Telecom
Sophos “Pacific Rim” Report Details its Defensive and Counter-Offensive Operation with Multiple Interlinked Adversaries
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released “Pacific Rim,” a report detailing its defensive and counter-offensive operation over the last five years with multiple interlinked nation-state adversaries based in China targeting perimeter devices, including Sophos Firewalls.
The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well as overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups including Volt Typhoon, APT31 and APT41.
The adversaries targeted both small and large critical infrastructure and government targets, primarily located in South and South-East Asia, including nuclear energy suppliers, a national capital’s airport, a military hospital, state security apparatus, and central government ministries.
Throughout Pacific Rim, Sophos X-Ops, the company’s cybersecurity and threat intelligence unit, worked to neutralize the adversaries’ moves and continuously evolved defenses and counter-offensives.
After Sophos successfully responded to the initial attacks, the adversaries escalated their efforts and brought in more experienced operators. Sophos subsequently uncovered a vast adversarial ecosystem.
While Sophos released details starting in 2020 on the campaigns associated, including Cloud Snooper and Asnarök, the company is sharing the overall investigation analysis to raise awareness of the persistence of Chinese nation-state adversaries and their hyperfocus to compromise perimeter, unpatched and end-of-life (EOL) devices, often via zero-day exploits they are creating for those devices.
Sophos is also encouraging all organizations to urgently apply patches for vulnerabilities discovered in any of their internet-facing devices and to migrate any older unsupported devices to current models.
Sophos regularly updates all of its supported products based on new threats and indicators of compromise (IoCs) to protect customers. Sophos Firewall customers are protected via rapid hotfixes that are now turned on by default.
“The reality is that edge devices have become highly attractive targets for Chinese nation-state groups like Volt Typhoon and others as they look to build operational relay boxes (ORBs) to obfuscate and support their activity.
“This includes directly targeting an organization for espionage, or indirectly leveraging any weak points for onward attacks – essentially becoming collateral damage. Even organizations that are not targets are getting hit.
“Network devices designed for businesses are natural targets for these purposes – they are powerful, always on, and have constant connectivity,” said Ross McKerchar, CISO at Sophos.
“When a group seeking to build a global network of ORBs targeted some of our devices, we responded by applying the same detection and response techniques we use to defend our corporate endpoints and network devices.
“This allowed us to burn multiple operations and tap into a valuable stream of threat intelligence that we applied to protect our customers from both future widespread attacks and highly targeted operations.”
Highlights of the Report
● On Dec. 4, 2018, a low-privileged computer connected to an overhead display began to scan the Sophos network—seemingly on its own—at the India headquarters of Cyberoam, a company Sophos acquired in 2014. Sophos found a payload quietly listening for specialized inbound internet traffic on the computer that contained a novel type of backdoor and a complex rootkit — “Cloud Snooper.”
● In April 2020, after several organizations reported a user interface pointing to a domain with “Sophos” in its name. Sophos worked with European law enforcement, which tracked down and confiscated the server the adversaries used to deploy malicious payloads in what Sophos later dubbed Asnarök. Sophos neutralized Asnarök, which the company was able to attribute to China, by taking over the malware’s command and control (C2) channel. It also allowed Sophos to neutralize a planned wave of botnet attacks.
● After Asnarök, Sophos advanced its intelligence operations by creating an additional threat actor tracking program focused on identifying and disrupting adversaries looking to exploit Sophos devices deployed in customer environments; the program was built using a combination of open-source intelligence, web analytics, telemetry monitoring, and targeted kernel implants deployed to the attackers’ research devices.
● Next, the attackers showed an increasing level of persistence, upleveling their tactics and deploying increasingly stealthy malware. However, using its threat actor tracking program and enhanced telemetry gathering capabilities, Sophos was able to pre-empt several attacks and obtain a copy of a UEFI bootkit and custom exploits before they could be deployed broadly.
● A few months later, Sophos tracked some of the attacks to an adversary who has demonstrated links to China and Sichuan Silence Information Technology’s Double Helix Research Institute in the country’s Chengdu region.
