Telecom
Sophos’ Active Adversary Playbook 2022 Reveals 36% Increase in Dwell Time Attackers
Sophos, a global leader in next-generation cybersecurity, has released the “Active Adversary Playbook 2022,” detailing attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021.
John Shier, senior security advisor at Sophos
The findings show a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 days in 2020.
The report also reveals the impact of ProxyShell vulnerabilities in Microsoft Exchange, which Sophos believes some Initial Access Brokers (IABs) leveraged to breach networks and then sell that access to other attackers.
“The world of cybercrime has become incredibly diverse and specialized. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. “In this increasingly dynamic, specialty-based cyberthreat landscape, it can be hard for organizations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralize attacks as fast as possible.”
Sophos’ research also shows that intruder dwell time was longer in smaller organizations’ environments. Attackers lingered for approximately 51 days in organizations with up to 250 employees, while they typically spent 20 days in organizations with 3,000 to 5,000 employees.
“Attackers consider larger organizations to be more valuable, so they are more motivated to get in, get what they want and get out. Smaller organizations have less perceived ‘value,’ so attackers can afford to lurk around the network in the background for a longer period. It’s also possible these attackers were less experienced and needed more time to figure out what to do once they were inside the network. Lastly, smaller organizations typically have less visibility along the attack chain to detect and eject attackers, prolonging their presence,” said Shier. “With opportunities from unpatched ProxyLogon and ProxyShell vulnerabilities and the uprise of IABs, we’re seeing more evidence of multiple attackers in a single target. If it’s crowded within a network, attackers will want to move fast to beat out their competition.”
Additional key findings in the playbook include:
- The median attacker dwell time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources. The median dwell time for organizations hit by ransomware was 11 days. For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. Organizations in the education sector or with fewer than 500 employees also had longer dwell times
- Longer dwell times and open entry points leave organizations vulnerable to multiple attackers. Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously
- Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020
- Common tool combinations used in attacks provide a powerful warning signal of intruder activity. For example, the incident investigations found that in 2021 PowerShell and malicious non-PowerShell scripts were seen together in 64% of cases; PowerShell and Cobalt Strike combined in 56% of cases; and PowerShell and PsExec were found in 51% of cases. The detection of such correlations can serve as an early warning of an impending attack or confirm the presence of an active attack
- Fifty percent of ransomware incidents involved confirmed data exfiltration – and with the available data, the mean gap between data theft and the deployment of ransomware was 4.28 days. Seventy-three percent of incidents Sophos responded to in 2021 involved ransomware. Of these ransomware incidents, 50% also involved data exfiltration. Data exfiltration is often the last stage of the attack before the release of the ransomware, and the incident investigations revealed the mean gap between them was 4.28 days and the median was 1.84 days
- Conti was the most prolific ransomware group seen in 2021, accounting for 18% of incidents overall.REvil ransomware accounted for one in 10 incidents, while other prevalent ransomware families included DarkSide, the RaaS behind the notorious attack on Colonial Pipeline in the U.S. and Black KingDom, one of the “new” ransomware families to appear in March 2021 in the wake of the ProxyLogon vulnerability. There were 41 different ransomware adversaries identified across the 144 incidents included in the Of these, around 28 were new groups first reported during 2021. Eighteen ransomware groups seen in incidents in 2020 had disappeared from the list in 2021
“The red flags that defenders should look out for include the detection of a legitimate tool, combination of tools, or activity in an unexpected place or at an uncommon time,” said Shier. “It is worth noting that there may also be times of little or no activity, but that doesn’t mean an organization hasn’t been breached. There are, for instance, likely to be many more ProxyLogon or ProxyShell breaches that are currently unknown, where web shells and backdoors have been implanted in targets for persistent access and are now sitting silently until that access is used or sold. Defenders need to be on the alert for any suspicious signals and investigate immediately. They need to patch critical bugs, especially those in widely used software, and, as a priority, harden the security of remote access services. Until exposed entry points are closed and everything that the attackers have done to establish and retain access is completely eradicated, just about anyone can walk in after them, and probably will.”
The Sophos Active Adversary Playbook 2022 is based on 144 incidents in 2021, targeting organizations of all sizes, in a wide range of industry sectors, and located in the U.S., Canada, the U.K., Germany, Italy, Spain, France, Switzerland, Belgium, Netherlands, Austria, the United Arab Emirates, Saudi Arabia, the Philippines, the Bahamas, Angola, and Japan. The most represented sectors are manufacturing (17%), followed by retail (14%), healthcare (13%), IT (9%), construction (8%), and education (6%).
The aim of Sophos’ report is help security teams understand what adversaries do during attacks and how to spot and defend against malicious activity on the network. To learn more about attacker behaviors, tools and techniques, read the Sophos Active Adversary Playbook 2022 on Sophos News.
Telecom companies should invest in sophisticated anti-fraud tools that employ machine learning and Artificial Intelligence (AI) to enhance detection and response times while conducting regular audits to ensure that systems remain up-to date and effective.
That’s according to Pricewaterhouse Coopers (PwC’s) latest paper on AI fraud in the Telecom sector.
