Telecom
Sophos’ Incident Response Report Shows How Cybercriminals Abuse Remote Desktop Protocol in 90% of Attacks
Sophos, a global leader of innovative security solutions that defeat cyberattacks, today released the Active Adversary analysis, “It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024.”
John Shier, senior security advisor at Sophos
The report, which analyzes more than 150 incident response (IR) cases handled by the Sophos X-Ops IR team in 2023, found that cybercriminals abused remote desktop protocol (RDP)—a common method for establishing remote access on Windows systems—in 90% of attacks.
This was the highest incidence of RDP abuse since Sophos began releasing its Active Adversary reports in 2021, covering data from 2020.
In addition, external remote services such as RDP were the most common vector by which attackers initially breached networks; they were the method of initial access in 65% of IR cases in 2023.
External remote services have consistently been the most frequent source of initial access for cybercriminals since the Active Adversary reports were launched in 2020, and defenders should consider this a clear sign to prioritize the management of these services when assessing risk to the enterprise.
“External remote services are a necessary, but risky, requirement for many businesses. Attackers understand the risks these services pose and actively seek to subvert them due to the bounty that lies beyond. Exposing services without careful consideration and mitigation of their risks inevitably leads to compromise. It doesn’t take long for an attacker to find and breach an exposed RDP server, and without additional controls, neither does finding the Active Directory server that awaits on the other side,” said John Shier, field CTO, Sophos.
In one Sophos X-Ops customer case, attackers successfully compromised the victim four times within six months, each time gaining initial access through the customer’s exposed RDP ports.
Once inside, the attackers continued to move laterally throughout the customer’s networks, downloading malicious binaries, disabling endpoint protection, and establishing remote access.
Compromised credentials and exploiting vulnerabilities are still the two most common root causes of attacks. However, the 2023 Active Adversary Report for Tech Leaders, released last August, found that in the first half of that year, for the first time, compromised credentials surpassed vulnerabilities as the most frequent root cause of attacks. This trend continued through the rest of 2023, with compromised credentials representing the root cause of over 50% of IR cases for the entire year. When looking at Active Adversary data cumulatively over the years from 2020 through 2023, compromised credentials were also the number one “all-time” root cause of attacks, involved in nearly a third of all IR cases. Yet despite the historical prevalence of compromised credentials in cyberattacks, in 43% of IR cases in 2023, organizations did not have multi-factor-authentication configured.
Exploiting vulnerabilities was the second most common root cause of attacks, both in 2023 and when analyzing data cumulatively from 2020 through 2023, accounting for the root cause in 16% and 30% of IR cases, respectively.
“Managing risk is an active process. Organizations that do this well experience better security situations than those that don’t in the face of continuous threats from determined attackers. An important aspect of managing security risks, beyond identifying and prioritizing them, is acting on the information. Yet, for far too long, certain risks such as open RDP continue to plague organizations, to the delight of attackers who can walk right through the front door of an organization. Securing the network by reducing exposed and vulnerable services and hardening authentication will make organizations more secure overall and better able to defeat cyberattacks,” said Shier.
The Sophos Active Adversary Report for 1H 2024 is based on more than 150 incident response (IR) investigations spanning the globe across 26 sectors.
Targeted organizations are located in 23 different countries, including the United States, Canada, Mexico, Colombia, the United Kingdom, Sweden, Switzerland, Spain, Germany, Poland, Italy, Austria, Belgium, the Philippines, Singapore, Malaysia, India, Australia, Kuwait, the United Arab Emirates, Saudi Arabia, South Africa, and Botswana.
To learn more about the current adversary landscape, read It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024 on Sophos.com.
Telecommunication companies have threatened to withdraw their Unstructured Supplementary Services Data (USSD), services from banks over what they called misinformation.
MTN Nigeria, Airtel, Globacom and 9Mobile- the telcos disclosed that the banks’ notice to their customers on the new billing system and airtime deductions for USSD services was misleading.
