Telecom
Sophos’ Active Adversary Playbook 2022 Reveals 36% Increase in Dwell Time Attackers
Sophos, a global leader in next-generation cybersecurity, has released the “Active Adversary Playbook 2022,” detailing attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021.
John Shier, senior security advisor at Sophos
The findings show a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 days in 2020.
The report also reveals the impact of ProxyShell vulnerabilities in Microsoft Exchange, which Sophos believes some Initial Access Brokers (IABs) leveraged to breach networks and then sell that access to other attackers.
“The world of cybercrime has become incredibly diverse and specialized. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. “In this increasingly dynamic, specialty-based cyberthreat landscape, it can be hard for organizations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralize attacks as fast as possible.”
Sophos’ research also shows that intruder dwell time was longer in smaller organizations’ environments. Attackers lingered for approximately 51 days in organizations with up to 250 employees, while they typically spent 20 days in organizations with 3,000 to 5,000 employees.
“Attackers consider larger organizations to be more valuable, so they are more motivated to get in, get what they want and get out. Smaller organizations have less perceived ‘value,’ so attackers can afford to lurk around the network in the background for a longer period. It’s also possible these attackers were less experienced and needed more time to figure out what to do once they were inside the network. Lastly, smaller organizations typically have less visibility along the attack chain to detect and eject attackers, prolonging their presence,” said Shier. “With opportunities from unpatched ProxyLogon and ProxyShell vulnerabilities and the uprise of IABs, we’re seeing more evidence of multiple attackers in a single target. If it’s crowded within a network, attackers will want to move fast to beat out their competition.”
Additional key findings in the playbook include:
- The median attacker dwell time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources. The median dwell time for organizations hit by ransomware was 11 days. For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. Organizations in the education sector or with fewer than 500 employees also had longer dwell times
- Longer dwell times and open entry points leave organizations vulnerable to multiple attackers. Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously
- Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020
- Common tool combinations used in attacks provide a powerful warning signal of intruder activity. For example, the incident investigations found that in 2021 PowerShell and malicious non-PowerShell scripts were seen together in 64% of cases; PowerShell and Cobalt Strike combined in 56% of cases; and PowerShell and PsExec were found in 51% of cases. The detection of such correlations can serve as an early warning of an impending attack or confirm the presence of an active attack
- Fifty percent of ransomware incidents involved confirmed data exfiltration – and with the available data, the mean gap between data theft and the deployment of ransomware was 4.28 days. Seventy-three percent of incidents Sophos responded to in 2021 involved ransomware. Of these ransomware incidents, 50% also involved data exfiltration. Data exfiltration is often the last stage of the attack before the release of the ransomware, and the incident investigations revealed the mean gap between them was 4.28 days and the median was 1.84 days
- Conti was the most prolific ransomware group seen in 2021, accounting for 18% of incidents overall.REvil ransomware accounted for one in 10 incidents, while other prevalent ransomware families included DarkSide, the RaaS behind the notorious attack on Colonial Pipeline in the U.S. and Black KingDom, one of the “new” ransomware families to appear in March 2021 in the wake of the ProxyLogon vulnerability. There were 41 different ransomware adversaries identified across the 144 incidents included in the Of these, around 28 were new groups first reported during 2021. Eighteen ransomware groups seen in incidents in 2020 had disappeared from the list in 2021
“The red flags that defenders should look out for include the detection of a legitimate tool, combination of tools, or activity in an unexpected place or at an uncommon time,” said Shier. “It is worth noting that there may also be times of little or no activity, but that doesn’t mean an organization hasn’t been breached. There are, for instance, likely to be many more ProxyLogon or ProxyShell breaches that are currently unknown, where web shells and backdoors have been implanted in targets for persistent access and are now sitting silently until that access is used or sold. Defenders need to be on the alert for any suspicious signals and investigate immediately. They need to patch critical bugs, especially those in widely used software, and, as a priority, harden the security of remote access services. Until exposed entry points are closed and everything that the attackers have done to establish and retain access is completely eradicated, just about anyone can walk in after them, and probably will.”
The Sophos Active Adversary Playbook 2022 is based on 144 incidents in 2021, targeting organizations of all sizes, in a wide range of industry sectors, and located in the U.S., Canada, the U.K., Germany, Italy, Spain, France, Switzerland, Belgium, Netherlands, Austria, the United Arab Emirates, Saudi Arabia, the Philippines, the Bahamas, Angola, and Japan. The most represented sectors are manufacturing (17%), followed by retail (14%), healthcare (13%), IT (9%), construction (8%), and education (6%).
The aim of Sophos’ report is help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on the network. To learn more about attacker behaviors, tools and techniques, read the Sophos Active Adversary Playbook 2022 on Sophos News.
Telecommunications and digital services provider, Globacom, has partnered with the Federal Ministry of Communications, Innovation and Digital Economy and Huawei Nigerian Enterprises, to provide digital access to 7,000 remote communities in Nigeria with the commissioning of the pilot project in Isuanin Kura in Ibwa 2, Gwagwalada, on the outskirts of the Federal Capital Territory, Abuja on Wednesday.