The paper notes the dual role of Artificial Intelligence as both a threat and a shield highlights the need for Nigerian telecom operators to adopt AI deliberately and strategically.
It calls for a deeper understanding of how technological disruption is transforming fraud risks today and how those risks may evolve in the.
The professional services firm noted that the rapid adoption of AI is reshaping the fraud landscape in the telecommunications sector, enabling criminals to automate scams, impersonate victims through deepfake technologies, and scale fraudulent schemes with unprecedented speed.
The 16-page report, titled ‘AI’s Dual Role in Telecom Fraud’, noted that while AI is helping fraudsters launch more sophisticated attacks, the same technology can also serve as a powerful defensive tool for telecom operators and financial institutions.
“AI has tremendous potential to drive positive change across sectors, but it also enables fraudsters to create and disseminate scams quickly and at scale,” PwC said, warning that the expanding digital ecosystem linking telecom networks and financial services is creating new vulnerabilities.
Fraud has long posed a significant challenge for telecom operators worldwide, resulting in financial losses, reputational damage, and regulatory scrutiny.
Globally, telecom fraud was estimated at approximately $38.95 bn in 2023, highlighting the scale of the problem. In Nigeria, the sector has also faced rising risks.
According to the Nigerian Communications Commission (NCC), citizens lost approximately N12.5 bn to telecom-related financial crimes between 2019 and January 2023.
PwC said the growing integration between telecom networks and financial services, such as mobile money platforms and digital banking, is further complicating the fraud landscape.
“When fraud occurs across interconnected platforms, both telecommunications and financial services providers face regulatory scrutiny and erosion of customer trust,” the report said.
The firm added that telecom operators are increasingly becoming critical infrastructure for digital financial services, exposing them to greater risk as criminals target the ecosystem.
Despite these risks, PwC said telecom companies have a unique advantage in the fight against fraud due to the vast amount of network and customer data they possess.
By deploying advanced AI systems, telcos can detect suspicious activity patterns, flag unusual call behaviour, and identify fraudulent transactions in real time.
For example, AI-driven pattern recognition can analyse large datasets to detect irregular call durations, unusual call frequencies, or activity occurring at odd hours, indicators that may signal fraudulent activity.
Machine learning models trained on historical fraud cases can also help identify subtle warning signs that traditional detection systems might miss.
PwC noted that some telecom operators are already deploying AI-powered spam detection tools capable of analysing hundreds of behavioural parameters to determine whether a message is fraudulent.
Real-time data analysis, the firm added, can allow companies to block fraudulent activities before they cause major financial damage.
Beyond fraud detection, AI can also help organisations respond more effectively to incidents.
Using natural language processing, generative AI systems can convert technical security data into simplified reports tailored for regulators, executives, and compliance officers.
However, PwC said technology alone will not be enough to curb the growing threat.
The firm stressed that stronger collaboration between telecom operators, financial institutions, and regulators is essential to prevent fraud from spreading across digital platforms.
Telecom companies, it said, possess sophisticated tools capable of monitoring call patterns and network behaviour, which could help banks detect suspicious activities such as SIM swap attempts.
At the same time, banks have developed advanced fraud detection algorithms that could enhance telecom operators’ ability to identify suspicious activity across their networks.
“By sharing insights and real-time threat intelligence, both sectors can strengthen their individual and collective defences,” PwC said.
The firm cited international examples where such collaboration has improved fraud detection and response times, including initiatives in the United Kingdom, Singapore, Australia, and the Philippines. PwC also emphasised the importance of closer engagement with regulators such as the Central Bank of Nigeria and the Nigerian Communications Commission to ensure clear and responsive regulatory frameworks that support innovation while protecting consumers.
MTN Nigeria expanded its lead in Nigeria’s fixed broadband market after adding 13,433 subscribers to its fibre-to-the-home service in December 2025. The gains come as smaller providers struggle to retain users amid rising demand for high-speed internet.
Industry data from the Nigerian Communications Commission (NCC) showed sharp subscriber losses among smaller operators.
21st Century Technologies saw its subscriber base fall from 175 in December to 82 in January, a drop of more than 50 percent.
SWIFT Nigeria recorded an even larger decline.
The company lost 11,285 users, with total subscribers falling from 25,484 to 14,199, a 44.3 percent decrease.
The gap between large infrastructure providers and smaller operators is widening as broadband demand grows across Nigeria.
Companies with extensive fibre networks can offer faster speeds and wider coverage, while smaller competitors face higher costs and limited scale.
MTN has accelerated its investment in network infrastructure to maintain its lead.
The company spent ₦1 trillion, or about $715 million, in capital expenditure in 2025, more than double the ₦443.5 billion invested in 2024.
The investment followed a return to profitability, with profit after tax reaching ₦1.1 trillion after losses in 2024 linked to foreign-exchange pressures.
Spending focused on network modernization, 4G expansion, 5G rollout and deeper fibre deployment.
