Telecom
Sophos’ Active Adversary Playbook 2022 Reveals 36% Increase in Dwell Time Attackers
Sophos, a global leader in next-generation cybersecurity, has released the “Active Adversary Playbook 2022,” detailing attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021.
John Shier, senior security advisor at Sophos
The findings show a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 days in 2020.
The report also reveals the impact of ProxyShell vulnerabilities in Microsoft Exchange, which Sophos believes some Initial Access Brokers (IABs) leveraged to breach networks and then sell that access to other attackers.
“The world of cybercrime has become incredibly diverse and specialized. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. “In this increasingly dynamic, specialty-based cyberthreat landscape, it can be hard for organizations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralize attacks as fast as possible.”
Sophos’ research also shows that intruder dwell time was longer in smaller organizations’ environments. Attackers lingered for approximately 51 days in organizations with up to 250 employees, while they typically spent 20 days in organizations with 3,000 to 5,000 employees.
“Attackers consider larger organizations to be more valuable, so they are more motivated to get in, get what they want and get out. Smaller organizations have less perceived ‘value,’ so attackers can afford to lurk around the network in the background for a longer period. It’s also possible these attackers were less experienced and needed more time to figure out what to do once they were inside the network. Lastly, smaller organizations typically have less visibility along the attack chain to detect and eject attackers, prolonging their presence,” said Shier. “With opportunities from unpatched ProxyLogon and ProxyShell vulnerabilities and the uprise of IABs, we’re seeing more evidence of multiple attackers in a single target. If it’s crowded within a network, attackers will want to move fast to beat out their competition.”
Additional key findings in the playbook include:
- The median attacker dwell time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources. The median dwell time for organizations hit by ransomware was 11 days. For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. Organizations in the education sector or with fewer than 500 employees also had longer dwell times
- Longer dwell times and open entry points leave organizations vulnerable to multiple attackers. Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously
- Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020
- Common tool combinations used in attacks provide a powerful warning signal of intruder activity. For example, the incident investigations found that in 2021 PowerShell and malicious non-PowerShell scripts were seen together in 64% of cases; PowerShell and Cobalt Strike combined in 56% of cases; and PowerShell and PsExec were found in 51% of cases. The detection of such correlations can serve as an early warning of an impending attack or confirm the presence of an active attack
- Fifty percent of ransomware incidents involved confirmed data exfiltration – and with the available data, the mean gap between data theft and the deployment of ransomware was 4.28 days. Seventy-three percent of incidents Sophos responded to in 2021 involved ransomware. Of these ransomware incidents, 50% also involved data exfiltration. Data exfiltration is often the last stage of the attack before the release of the ransomware, and the incident investigations revealed the mean gap between them was 4.28 days and the median was 1.84 days
- Conti was the most prolific ransomware group seen in 2021, accounting for 18% of incidents overall.REvil ransomware accounted for one in 10 incidents, while other prevalent ransomware families included DarkSide, the RaaS behind the notorious attack on Colonial Pipeline in the U.S. and Black KingDom, one of the “new” ransomware families to appear in March 2021 in the wake of the ProxyLogon vulnerability. There were 41 different ransomware adversaries identified across the 144 incidents included in the Of these, around 28 were new groups first reported during 2021. Eighteen ransomware groups seen in incidents in 2020 had disappeared from the list in 2021
“The red flags that defenders should look out for include the detection of a legitimate tool, combination of tools, or activity in an unexpected place or at an uncommon time,” said Shier. “It is worth noting that there may also be times of little or no activity, but that doesn’t mean an organization hasn’t been breached. There are, for instance, likely to be many more ProxyLogon or ProxyShell breaches that are currently unknown, where web shells and backdoors have been implanted in targets for persistent access and are now sitting silently until that access is used or sold. Defenders need to be on the alert for any suspicious signals and investigate immediately. They need to patch critical bugs, especially those in widely used software, and, as a priority, harden the security of remote access services. Until exposed entry points are closed and everything that the attackers have done to establish and retain access is completely eradicated, just about anyone can walk in after them, and probably will.”
