Telecom
Sophos CryptoGuard Technology Reveals How Attackers Increased Their Use of Remote Ransomware by 62% Annually
Sophos, a global leader in innovating and delivering cybersecurity as a service, has released a report, titled “CryptoGuard: An Asymmetric Approach to the Ransomware Battle,” which found that some of the most prolific and active ransomware groups, including Akira, ALPHV/BlackCat, LockBit, Royal, Black Basta, are deliberately switching on remote encryption for their attacks.
In remote encryption attacks, also known as remote ransomware, adversaries leverage a compromised and often underprotected endpoint to encrypt data on other devices connected to the same network.
Sophos CryptoGuard is the anti-ransomware technology that Sophos acquired in 2015* and is included in all Sophos Endpoint licenses. CryptoGuard monitors the malicious encryption of files and provides immediate protection and rollback capabilities, including when the ransomware itself never appears on a protected host.
The unique anti-ransomware technology is a last line of defense in Sophos’ layered endpoint protection, only activating if an adversary triggers it later in the attack chain.
CryptoGuard detected a 62% year-over-year increase in intentional remote encryption attacks since 2022.
“Companies can have thousands of computers connected to their network, and with remote ransomware, all it takes is one underprotected device to compromise the entire network. Attackers know this, so they hunt for that one ‘weak spot’—and most companies have at least one. Remote encryption is going to stay a perennial problem for defenders, and based, on the alerts we’ve seen, the attack method is steadily increasing,” said Mark Loman, vice president, threat research at Sophos, and the co-creator of CryptoGuard.
Since this type of attack involves encrypting files remotely, traditional anti-ransomware protection methods deployed on remote devices don’t “see” the malicious files or their activity, failing to protect them from unauthorized encryption and potential data loss. Sophos CryptoGuard technology, however, takes an innovative approach to stopping remote ransomware, as explained in the Sophos X-Ops article: analyzing the contents of files to see if any data became encrypted to detect ransomware activity on any device in a network, even if there is no malware on the device.
In 2013, CryptoLocker was the first prolific ransomware to utilize remote encryption with asymmetric encryption, also known as public-key cryptography. Since then, adversaries have been able to escalate the use of ransomware, due to ubiquitous, ongoing security gaps at organizations worldwide and the advent of cryptocurrency.
“When we first noticed CryptoLocker taking advantage of remote encryption ten years ago, we foresaw that this tactic was going to become a challenge for defenders. Other solutions focus on detecting malicious binaries or execution. In the case of remote encryption, the malware and execution reside on a different computer (unprotected) than the one having the files encrypted. The only way to stop it is watching the files and protecting them. That’s why we innovated CryptoGuard,” said Loman.
“CryptoGuard does not hunt for ransomware; instead, it zeroes in on the primary targets—the files. It applies mathematical scrutiny to documents, detecting signs of manipulation and encryption. Notably, this autonomous strategy deliberately does not depend on indicators of breach, threat signatures, artificial intelligence, cloud lookups, or prior knowledge to be effective. By focusing on the files, we can change the power balance between the attackers and the defenders. We’re increasing the cost and complexity for the attackers to successfully encrypt data, so that they will abandon their objectives. This is a part of our asymmetric defense approach strategy.
“Remote ransomware is a prominent problem for organizations, and it is contributing to the longevity of ransomware in general. Given that reading data over a network connection is slower than from a local disk, we have seen attackers, like LockBit and Akira, strategically encrypt only a fraction of each file. This approach aims to maximize impact in minimal time, further reducing the window for defenders to notice the attack and respond. Sophos’ approach to anti-ransomware technology stops both remote attacks and those that encrypt just 3% of a file. We’re hoping to inform defenders about this persistent attack method, so they can properly protect devices.”
For more information, read “CryptoGuard: An Asymmetric Approach to the Ransomware Battle” on Sophos.com.
In the wake of increasing geopolitical tension, Cassava Technologies has unveiled its National Sovereign Cloud offering for African governments.
The solution, the company claims, will help the continent’s governments ensure data is kept on infrastructure that remains under local legal and operational jurisdiction.
According to the official announcement, made yesterday, the solution provides “secure, locally-governed digital infrastructure that enables the deployment of AI-enabled public services”.
The overarching solution encompasses cloud, cyber security, AI computing infrastructure, as well as local language AI models and skills support for governments.
The announcement comes amid increasing uncertainty over the hosting of sensitive national data on cloud services operated by foreign hyperscalers, which are subject to legal frameworks, such as the U.S. CLOUD Act. The CLOUD Act opens the door to allow American authorities to access data stored on the servers of US hyperscalers, wherever those servers are physically located.
Cassava has claimed separately that currently, “approximately 33% to 45% of the world’s data is hosted in the USA”.
The company added: “A sovereign cloud reduces exposure to extraterritorial laws, improves cyber resilience, and ensures that model weights and training data for public AI remain under national custody.”
The Africa Data Centres Association’s 2026 Economic Report states that “data sovereignty has evolved from a legal aspiration into a strategic policy lever”.