The operator expanded its fibre-to-the-home footprint to about 4 million households, concentrating deployments in Lagos, Abuja, Port Harcourt, Kano and Ibadan as data traffic rose 34 percent.
Network vandalism remains a challenge. MTN recorded 9,218 fibre cuts in 2025, an average of 25 incidents per day, affecting 211 base stations.
Key Takeaways
Nigeria’s broadband market is entering a scale phase where infrastructure investment is becoming the main competitive advantage.
Telecom operators with strong balance sheets are deploying billions of naira into fibre networks to capture demand for high-speed connectivity driven by streaming, remote work, digital payments and cloud services.
Fibre infrastructure also strengthens mobile networks by connecting base stations and improving 4G and 5G performance.
However, the economics of building and maintaining fibre networks remain challenging in emerging markets. Infrastructure vandalism, power supply instability and high deployment costs increase operational risk.
These factors make it difficult for smaller internet service providers to compete with large telecom operators that can spread costs across millions of customers.
As demand for broadband continues to grow in Africa’s largest economy, the sector may see further consolidation, with dominant operators strengthening their market position while regulators face increasing pressure to maintain competition and affordable access to high-speed internet.
credit…. dabafinance.com
Telecom
VDT Communications Achieves Two Prestigious Certifications ISO /IEC 27001:2022, ISO/IEC 27032:2023 Reinforcing its Leadership in Broadband Service Provision
VDT Communications Limited, a provider of Enterprise communication solutions, is proud to announce that it has been awarded the ISO/IEC 27001:2022 Information Security Management System (ISMS) and ISO/IEC 27032:2023 Cybersecurity Management System certifications.
These prestigious certifications demonstrate VDT’s commitment to maintaining the highest standards of information security and cybersecurity, ensuring the protection of sensitive customer data and maintaining the trust of its clients.
These certifications are a testament to VDT’s dedication to implementing robust information security and cybersecurity measures, aligning with international best practices.
The ISO/IEC 27001:2022 certification recognizes VDT’s ability to establish, implement, maintain, and continually improve its ISMS, ensuring the confidentiality, integrity, and availability of customer information. The ISO/IEC 27032:2023 certification highlights its commitment to protecting its customers’ information assets and preventing Cyber threats.
VDT Communications Limited has consistently demonstrated its commitment to excellence, previously earning and maintaining ISO 9001:2015 Quality Management System and ISO 20000-1:2018 IT Service Management certifications. These certifications have enabled the company to deliver high-quality services, ensuring customer satisfaction and loyalty.
“We are thrilled to receive these two prestigious certifications, which reinforce our commitment to information security and cybersecurity. These certifications demonstrate our dedication to implementing robust security measures that ensure confidentiality, integrity and availability of customer data” said Engr. Abiodun Omoniyi, GMD of VDT Communications Limited.
The ISO/IEC 27001:2022 and ISO/IEC 27032:2023 certifications bring numerous benefits to VDT’s customers, including:
- Enhanced information security and cybersecurity posture
- Protection of sensitive customer data
- Compliance with international standards and regulations
- Improved risk management and incident response
- Increased trust and confidence in VDT’s services
“We are proud to serve our customers with the highest level of security and quality,” Bimbo Ikumariegbe, Chief Operating Officer (COO) of VDT. “These certifications demonstrate our commitment to excellence and our dedication to delivering innovative communication solutions that meet the evolving needs of our customers” – Olufemi Akinola, Head, Information Technology.
Breaking…….Nigerian Firms Pledge Millions, Create UK Jobs
Crypto Transactions Hit $96Bn in Nigeria -SEC
PwC Warns Nigeria Telcos of AI Fraud Risks
Lawyer Drags FG Court over Controversial Health Data Sharing Agreement with US
Elumelu Tags Elon Musk, Disowns AI-Generated Scam Video
Kaspersky Discovers New Phishing Campaign Exploiting Google Tasks Notifications to Steal Corporate Credentials
esentry 2025 Report Shows Healthcare, Financial Services and Telecoms as Staging Grounds for Increased Cyberattacks in Africa
AfDB, UNDP Launch $10Bn AI Initiative for Africa
Mutual Benefits Assurance Settles ₦5.9bn Claims in January 2026
MultiChoice Suspends Yearly DStv Price Hike as Canal+ Pushes Growth
E-Financial2 days agoCBN Rolls Out New Rules for Safer Instant Payments, More Customer Control
News2 days agoNIMMME Inaugurates Engr. Michael Orekyeh as 13th National Chairman in Abuja
Telecom2 days agoMTN Nigeria Races Ahead in Fibre Broadband Market
E-Financial2 days agoCBN Tightens BVN Rules to Curb Fraudulent Banking Transactions
E-Financial2 days agoNova Bank Appoints Jude Anele as Managing Director/CEO
E-Business2 days agoTech Expert Unveils BAT-BOT AI App to Curb Fake News ahead of 2027 Elections
Broadcasting23 hours agoSpotify’s Loud & Clear Report Reveals Over ₦60Bn Revenue for Nigerian Artists in 2025
Telecom23 hours agoPwC Warns Nigeria Telcos of AI Fraud Risks