Also, Association of Licensed Telecom Operators of Nigeria (ALTON) also denied that the directive was from the Nigerian Communications Commission (NCC).
USSD is done via shortcodes on mobile phones and allows bank customers to make transactions in places with limited or no internet service.
Recall that banks earlier this week claimed that NCC has directed them to begin charging them from their airtime rather than from customers’ accounts.
The notice from the banks read in part: “In line with the directive of the Nigerian Communications Commission (NCC), please be informed that effective June 3, 2025, charges for USSD banking services will no longer be deducted from your bank account.
“Going forward, these charges will be deducted directly from your mobile airtime balance in accordance with the NCC’s End-User Billing (EUB) model.
“Under this new billing structure, each USSD session will attract a charge of ?6.98 per 120 seconds, which will be billed by your mobile network operator.
“You will receive a consent prompt at the start of each session, and airtime will only be deducted upon your confirmation and availability of the bank to fulfil this service.
“If you do not wish to continue using USSD banking under this new model, you may choose to discontinue use of the USSD channel.”
Reacting, ALTON, umbrella body of telecom operators in Nigeria, said the banks’ notice is a gross misinformation deliberately hatched to suit their selfish interests.
Hence they threatened to withdraw network support to the banks’ USSD services.
Engr Gbenga Adebayo, chairman of ALTON told Vanguard: ” I don’t understand why the banks are twisting agreements and distorting information just to favour their selfish interests. In the first place, the information wasn’t a directive from the NCC but a joint regulatory agreement between the NCC and the Central Bank of Nigeria, CBN witnessed by the telcos and the banks. The agreement was that if the banks finally cleared all USSD debts owed to the telcos by June 2, 2025, they are free to migrate to the end-user billing method, so long as the model of migration is transparent and agreed upon by the telcos.
“The reason for that clause was because the telcos insisted that the process of migration is such that will not allow a customer to be billed twice; in other words, that a subscriber would not have his airtime deducted and also have his or her money deducted for same services from his or her bank account.
” As we speak, some of the banks have cleared their debts, but the majority are yet to do so. So, even if all the modalities of migrating to end-user billing have been perfectly carried out, the implementation cannot even begin because the banks are yet to clear the USSD debt owed to the telcos.
“Our position now is that if that is the way the banks want to treat the agreement, we may withdraw support for their USSD services. It is not a must-have. They can do without it. But, they should clear the debts as agreed,” he added.
MTN Nigeria has announced plans to embark on a massive capital expenditure (CAPEX) drive in 2025, committing nearly N900 billion to significantly enhance network service quality across Nigeria.
Dr. Karl Toriola, CEO, MTN Nigeria,
The substantial investment, more than double the combined CAPEX of approximately N440 billion spent in 2023 and 2024, underscored MTN’s aggressive strategy to address persistent service quality issues and meet growing customer and regulatory expectations.
Dr. Karl Toriola, CEO, MTN Nigeria, detailed this unprecedented financial commitment during a recent interview on Arise TV, emphasizing that improving service quality is the company’s paramount message for the year.
He highlighted a clear understanding and expectation from both the Nigerian Communications Commission (NCC) and security agencies for improved network quality.
A primary focus of this increased CAPEX will be on putting additional capacity in a city like Lagos, particularly in Abuja, where you have a lot of buildings coming up, you need additional sites because there are coverage issues.
Beyond these critical urban centers, the investment aims to bolster network resilience and ensure power stability for its infrastructure nationwide.
This includes proactively addressing site outages by ensuring timely payment for operational necessities such as diesel for generators, a persistent challenge in the Nigerian operating environment.
Toriola outlined a comprehensive upgrade process, which involves placing orders formally, opening letters of credit, and then the equipment gets shipped in and installed.
He added that MTN will be acquiring new sites and laying fiber to the base station to create better stability” where necessary.
