a global leader of innovative security solutions for defeating cyberattacks, has announced its best-ever results in the MITRE ATT&CK Enterprise 2025 Evaluation.

Sophos XDR Achieves its Best-Ever Results in the MITRE ATT&CK Enterprise 2025 Evaluation

MITRE ATT&CK Enterprise 2025 Evaluation

Sophos XDR detected 100% of adversary behaviors (sub-steps)1 across two complex attack scenarios: Scattered Spider, which Sophos X-Ops tracks as GOLD HARVEST, a financially motivated cybercriminal collective, and Mustang Panda, which Sophos X-Ops tracks as BRONZE PRESIDENT, a People’s Republic of China (PRC) espionage group.

The Scattered Spider scenario included activity across Windows, Linux, and AWS cloud environments, and the Mustang Panda scenario focused on Windows only.

Further, Sophos achieved the highest-possible “Technique”-level rating for 86 out of 90 total sub-steps in the evaluation, by generating high-fidelity detections with details on execution, impact, and adversary behavior, providing clear who, what, when, where, how, and why insights.

Sophos XDR achieved:

  • 100% detection coverage1 for all 90 adversary sub-steps across two complex attack scenarios across Windows, Linux, and AWS cloud environments
  • Highest possible (“Technique”) ratings for 86 of 90 sub-steps, demonstrating deep visibility and actionable detections
  • Highest possible (“Technique”) ratings for 61 out of 62 of sub-steps in the Scattered Spider scenario involving identity abuse, cloud exploitation, and data exfiltration

“Scattered Spider and Mustang Panda represent distinct threat profiles that challenge defenders in very different ways,” said Simon Reed, chief research and scientific officer, Sophos. “Achieving full detection coverage against both validates the accuracy and depth of Sophos’ analytics and demonstrates how the company’s AI-native XDR platform converts complex telemetry into clear, actionable intelligence, helping security teams detect, understand, and stop advanced attacks with confidence.

“Sophos’ consistently strong performance in these rigorous evaluations underscores the power and precision of our threat detection and response capabilities, and our commitment to stopping the world’s most sophisticated cyberthreats.

“Over the five years that Sophos has participated in ATT&CK Evaluations, we have continually invested in strengthening our platform, and that investment has translated into stronger results year after year – both in the evaluations, and in the security outcomes we deliver for our customers.”

These results demonstrate the power of the Sophos XDR platform to defend against sophisticated cyber threats. Every day, Sophos processes 223+ terabytes of telemetry in Sophos Central, generating 34+ million detections and automatically blocking 11+ million threats.

This scale of customer insights ensures that Sophos’ detections are being tested and improved to provide continuous protection while delivering stronger outcomes for organizations worldwide.

Understanding The Threat Actors

Sophos X-Ops has tracked GOLD HARVEST (Scattered Spider) since 2022, observing a loosely affiliated cybercriminal collective driven by both financial motives and a desire to elevate their reputations on underground forums.

Despite several arrests, operators and associates continue to launch high-profile attacks across the U.K. and U.S., at times partnering with major Russian-speaking ransomware groups.

Their sophisticated social engineering capabilities enable them to compromise even well-defended organizations, underscoring the importance of strong behavioral detections within modern security operations.

In parallel, Sophos X-Ops has monitored BRONZE PRESIDENT (Mustang Panda) for many years.

This long-running PRC espionage group conducts intelligence-led operations that align closely with priorities of China’s Ministry of State Security. Recent targeting includes activity against Tibetan communities surrounding the Dalai Lama’s 90th birthday, as well as intrusions on Thai government and military offices during periods of heightened regional tension.

BRONZE PRESIDENT remains one of the most active and persistent state-aligned threat actors operating today.

MITRE ATT&CK Evaluations are among the world’s most rigorous independent security tests.

They emulate the tactics, techniques, and procedures (TTPs) used by real-world adversaries to assess each participating vendor’s ability to detect, analyze, and articulate threats in alignment with the MITRE ATT&CK Framework.

These evaluations continually strengthen Sophos’ capabilities for the benefit of the organizations it protects. This was the seventh round of MITRE’s “Enterprise” ATT&CK Evaluation, a product-focused assessment designed to help organizations better understand how security operations solutions like Sophos EDR and Sophos XDR can help them defend against sophisticated, multi-stage attacks.

When evaluating EDR or XDR solutions, Sophos recommends reviewing MITRE ATT&CK Evaluations alongside other independent proof points.


Kindly share this post
Continue Reading

Telecom

CBN, NCC to Launch Short Code for Swift Consumer Complaint Resolution

Published

on

Kindly share this post

Central Bank of Nigeria (CBN) on Thursday announced plans to partner with the Nigerian Communications Commission (NCC) to develop an industry-wide short code for consumers to lodge complaints with financial institutions anytime, anywhere, even without internet access.

CBN, NCC to Launch Short Code for Swift Consumer Complaint Resolution

CBN

Dr Aisha Isa-Olatinwo, CBN Director, Consumer Protection and Financial Inclusion Department, disclosed this at a virtual Consumer Protection Town Hall meeting titled “Ask the Regulator”, organised by Enhancing Financial Inclusion and Advancement (EFInA).

She said the initiative addresses challenges faced by vulnerable consumers using feature phones who often have to visit bank branches physically to report issues amid the convergence of telecom and banking services.

Isa-Olatinwo said the CBN had achieved 94 per cent month-on-month timely resolution of consumer complaints, adding that the apex bank had streamlined processes and partnered with banks to balance consumer protection with financial system stability.

An EFInA poll presented at the event revealed that 61 per cent of respondents experienced failed transactions in the past 12 months, while 26 per cent had reversals within 24 hours and 54 per cent between 24 and 48 hours.

Other complaints included six per cent for fraud, 14 per cent for hidden charges and 15 per cent for poor customer service, with 66 per cent of respondents aware of complaint escalation steps.

President of Consumer Advocacy Foundation of Nigeria (CAFON), Mrs Sola Salako-Ajulo, lamented that consumers often feel unprotected and urged introduction of fraud insurance for instant reversals, shifting the burden of proof from customers.

She said: “What is missing in our system—unlike more developed economies—is fraud insurance, where banks reverse reported fraud immediately, refund consumers, and investigate later.”

Mr Ajibade Laolu-Adewale, Chairman of Committee of e-Business Industry Heads (CeBIH), represented by Mr Adeyemi Salisu, stressed that banks must resolve disputes between acquiring and issuing banks without redirecting customers to merchants.

The short code initiative is expected to enhance financial inclusion by providing accessible redress mechanisms in Nigeria’s evolving digital payment ecosystem.


Kindly share this post
Continue Reading

Trending