The Sophos Active Adversary Playbook 2022 is based on 144 incidents in 2021, targeting organizations of all sizes, in a wide range of industry sectors, and located in the U.S., Canada, the U.K., Germany, Italy, Spain, France, Switzerland, Belgium, Netherlands, Austria, the United Arab Emirates, Saudi Arabia, the Philippines, the Bahamas, Angola, and Japan. The most represented sectors are manufacturing (17%), followed by retail (14%), healthcare (13%), IT (9%), construction (8%), and education (6%).
The aim of Sophos’ report is help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on the network. To learn more about attacker behaviors, tools and techniques, read the Sophos Active Adversary Playbook 2022 on Sophos News.
Nigerian Communications Commission (NCC) has reiterated its commitment to safeguarding telecommunications infrastructure across the country, in line with President Bola Tinubu’s Executive Order, which criminalises the vandalism, theft or obstruction of critical national infrastructure.
The Commission noted that the enforcement drive is aimed at curbing the growing incidence of sabotage at telecom sites, which continues to degrade the quality of network services nationwide.
Speaking during a courtesy visit by the Executive of the Nigeria Union of Journalists (NUJ), Federal Capital Territory (FCT) Council to the Commission’s headquarters in Abuja, Mrs Nnenna Ukoha, head of Public Affairs at the NCC, reaffirmed the Commission’s resolve to act.
She stated, “President Tinubu signed the Executive Order on 24th June 2024, declaring telecom infrastructure as Critical National Information Infrastructure (CNII). The NCC is now mandated to implement this order fully, and anyone found tampering with these facilities will face the full weight of the law.”
Mrs Ukoha, who represented Dr Aminu Maida, executive vice chairman and chief executive officer, added that the NCC has launched a nationwide awareness campaign to sensitise the public about the significance of protecting critical national infrastructure, including telecom, energy and transport facilities.
Expressing concern over rampant damage, she said, “The destruction of fibre cables, theft of generators and fuel, and removal of key components from telecom base stations have become all too common. These acts directly affect the quality of service that millions of Nigerians depend on.”
She identified three major challenges undermining telecom service delivery:
Vandalism and Theft: “We are witnessing frequent attacks on telecom sites. These lead to service outages and cost operators billions in repairs.”
Restricted Site Access: “Operators face obstruction from local communities, touts and even some government officials who demand levies, making it difficult to access sites for maintenance and refuelling.”
Road Construction Damage: “Ongoing road projects often result in accidental damage to underground fibre cables, further compounding the situation.”
Responding to public complaints about fast-depleting data, Mrs Ukoha clarified that “mobile network operators do not steal users’ data. What many people experience is due to automatic app updates, background processes, and hotspots being shared unknowingly.”
She advised users to be proactive: “We encourage consumers to review their phone settings, limit background data, turn off auto-play videos, and regularly change hotspot passwords.”
Commending the media, she added, “Journalists play a vital role in educating the public. We appreciate your efforts and urge continued partnership in disseminating accurate, impactful information.”
She also revealed the Commission’s drive to improve digital inclusion: “The NCC is committed to supporting underserved communities with affordable internet access and has commenced specialised training for journalists, particularly senior editors in Lagos and Abuja.”
Mrs Ukoha emphasised collaboration with government agencies to reduce infrastructure damage: “As construction projects expand nationwide, we must work together to prevent unnecessary damage to telecom assets.”
Also speaking, Mallam Yakubu Musa, head, Corporate Communications, NCC, reinforced the importance of the media in the telecom ecosystem.
He said, “Our partnership with the press is key to promoting transparency, building consumer trust, and supporting regulatory compliance.”
In her remarks, Comrade Grace Ike, chairman, NUJ FCT, commended the NCC’s regulatory efforts and expressed interest in deeper collaboration.
She stated, “We look forward to partnering with the NCC on media training, expanding internet access for journalists, and enhancing public awareness. We also seek your support for our forthcoming Press Week and capacity-building programmes.”
She continued, “The NUJ recognises the importance of digital tools in journalism. Equipping media professionals with access and knowledge will strengthen democratic engagement and promote good governance.”
The NUJ delegation, comprising key executives and media team members, reiterated its commitment to working closely with the NCC to promote national development.
This enforcement initiative—anchored on President Tinubu’s July 2024 Executive Order—provides a solid legal framework for protecting vital telecom infrastructure and ensuring uninterrupted communication services.