● In March 2022, an anonymous security researcher reported a zero-day remote code execution vulnerability, designated CVE-2022-1040, to Sophos as part of the company’s bug bounty program. Further investigation revealed that this CVE was already being exploited in the wild in multiple operations—operations that Sophos was then able to stop impacting customers. After deeper analysis, Sophos determined the person reporting the exploit may have had a connection to the adversaries.
“This was the second time Sophos received a suspiciously timed “tip” about an exploit before it was used maliciously.
“Recent advisories from CISA have made it clear that Chinese nation-state groups have become a perennial threat to nations’ critical infrastructure,” McKerchar continued.
“What we tend to forget is that small- and medium-sized businesses—those that form the bulk of the supply chain for critical infrastructure—are targets since they are often the weak links in this supply chain.
“Unfortunately, these businesses often have fewer resources to defend against such sophisticated threats. Further complicating matters is the tendency for these adversaries to gain a foothold and dig in, making it hard to evict them.
“The modus operandi of China-based adversaries is creating long-term persistence and complex obfuscated attacks. They won’t stop until they’re disrupted.”
Industry Quotes About Sophos’ Pacific Rim Report
“Through the JCDC, CISA obtains and shares crucial intelligence on the cybersecurity challenges we face, including the advanced tactics and techniques used by People’s Republic of China (PRC) state-sponsored cyber actors.
“The expertise of partners like Sophos and reports like its Pacific Rim report, provides the global cyber community more insights into the PRC’s evolving behaviors.
“By working side-by-side, we are helping cyber defenders understand the scale and widespread exploitation of edge network devices and implement mitigation strategies,” said Jeff Greene, executive assistant director for cybersecurity at CISA. “CISA continues to highlight how classes of vulnerabilities, including SQL injections and memory safety vulnerabilities, continue to be exploited en masse.
“We urge software manufacturers to review our Secure by Design resources and, as Sophos has done in this case, put its principles into practice. We encourage others to take the pledge and to review our alerts on how to eliminate common classes of defects.”
“Many cybersecurity vendors conduct adversarial research operations, but few are able to successfully do so against such a challenging set of nation-state adversaries for such a long period of time,” said Eric Parizo, managing principal analyst with the cybersecurity research group at Omdia.
“Sophos made the most of a highly unique opportunity, and it should be lauded for delivering research and tactical takeaways that will help better defend its customers now and well into the future.”
“At NCSC-NL, one of our tasks is to share information and connect organisations.
“Facilitating communication and cooperation between national and international organisations is of great importance to improve cyber resilience.
“We are happy to have been able to make a contribution to this investigation with Sophos,” said Hielke Bontius, head of operations, NCSC-NL.
Advice for Defenders
Organizations should expect all internet-facing devices are prime targets for nation-state adversaries, especially those devices in critical infrastructure. Sophos encourages organizations to take the following actions to strengthen their security posture.
● Minimize internet-facing services and devices when possible
● Prioritize patching with urgency for internet-facing devices and monitor these devices
● Enable hotfixes for edge devices to be allowed and applied automatically
● Collaborate with law enforcement, public-private partners, and government to share and act on relevant IoCs
● Create a plan for how your organization deals with EOL devices
“We need to work collaboratively across the public and private sector, law enforcement and governments, and the security industry, to share what we know about these adversarial operations. Targeting the very same edge devices that are deployed to protect networks is a bold and clever tactic. Organizations, channel partners and Managed Service Providers need to understand that these devices are top targets for attackers and should ensure they are appropriately hardened, and critical patches are applied as soon as they are released.
In fact, we know that attackers are actively hunting for EOL devices. Vendors play a big part here, too. They need to help customers by supporting reliable and well-tested hot fixing, making it easy to upgrade from EOL platforms, systematically refactoring or removing legacy code that can harbor lingering vulnerabilities, continuously improving secure by default designs to offload the customer burden of hardening, and monitoring the integrity of our deployed devices,” concluded McKerchar.
Nigerians lost about N12.5 billion to telecom-related financial crimes from 2019 to January 2023, underscoring the scale and persistence of this threat to the telecommunications industry, PwC Nigeria has said, citing data from the Nigerian Communications Commission (NCC).
PwC, in its latest report, ‘AI’s Dual Role in Telecom Fraud: Why Artificial Intelligence is Both a Threat and a Shield for Telcos’, said the growing adoption of AI by fraudsters is amplifying the frequency and impact of fraud.