The project, which is championed by the Ministry, will deliver 2G/3G/4G services, free public Wi-Fi access, digital healthcare and remote learning capabilities to the over 12,000 residents of the community.
Minister of Communications, Innovation and Digital Economy, Dr. Bosun Tijani, was full of commendation to Globacom and Huawei for supporting President Bola Tinubu’s commitment to addressing the connectivity crisis affecting more than 20 million Nigerians who currently lack basic telecommunication access in the country.
Said he: “If you bring out your phone in many communities, there is no network at all. This is costing the country significantly because people cannot access financial services, medical care, or education”, adding that this also poses governance challenges as disconnected areas are difficult to administer.
“Where you live should not determine your access to opportunity. We are using innovation to ensure every Nigerian, regardless of location, can thrive in the digital age”, the Minister added.
Globacom’s Group Chief Technical Director, Mr. Sanjib Roy, who spoke on the project said the company worked with the Ministry and Huawei to bring up the site by providing the Microwave backhaul link and access to Globacom’s full core network resources and also manage the operation of the site to ensure uninterrupted voice and data services for the community.
“The Smart Education facility allows for young students within the community to receive education remotely, with the teachers being in Abuja or any other part of the world, while Healthcare delivery has been revolutionised through connected medical equipment that enables remote consultations between patients in Ibwa and doctors and specialists in urban-locations”, Mr Roy explained. The site and all the equipment are powered by solar thereby ensuring clean environment and uninterrupted power supply.
During the inauguration, the system’s effectiveness was demonstrated with the leader of Isuanin Kura, Ibwa 2 Community, Chief Abubakar Bamaiyi, having a live consultation with a medical doctor in Abuja, while the Minister and other guests watched as the students in the local school were being taught via online video by a teacher in Lagos, using equipment provided by Huawei.
Mr Kazeem Kaka, Globacom’s Head of Division, North West, who also spoke at event, said, “For Globacom, this is a continuation of our long-standing mission to democratize access to communication. Since 2003, we have remained at the forefront of efforts to lower the barriers to connectivity—making telephony, internet, and data services more accessible and affordable for all Nigerians.
“Today’s launch reinforces that commitment. We are particularly excited about the impact this initiative will have on education, healthcare, and economic empowerment of Ibwa people”.
In his remarks, Mr Terrens Wu, Managing Director, Huawei Nigerian Enterprises, said his company was proud to be part of the initiative to provide connectivity, and promote learning and healthcare in rural communities through digital technology. His company later gave out 120 affordable smartphones to the community to help them have access to telephony.
National Identity Management Commission (NIMC) has unveiled an ambitious plan to register at least 95% of Nigerians into the National Identity Database before the end of 2025, aligning with President Bola Tinubu’s Renewed Hope Agenda on digital governance and inclusive development.
Speaking at a media briefing in Abuja, NIMC Director-General Abisoye Coker-Odusote outlined the agency’s strategy, which includes expanded registration centers, improved infrastructure, and intensified public sensitization campaigns.
“As part of our efforts, we are launching the Ward Enrollment Exercise to ensure that at least 95% of Nigerians are captured by December,” she stated.
NIMC reported that over 120 million Nigerians have already been enrolled, with the target set to register an additional 100 million before year-end. Coker-Odusote emphasized that the exercise would provide the government with accurate population data, enabling better planning and resource allocation.
Addressing concerns about data security and public trust, the NIMC boss assured Nigerians that robust measures have been put in place to safeguard personal information.
She highlighted initiatives such as the NIN Authentication system, which allows individuals to control access to their data through user consent management.
Additionally, NIMC is collaborating with security agencies to track and shut down fraudulent NIN websites while working alongside the Nigeria Data Protection Commission (NDPC) to ensure that enrollment officers receive proper certification in data handling.
“To foster trust, we are ensuring that all personnel handling data are certified experts through NDPC training programs,” she explained.
Looking ahead, Coker-Odusote revealed that NIMC is actively working to integrate all ministries, departments, and agencies (MDAs) to eliminate fragmented operations.
She also disclosed plans to launch a Public Key Infrastructure (PKI) initiative, which will enhance trust in government transactions and digital interactions.
“In the near future, MDAs will be able to implement digital signing across platforms, seamlessly exchanging documents within and between various establishments, thereby advancing e-government and the digital economy,” she added.
The mass enrollment drive, coupled with the strengthening of cybersecurity frameworks, positions Nigeria for an inclusive and efficient national identity system that will serve as a foundation for digital transformation.
As artificial intelligence (AI) continues to transform the global digital landscape, two prominent technology leaders have issued urgent warnings and strategic calls for Nigeria and Africa to adopt a unified, governance-driven approach to AI development, emphasizing that trust, regulation, and cybersecurity are more important than ever.
L-r: Dr. Krishnan Ranganath, Regional Executive, West Africa, Africa Data Centres, Adewale Obadare, chief visionary officer, Digital Encode, Amrish Singhal, chief operations officer, Spectranet, Engr. Ike Nnamani, Managing Director, Digital Realty Nigeria and Rudman Muhammed, Managing Director, Internet Exchange Point of Nigeria, at the 16th Africa’s Beacon of ICT Merit and Leadership awards held in Lagos recently.