Telecom
Africa’s Lawmakers Commit to Strengthening AI, Digital Health and Smart Manufacturing Frameworks
The Pan-African Parliament (PAP) and the African Population Health Research Center (APHRC), in collaboration with the GSMA, have concluded the first Africa Digital Parliamentary Summit focused on building legislative capacity in Artificial Intelligence (AI), data protection, digital health and smart manufacturing, in a bid to promote evidence-based policy-making for Africa’s digital future.
The three-day Summit, held from 9-11 July in Lusaka, convened over 20 Members of Parliament from the Pan-African Parliament Committees on Transport, Industry, Communications, Energy, Science and Technology, and Health, Labour and Social Affairs and was opened by the Zambian Minister of Technology and Science, Honourable Felix Mutati. Strategic partners in attendance included AUDA-NEPAD, Africa CDC, ECOSOCC, and the African Peer Review Mechanism (APRM).
This concluded with the publication of the Lusaka Declaration outlining shared priorities and next steps for ensuring Africa’s digital transformation is inclusive, responsible and grounded in evidence-based policy.
The Lusaka Declaration recognised the vital role of Members of Parliament in shaping laws and policies that drive the continent’s development. The Digital Parliamentary Summit offered a timely platform to enhance the knowledge and capacity of Parliamentarians on critical aspects of digital transformation.
A key highlight of the Summit was the consideration and discussion with Parliamentarians on the draft Africa Digital Health and Smart Manufacturing reports developed by APHRC and the GSMA.
Both reports will be submitted to the Plenary of the PAP when Parliamentarians of the 55 member states of the African Union meet in Midrand later this month on the occasion of the 5th Ordinary Session of the 6th Legislature of the Pan-African Parliament.
Honourable Behdja Mokrani, Chairperson of the Pan-African Parliament Committee on Transport, Industry, Communications, Energy, Science and Technology said “Against the backdrop of global economic uncertainties and the accelerating pace of technological disruption, this Summit has highlighted the critical need to equip African legislators with the foresight and capabilities required to navigate the Fourth Industrial Revolution.
The capacity-building component of the Summit, along with the presentation of the Africa Digital Health and Smart Manufacturing Reports by APHRC and GSMA, reinforced the importance of African policymakers acquiring the relevant skills to address policy issues related to digital transformation – particularly in the areas of Digital Health and Smart Manufacturing – in alignment with the African Union’s Agenda 2063.
Anthony Mveyange, Director of Programs, Synergy, African Population Health Research Center adds “At APHRC, we firmly believe that digital health is a transformative force, holding immense potential for Africa to ‘leapfrog’ traditional development pathways.
This Summit powerfully demonstrates how, by leveraging AI alongside advancements in digital health and smart manufacturing, we can accelerate socio-economic progress and foster deeper continental integration, directly aligning with the ambitious goals of the African Union’s Agenda.”
Key themes explored during the Summit included:
- The potential of AI-driven digital health to accelerate universal health coverage through better data integration and cross-border information exchange
- The role of smart manufacturing in enhancing industrial resilience and job creation through automation and IoT
- The need for harmonised, Africa-led data governance frameworks to ensure responsible AI development and protect privacy and human rights
“AI, digital health, and smart manufacturing have the potential to transform Africa’s economies and improve lives – but unlocking that potential requires the right policy environment.
“This Summit is an important step in equipping lawmakers with the tools to shape secure, inclusive and future-ready digital economies” said Kenechi Okeleke, Senior Director, Regional, Social and Policy Research, GSMA.
Participants reaffirmed their commitment to advancing digital transformation through coordinated reforms, including:
- Strengthening STEM education and digital literacy among policymakers
- Embedding ICT training in public service development
- Establishing cross-sector collaboration between the health, trade and ICT sectors
- Creating enabling conditions for investment in advanced connectivity infrastructure
Draft findings presented during the Summit estimate that Africa’s digital health market could reach $6.5 billion by 2030 under an optimistic scenario, highlighting the urgent need for policy alignment to maximise impact and drive inclusive growth.
The Summit also set out a roadmap for ongoing engagement between the Pan-African Parliament, APHRC and the GSMA, including the establishment of ‘Evidence-to-Policy’ resource units, sustained capacity-building efforts, and regional forums to harmonise legislation on AI, digital health, and data governance across Africa.