The report said fraud has long been a persistent challenge in the telecoms landscape, leading to substantial financial losses for customers and reputational damages for telecommunication companies (telcos).
PwC’s latest report, ‘AI’s dual role in telecom fraud’, highlights global trends in how AI is reshaping both the threats and defences in telecommunications.
The publication examined what these shifts mean for operators in the local market and how they can stay ahead by adopting proactive, AI driven fraud management strategies.
It offered insights into how AI is enabling more sophisticated fraud schemes, from deepfake social engineering to automated attacks; the emerging role of AI powered detection and monitoring tools in strengthening fraud prevention frameworks.
The report also gave practical steps for telecom operators to balance innovation, resilience, and customer trust in an AI driven fraud ecosystem.
PwC noted that the impact of fraud on telecommunications companies is far-reaching, resulting in financial losses, reputational damage, and compliance issues.
The report said for instance, that in 2023, global telecom fraud was estimated at $38.95 billion.
It, however, stated that in Nigeria, where telecom acts as a key gateway to financial services through Unstructured Supplementary Service Data (USSD) and some are moving into fintech, these evolving risks place added pressure on operators.
The report stated that while operators have developed systems and controls to manage these risks, the sector’s expansion into adjacent domains (such as mobile money and payment service banking) is blurring the traditional boundaries of telecom fraud.
“The result is a more complex and interconnected risk environment, where both the frequency and impact of fraud are escalating. Adding to this complexity is the rapid pace of technological advancement.
For instance, Russian cybersecurity firm F6 reported a rise in SIM swapping incidents, particularly related to the shift to eSIM technology. These fraudsters are hijacking phone numbers and bypassing security measures to access bank accounts,” the report said.
The report, authored by Udochi Muogilim, Partner and Technology, Media and Telecommunications Leader, PwC Nigeria, and Adeola Adekunle, associate director, Forensic Services, however, said as AI continues to mature, it is reshaping the fraud landscape—introducing heightened threats and powerful new tools.
“On one hand, AI can be exploited to scale and automate fraud schemes with unprecedented sophistication. On the other, it equips telcos with advanced capabilities for fraud detection, prevention, and response.
“This dual role—AI as both a tool and a target—underscores the urgent need for Nigerian telecom players to adopt AI thoughtfully and strategically.
“Navigating this evolving landscape requires more than just investment in technology; it demands a deep understanding of what’s happening today in the world of technological disruption, and what’s to come,” the experts stated.
The report reiterated that telecom fraud affects a wide range of stakeholders, from individual consumers facing unauthorised charges to large corporations suffering reputation damage.
“The combination of AI and various fraud types significantly increases the success rate of these schemes.
“Furthermore, the global nature of telecommunications networks allows fraud to swiftly cross borders, complicating efforts to investigate and prosecute offenders, thus presenting a pressing concern for telecom companies and their regulators,” PwC said.
The firm, however, emphasised that AI has the potential to revolutionise how telecom companies and regulators combat fraud while enhancing the quality of service, ultimately fostering greater trust among consumers.
To fully harness this potential, PwC said it is crucial for industry players to stay informed about evolving technology trends and anticipate future challenges.
This awareness, it added, will empower them to leverage AI’s capabilities for more effective fraud prevention and the proactive management of emerging fraud types, all while adhering to responsible AI principles.
“A well-coordinated combination of the right resources and strategic alliances will enable the industry to make a significant impact in the fight against telecom fraud and build a safer, more efficient telecommunications ecosystem,” PwC affirmed.
The firm even went a notch higher by offering to help industry players and stakeholders turn fraud-related friction into forward movement, powered by the right technology.
“We bring trust and transparency to the heart of your decision-making, helping you use AI, data and tech to reduce the risk of fraud, respond swiftly to breaches, and emerge stronger—so you can prepare your business for what’s next,” PwC offered.
National Information Technology Development Agency (NITDA) has reaffirmed its commitment to building a coordinated and inclusive digital ecosystem in Nigeria, further strengthening its role as an ecosystem orchestrator.
NITDA
This was disclosed during a working visit centred on Nigeria’s startup ecosystem framework, where the Director General of NITDA, Kashifu Inuwa, was represented by the Director of Stakeholders Management and Partnerships, Dr Aristotle Onumo.