Ahmed El Beheiry, Group COO and Group Chief Technology and AI Officer, Cassava Technologies said: “Across Africa, governments are accelerating their digital transformation agendas and are increasingly focused on ensuring that data and digital infrastructure remain secure and sovereign.”
Announced at the Mobile Word Congress in Barcelona, this week, the Sovereign Cloud offering launch accompanied the launch of Cassava’s Cloud Partner programme.
The partner programme targets mobile network operators and system integrators across Africa to resell and distribute AI, cloud, and other digital services using Cassava’s infrastructure and technology platforms.
El Beheiry added: “We are expanding Africa’s sovereign AI ecosystem to build solutions that address the continent’s unique challenges while creating new opportunities for growth and digital inclusion.”
The programme offers partners access to NVIDIA Cloud Partner solutions, Cassava’s AI Factory, its own native AI solutions and its AI Multi-Model Exchange, which supports both Anthropic’s Claude and Google’s Gemini models.
Mazen Mroue, a non-executive director at MTN Nigeria Communications Plc, has resigned effective February 27, 2026, to prioritise other responsibilities within the MTN Group, the company announced in a Nigerian Exchange Limited (NGX) filing.
MTN Nigeria
The notice, signed by company secretary Uto Ukpanah, stated: “This is to enable Mr. Mroue to focus on other priorities within MTN Group Limited. The Board wishes to express its appreciation to Mr. Mroue for his immense service to MTN Nigeria and wishes him success in his future endeavours.”
Mroue joined MTN Nigeria’s board on June 1, 2022, bringing over 28 years of telecom experience. A veteran MTN executive, he previously served as CEO of MTN Uganda and MTN Liberia, non-executive director at MTN Cyprus, and held leadership roles at MTN Ghana.
Since February 2022, he has been MTN Group’s Chief Technology and Information Officer, overseeing technology strategy and governance. Earlier, as MTN Nigeria’s COO from August 2018 to January 2022, he also sat on the MTN Nigeria Foundation board.
The exit follows MTN Nigeria’s stellar 2025 results, posting a ₦1.70 trillion profit before tax—reversing a ₦550.3 billion loss in 2024 driven by forex woes—marking one of the telco’s strongest rebounds.
Google has rolled out support for Yorùbá and Hausa languages in its AI-powered Search features—AI Overviews and AI Mode—enabling millions of Nigerians to get quick answers, summaries, and conversational web exploration in their mother tongues.
The update forms part of Google’s push to cover 13 African languages, including Afrikaans, Akan, Amharic, Kinyarwanda, Afaan Oromoo, Somali, Sesotho, Kiswahili, Setswana, Wolof, and isiZulu, selected based on high search activity across the continent.
Now, a Kano student can ask complex questions in Hausa, while an Ibadan trader seeks business tips in Yorùbá—both receiving culturally nuanced AI responses via text or voice on Android, iOS, or web.
Taiwo Kola-Ogunlade, Google’s West Africa Communications Manager, said: “Building truly global Search requires nuanced local understanding. With Gemini-powered AI, we’ve made advanced capabilities relevant in Yorùbá and Hausa, so Nigerians converse naturally with Search in their mother tongues.”
To use: Open the Google app, tap AI Mode, and query in Hausa or Yorùbá for personalised guidance—breaking language barriers and making technology reflect Nigeria’s diverse identity.
Police Says Victims Enable Cyber Attacks Out of Ignorance
Bank Accuses Magistrate, Lawyer of Using Fake Order to Steal N3.5m from Account
FG Launches NERD to Combat Certificate Fraud
NCDC Issues Public Advisory on Cerebrospinal Meningitis
Goodnews Naija Launches ‘Building in Nigeria’ Series on Entrepreneurs, Real Sector Builders
Dr. Cairo Ojougboh Foundation Bolsters Nigeria’s Education Drive with ₦2.7m Student Support
Kaspersky Brings more Transparency to Threat Detection with New Hunt Hub
PwC Reveals AI Scaling Gap Slows Africa’s Digital Transformation
Kaspersky Discovers New Phishing Campaign Exploiting Google Tasks Notifications to Steal Corporate Credentials
esentry 2025 Report Shows Healthcare, Financial Services and Telecoms as Staging Grounds for Increased Cyberattacks in Africa
E-Financial2 days agoSenate Targets Fintech Overreach, Vows Ponzi Crackdown After ₦1.3trn CBEX Scam
General News2 days agoFCCPC Bans Lagos ‘No Refund’ Policy, Vows Fines and Shutdowns for Traders
Telecom2 days agoGoogle Adds Yorùbá, Hausa to AI Search, Boosting Access for Millions of Nigerians
E-Business1 day agoPolice Says Victims Enable Cyber Attacks Out of Ignorance
E-Financial2 days agoSmartCash Launches ‘No Be Cho Cho Cho’ Campaign to Boost Digital Banking in Nigeria
Telecom2 days agoMTN Nigeria Non-Executive Director Mazen Mroue Quits to Focus on Group Role
E-Financial1 day agoQuest Merchant Bank Achieves CBN Regulatory Recapitalisation Milestone
Telecom2 days agoNativeID Launches Free Digital Identity Platform to Shield Nigerian SMEs from Scammers