MTN Foundation hosted its annual Anti-Substance Abuse Programme (ASAP) Conference on July 9, 2025, at the MTN Rooftop in Ikoyi, Lagos, bringing together stakeholders from government, healthcare, education, security, civil society, and the private sector to address the growing challenge of drug abuse among Nigerian youth.
L-R: Tobe Okigbo, Chef Corporate Services Officer, MTN Nigeria; Archieabia Ibinabo, Assistant Commander General of Narcotics, representative of Brig. Gen Mohammed Buba Marwa, Chairman/CEO, National Drug Law Enforcement Agency (NDLEA); Barrister Abimbola Salu-Hundeyin, Secretary to the Lagos State Government, (representative of His Excellency, Governor of Lagos State, Mr. Babajide Sanwo-Olu); RT. Honourable Princess Lasbat Mojisola Meranda, Deputy Speaker, Lagos State Assembly; Dr. Mosun Olusoga, Chairman, MTN Foundation; Odunayo Sanya, Executive Director, MTN Foundation, and Dr. Tolu Ajomale, Head of Special Projects and Mental Health, Lagos State Ministry of Health (representative of Prof. Akin Abayomi, Commissioner for Health, Lagos State) during the MTN Anti-Substance Abuse Programme (ASAP) Lagos Conference held in commemoration of World Drug Day at the MTN Rooftop, Ikoyi, Lagos on Wednesday, July 9, 2025.
Prominent attendees included Dr. Mosun Olusoga, Chairman of MTN Foundation; Barrister Bimbola Salu-Hundeyin, Secretary to the Lagos State Government; and Dr. Tolu Ajomale of the Lagos Ministry of Health, among others. Also present were representatives of NDLEA, UNODC, academia, psychologists, recovery advocates, and youth leaders.
Speaking on behalf of Governor Babajide Sanwo-Olu, Salu-Hundeyin reaffirmed Lagos State’s commitment to safeguarding its youth and fostering a future free from substance abuse. Dr. Olusoga emphasized that drug addiction extends beyond health, touching families, communities, and national well-being, calling for proactive, united action.
MTN Nigeria’s Chief Corporate Services Officer, Tobe Okigbo, stressed the company’s long-standing dedication to youth development through initiatives like ASAP. NDLEA’s Assistant Commander General of Narcotics, Archieabia Ibinabo, representing Brigadier General Buba Marwa, commended MTN Foundation as a vital ally in drug prevention efforts.
The conference featured personal stories of recovery in a session titled “Journeys Through the Fire,” followed by a panel discussion on multi-sectoral solutions to substance abuse. It concluded with a dramatic performance, “Just One Breath,” by LASU’s WADA Club, illustrating the personal and societal toll of drug use.
Executive Director of the MTN Foundation, Odunayo Sanya, closed the event with a powerful call to action, urging media, communities, and policymakers to drive sustained investment in youth empowerment and early intervention.
The Foundation reaffirmed its commitment to building resilience among young Nigerians and catalyzing cross-sector partnerships for a drug-free future.
EFCC Says Corrupt Politicians are Using Crypto Wallets to Launder Money
UBA Expands to More African Cities, Stamps Footprint in Saudi Arabia
NCC Speaks of Plans to Secure Telecom Infrastructure Nationwide
Africa’s Lawmakers Commit to Strengthening AI, Digital Health and Smart Manufacturing Frameworks
Ecobank Plans to Raise $250m Capital Through Private Placement
E-Financial2 days agoGOEs’ Remit Over ₦2tn to FG in 2024
News1 day agoCheck Point Report Finds Africa as Top Target for Cyber-attacks
Telecom2 days agoSave & Win: FCMB Promo Makes 12 Millionaires, Over 3,000 Winners
Telecom2 days agoMTN’s Karl Toriola and Business Leaders Champion Corporate Climate Reform
General News2 days agoSenate Orders Full Probe into N1.3 Trillion CBEX Ponzi Scandal
E-Business2 days agoNITDA Reaffirms Commitment to 95% Digital Literacy by 2030, as UBEC Pledges Collaboration
General News2 days agoUpSkill Universe Launches ‘Skills for Business’ to Empower 10,000 African SMEs, in Collaboration with HP and Google
Telecom2 days agoAnambra Deepens Digital Reforms, Eyes Top Ranking in Ease of Doing Business