Speaking during the visit, the DG said NITDA was established to drive coordinated and sustainable information technology development in Nigeria, leveraging both its regulatory and developmental mandates, serving as an ecosystem orchestrator that fosters collaboration, innovation, and growth across the digital economy.
He stated that these reforms are aligned with the Federal Government’s Eight-Point Agenda and reflected in NITDA’s Strategic Roadmap and Action Plan (SRAP 2.0), which is built around eight strategic pillars designed to accelerate the growth of Nigeria’s digital economy.
According to him, a key objective of the roadmap is to position Nigeria as a technologically driven nation that promotes inclusive economic development through innovation. He highlighted digital literacy as a major priority, with NITDA targeting 70 percent digital literacy by 2027 under the National Digital Literacy Framework, with a long-term goal of achieving 95 percent by 2030.
Other priority areas, he said, include ecosystem development, IT talent advancement, expansion of digital infrastructure, policy implementation, and research-driven innovation.
The visiting delegation from Angola’s National Institute of Support for Micro, Small and Medium Enterprises (INAPEM), led by Chairman of the Board of Directors (PCA) and Chief Executive Officer, Bráulio Augusto, commended Nigeria’s progress in implementing the Nigeria Startup Act and described the country as a valuable model for shaping Angola’s own startup legislation.
Augusto disclosed that Angola’s Startup Law has received initial parliamentary approval and is now entering the implementation stage. He expressed interest in understanding how Nigeria transitioned from legal adoption to practical execution, particularly in areas such as startup labelling, incentive management, ecosystem mapping, investor registration, and the operation of the Nigeria Startup Portal.
According to him, Angola is currently developing the Startup Angola Programme under its Digital Entrepreneurship Support Programme, aimed at building a structured and integrated startup ecosystem rather than isolated interventions.
The programme will focus on institutional strengthening, startup funding, support for business development service providers, expansion of innovation hubs, and partnerships with international accelerators.
He added that Nigeria’s experience is especially relevant as Angola seeks solutions to challenges including informality, limited access to finance, youth unemployment, digital inclusion gaps, and restricted market access for small and medium-sized enterprises.
The INAPEM chief also requested further technical insights into Nigeria’s National Startup Council, its member selection process, and the governance structure of the Nigeria Startup Portal.
The visit highlights growing collaboration among African nations in digital policy development and further reinforces Nigeria’s position as a reference point in shaping startup ecosystem frameworks across the continent.
Kashifu Inuwa, National Information Technology Development Agency (NITDA), has reaffirmed the Agency’s commitment to deepening collaboration with the Federal Ministry of Communications, Innovation and Digital Economy (FMCIDE) to accelerate Nigeria’s digital transformation and strengthen policy alignment across the sector.
The Director General of the National Information Technology Development Agency (NITDA), Kashifu Inuwa, taking the Permanent Secretary of the Federal Ministry of Communications, Innovation and Digital Economy, Mr. Nadungu Gagare, on a tour of the newly commissioned Innovation Space during the Permanent Secretary’s working visit to the Agency’s corporate headquarters.
Speaking during a courtesy visit by the Permanent Secretary of the Ministry of Communications, Innovationand Digital Economy, Mr. Nadungu Gagare, to NITDA headquarters, Inuwa described the engagement as a significant demonstration of the Ministry’s support and leadership, noting that sustained collaboration between both institutions is essential to delivering Nigeria’s digital economy agenda.
The NITDA Director General recalled previous engagements with the Ministry, including a familiarisation visit during which the Agency shared its strategic roadmap and ongoing initiatives, noting that continuous dialogue has strengthened alignment between both institutions.
He highlighted key policy areas requiring continued collaboration, including the development of a national sovereign cloud infrastructure and a comprehensive cybersecurity policy framework.
“We are awaiting the Ministry’s guidance on how to move forward, particularly on the national cloud and cybersecurity policies,” he said, while emphasising the importance of clear institutional boundaries and mutual respect in enhancing operational effectiveness and inter-agency cooperation.
Inuwa also revealed that NITDA has been at the forefront of implementing the Performance Management System (PMS), having introduced the framework internally several years before its adoption across the Federal Civil Service.