While the immediate CAPEX is geared towards improving existing service quality and capacity, this investment aligns with MTN’s broader goals of enhancing financial inclusion in underserved rural areas, suggesting a long-term vision for network expansion and service improvement that extends beyond metropolitan areas.
Subscribers can anticipate tangible improvements in service quality, with a significant improvement in quality of service expected by the end of the second quarter or early in the third quarter of 2025, according to Toriola.
“This year is all going to be about capital expenditure on an aggressive basis to fix quality of service issues (and) meet both the regulators’ and the public’s expectations,” he affirmed, reiterating MTN’s steadfast focus on customer experience through substantial capital investment.
Telecom regulators and industry leaders from across the Middle East and Africa gathered in Cairo last week to chart a data-driven future for the region.
In a region where digital transformation is accelerating at unprecedented speed, connectivity intelligence firm, Ookla and Egypt’s National Telecom Regulatory Authority (NTRA) joined forces to organise the Telecommunications Regulatory Summit
Themed ‘Harnessing Data and Technology for Superior QoS’, the summit focused on how data, particularly crowdsourced insights, can transform regulatory strategies across the region.
The summit attracted stakeholders from over 30 countries, including delegates from the International Telecommunication Union (ITU) and World Broadband Association (WBBA), who engaged in high-level discussions on optimising network performance and accelerating digital inclusion.
Karim Yaici, lead industry analyst for the Middle East and Africa at Ookla, said the event set the tone for the growing value of data-driven decision-making.
“Access to and the use of crowdsourced data contribute to making more informed decisions, fostering transparency and ensuring that citizens in the MEA region benefit from high-quality, accessible and affordable connectivity,” he said.
The experts underlined that crowdsourced data is becoming a critical complement to traditional regulatory methods.
They agreed that it helps identify service gaps, prioritise infrastructure investments, and drive innovation.
With broadband speeds now closely tied to GDP growth and productivity, accurate performance data is seen as key to socio-economic advancement.
Dr. Hossam Abdel-Mawla, vice-president of technical affairs and quality of service at NTRA, stressed that the summit was pivotal in fostering regional collaboration.
“By actively sharing best practices and exploring innovative data-driven strategies, we are shaping a future where telecom regulations ensure digital inclusion and economic growth across the region,” he said.
In a key session, Ahmed Nabawy, director of client services at Ookla, presented findings on 5G performance in Egypt and Tunisia.
He demonstrated how Ookla’s unified data platform, powered by AI, enables operators to analyse 5G-capable device density and prioritise high-impact rollout areas.
The summit also explored the shift from conventional network quality metrics to more user-centric Quality of Experience models. These advanced analytics tools promise to enhance transparency, improve accountability, and ultimately deliver better connectivity experiences for all.
Telcos Threaten to Disconnect Banks over Misinformation on New USSD Charges
MTN Nigeria Plans N900Bn in Service Upgrade
NDIC Calls for Inputs to IADI Core Principles for Effective Deposit Insurance
Netflix Hikes Subscription Fees Again in Nigeria over “Market Conditions”
DSO: STBMAN Accuses NBC of Contempt, Seeks Presidential Intervention
E-Business2 days agoNIMC Plans to Register 95 Percent Nigerians by December
News2 days agoJAMB Waxes Worriedly over Rising Digital Exam Fraud
Telecom2 days ago9mobile Nigeria Inks Agreement to Roam with MTN
Telecom2 days agoIHS Nigeria Moves to Enhance G4S Secure Solutions Site Patrols and Increase Operational Efficiency with Patrol Vehicles
Telecom2 days agoBanks, Telcos to Start Deducting USSD Charges from Airtime Today
E-Business1 day agoAXIAN Telecom Invests in Jumia Post-MTN Era
Telecom2 days agoKonga Launches 3rd Edition of Mid-Year Shopping Festival with Unbeatable Discounts
E-Financial2 days agoFitch Upgrades Fidelity Bank’s National Rating to ‘A+(nga)’, Affirms Long-Term IDR at ‘B’