At the 2025 Africa’s Beacon of ICT Merit & Leadership Award (ABoICT 2025), held over the weekend in Lagos, Professor Adewale Peter Obadare, Chief Visionary Officer of Digital Encode, and Amrich Singhal, Chief Operating Officer of Spectranet, independently but powerfully echoed the same sentiment: AI without governance is a ticking time bomb.
Delivering his keynote on “AI Governance, Standardization and Cybersecurity in the AI Era,” Prof. Obadare warned against the rising trend of “AI washing”—where companies label basic software or services as “AI” to capitalize on hype, often without the underlying technological integrity or oversight.
“People are calling everything AI today, from photography apps to basic automation, but no one is talking about AI governance,” he said.
Drawing comparisons to the early days of the internet, Obadare cautioned that failing to integrate security and governance into AI architecture could lead to far-reaching consequences. “We are repeating the same mistake we made with TCP/IP, which was not built with cybersecurity in mind. We cannot afford to make that error again.”
He emphasized that governance should not be seen as a hindrance but as an enabler of safe innovation. “Governance is not a brake to stop movement; it is a brake to make movement safe,” he said.
Citing international standards like ISO/IEC 42001 and ISO/IEC 38507, Obadare called for responsible innovation grounded in clear ethical guidelines, stressing the importance of securing the core components of AI: data, models, and infrastructure.
Echoing similar concerns, Amrich Singhal, chief operating officer, Spectranet in his presentation themed “Responsible AI and Nigeria: Balancing Innovation, Regulation, and Cybersecurity,” stressed that “the countries that will benefit most from AI are not necessarily those with the most powerful models, but those with the most trusted systems.”
Singhal painted AI as a double-edged sword, capable of boosting national productivity while also enabling new forms of cyber manipulation—from deepfakes to identity theft and disinformation. “AI can clone voices, create fake personas, and even undermine democracy. It’s no longer a question of readiness, it’s a question of urgency,” he declared.
He acknowledged Nigeria’s potential due to its youthful, tech-savvy population and its expanding use of AI across sectors like healthcare, agriculture, education, and oil exploration.
However, he criticized existing regulatory structures such as the Nigeria Data Protection Regulation (NDPR) and NITDA’s 2023 draft AI framework as being “underdeveloped, underfunded, and poorly enforced.”
Both experts called for a multi-stakeholder approach to AI governance. Prof. Obadare warned of real-world failures, such as Microsoft’s racist chatbot Tay, Amazon’s gender-biased recruitment AI, and Uber’s fatal autonomous vehicle incident, not as tech failures, but as governance failures.
He also cited cybersecurity breaches, including the 2023 hacking of OpenAI’s ChatGPT and the leak of DeepSeek’s API keys and user data on launch day, to stress that “the danger is not just in the algorithms, but in how we design and deploy them.”
Singhal proposed a three-tiered strategy to build Nigeria’s AI resilience: government must champion AI education, create safe innovation sandboxes, and enforce data laws; private companies must adopt ethical and secure design practices; and civil society must raise awareness of digital rights and AI risks—especially for vulnerable populations.
In a firm conclusion, Prof. Obadare urged that “governance must be embedded by design,” warning that irresponsible innovation has already proven costly and called on both developers and policymakers to act before Nigeria’s AI future becomes a liability rather than a strength.
Meanwhile, Singhal closed with a stark challenge: “AI is already here. The question is not whether to use it, but how. Nigeria must choose whether AI will be a great equalizer or its greatest vulnerability.”
As the nation moves deeper into the AI era, the message is clear: building trust, enforcing cybersecurity, and embedding responsible governance must be at the core of Nigeria’s AI journey, before it’s too late.
Uche Uzoebo, SANEF CEO Makes Case for More Financial Inclusion Strategies Targeting Women
Survey Reveals Marketing Leaders See Strong Potential in gTLDS Despite Knowledge Gap
UK Minister for Africa Visits Nigeria to Deepen Strategic Partnership
Hydrogen, Lagos State Touch Thousands of Business Owners with “Healthy Heart, Healthy Business” Outreach
ACAMB Champions Bankers Wellness with Aerobics Fitness Session
Telecom2 days agoGlo, Huawei, Communications Ministry Bring Digital Services to Abuja Village
E-Financial2 days agoSEC Alerts Public on Silverkuun, Trending Dubious Investment Schemes
General News2 days agoTripoint Travels Hosts Pre-GEC Brunch for Nigerian Delegates Ahead of Global Entrepreneurship Congress 2025
E-Financial2 days agoAfrica Cross-border Payments Set to Hit $1 trillion by 2035
News2 days agoPalmPay Launches CSR Initiatives to Empower Women, Foster Financial Literacy in Northern Nigeria
Telecom2 days agoExperts @ ABoICT 2025 Warn of Digital Disaster Risks in Nigeria Without AI Governance
E-Financial2 days agoSANEF, CIBN Partner to Expand Agency Banking Certification
Broadcasting2 days agoDStv Makes History: Inducted into Brand Africa Hall of Fame as Africa’s Most Admired Media Brand