“We started PMS about four years ago. What we have now at the national level actually originated from our internal reforms,” he disclosed, adding that initiatives such as Project NEXT have strengthened accountability, role clarity, and measurable outcomes across the Agency.
“If you perform well, you are rewarded. If not, there are consequences. Even promotions are tied to performance,” he added.
The Director General further highlighted NITDA’s transformation from a traditional regulatory institution into a dynamic ecosystem enabler focused on innovation, inclusion, and national development.
“We are building a high-velocity organisation—one that is agile, inclusive, and driven by innovation,” he said, explaining that the Agency is embracing a more flexible and entrepreneurial culture that empowers staff to contribute ideas and drive institutional growth.
In his remarks, the Permanent Secretary of the FMCIDE, Mr. Nadungu Gagare, reaffirmed the Ministry’s commitment to strengthening collaboration with its agencies, describing partnership as fundamental to achieving sustainable progress in Nigeria’s digital transformation journey.
“If there is no partnership, there is nothing that can be achieved. But with partnership and collaboration, a lot can be accomplished, and that is exactly what we are seeing now,” he stated.
Gagare explained that the visit forms part of the Ministry’s ongoing engagement with agencies under its supervision to strengthen policy coordination, assess progress, and address operational challenges requiring higher-level intervention.
He commended the management and staff of NITDA for their dedication to advancing Nigeria’s digital innovation ecosystem, acknowledging the Agency’s contributions to digital literacy, innovation, cybersecurity awareness, and the creation of opportunities for startups and young innovators.
“NITDA has continued to play a pivotal role in shaping Nigeria’s digital future through the promotion of information technology development, digital literacy, innovation, and regulatory standards,” he said.
The Permanent Secretary also stressed the importance of policy coherence among institutions within the Ministry, noting that agency mandates are interconnected and must be implemented seamlessly.
“Your mandates are inputs into one another. That is why we need tight collaboration so implementation can go smoothly,” he said, while assuring NITDA of the Ministry’s continued guidance and institutional support.
He further highlighted ongoing Federal Civil Service reforms, particularly the adoption of the Performance Management System, which promotes accountability, clear target-setting, and measurable performance outcomes.
“When everything needed for performance is made available and targets are not met, consequence management follows. Where targets are exceeded, there is reward. This is how we drive performance in the service,” he noted.
The visit showcases the shared commitment of both FMCIDE and NITDA to advancing Nigeria’s digital economy through stronger collaboration, innovation, and effective governance, with the strengthened partnership expected to play a critical role in delivering inclusive growth, improved service delivery, and sustainable national development.
World Bank Blocks Social Media Comments from Nigerians over Loan Backlash
Nigerians Lose N12.5bBn to Telecom-Related Financial Crimes – PwC
Jumia Nigeria Records Strong Q1 2026 Growth as Technology-Led Strategy Drives Market Expansion
Lagos Plans New Cybersecurity Centre
LG Electronics Strengthens Household Energy Efficiency in Nigeria with Advanced Inverter Refrigerator Solutions
MTN, VDT, Zoracom, Digital Realty Back 2026 Girls in ICT Campaign
Vitel Wireless Partners Fintechs to Expand Access to Services
Kaspersky Discovers Vulnerability in Qualcomm Snapdragon Chips that can Lead to Data Loss & Device Compromise
MTN Suspends Data, Airtime Borrowing Service over New FCCPC Lending Rules
Bank Customers to Pay N1,500 for ATM Card Issuance, Replacement – CBN
Telecom2 days agoNCC Says Telecom Industry on Course to Improve Quality of Service
News2 days agoKaspersky Challenges IT Leaders with Next-generation Cyber Protection Simulations
Telecom2 days agoAfrica to get AI Data Centres Through Three-way Partnership
General News2 days agoFG to Balance Innovation with National Security with Stronger Drone Regulations
News2 days agoFG, World Bank Launch $65m SPESSE Funding for 24,000 Nigerians
Broadcasting2 days agoFG to Launch Nationwide Free Digital TV Platform June 17
Telecom2 days agoDistinguished Industry Veteran Dr. Olusola Teniola to Chair NDSF 2026
News1 day agoThe Nigeria Prize for Science & Innovation Records New Height as 2026 Edition Attracts 237 Entries