Telecom
Sophos “Pacific Rim” Report Details its Defensive and Counter-Offensive Operation with Multiple Interlinked Adversaries
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released “Pacific Rim,” a report detailing its defensive and counter-offensive operation over the last five years with multiple interlinked nation-state adversaries based in China targeting perimeter devices, including Sophos Firewalls.
The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well as overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups including Volt Typhoon, APT31 and APT41.
The adversaries targeted both small and large critical infrastructure and government targets, primarily located in South and South-East Asia, including nuclear energy suppliers, a national capital’s airport, a military hospital, state security apparatus, and central government ministries.
Throughout Pacific Rim, Sophos X-Ops, the company’s cybersecurity and threat intelligence unit, worked to neutralize the adversaries’ moves and continuously evolved defenses and counter-offensives.
After Sophos successfully responded to the initial attacks, the adversaries escalated their efforts and brought in more experienced operators. Sophos subsequently uncovered a vast adversarial ecosystem.
While Sophos released details starting in 2020 on the campaigns associated, including Cloud Snooper and Asnarök, the company is sharing the overall investigation analysis to raise awareness of the persistence of Chinese nation-state adversaries and their hyperfocus to compromise perimeter, unpatched and end-of-life (EOL) devices, often via zero-day exploits they are creating for those devices.
Sophos is also encouraging all organizations to urgently apply patches for vulnerabilities discovered in any of their internet-facing devices and to migrate any older unsupported devices to current models.
Sophos regularly updates all of its supported products based on new threats and indicators of compromise (IoCs) to protect customers. Sophos Firewall customers are protected via rapid hotfixes that are now turned on by default.
“The reality is that edge devices have become highly attractive targets for Chinese nation-state groups like Volt Typhoon and others as they look to build operational relay boxes (ORBs) to obfuscate and support their activity.
“This includes directly targeting an organization for espionage, or indirectly leveraging any weak points for onward attacks – essentially becoming collateral damage. Even organizations that are not targets are getting hit.
“Network devices designed for businesses are natural targets for these purposes – they are powerful, always on, and have constant connectivity,” said Ross McKerchar, CISO at Sophos.
“When a group seeking to build a global network of ORBs targeted some of our devices, we responded by applying the same detection and response techniques we use to defend our corporate endpoints and network devices.
“This allowed us to burn multiple operations and tap into a valuable stream of threat intelligence that we applied to protect our customers from both future widespread attacks and highly targeted operations.”
Highlights of the Report
● On Dec. 4, 2018, a low-privileged computer connected to an overhead display began to scan the Sophos network—seemingly on its own—at the India headquarters of Cyberoam, a company Sophos acquired in 2014. Sophos found a payload quietly listening for specialized inbound internet traffic on the computer that contained a novel type of backdoor and a complex rootkit — “Cloud Snooper.”
● In April 2020, after several organizations reported a user interface pointing to a domain with “Sophos” in its name. Sophos worked with European law enforcement, which tracked down and confiscated the server the adversaries used to deploy malicious payloads in what Sophos later dubbed Asnarök. Sophos neutralized Asnarök, which the company was able to attribute to China, by taking over the malware’s command and control (C2) channel. It also allowed Sophos to neutralize a planned wave of botnet attacks.
● After Asnarök, Sophos advanced its intelligence operations by creating an additional threat actor tracking program focused on identifying and disrupting adversaries looking to exploit Sophos devices deployed in customer environments; the program was built using a combination of open-source intelligence, web analytics, telemetry monitoring, and targeted kernel implants deployed to the attackers’ research devices.
● Next, the attackers showed an increasing level of persistence, upleveling their tactics and deploying increasingly stealthy malware. However, using its threat actor tracking program and enhanced telemetry gathering capabilities, Sophos was able to pre-empt several attacks and obtain a copy of a UEFI bootkit and custom exploits before they could be deployed broadly.
● A few months later, Sophos tracked some of the attacks to an adversary who has demonstrated links to China and Sichuan Silence Information Technology’s Double Helix Research Institute in the country’s Chengdu region.
● In March 2022, an anonymous security researcher reported a zero-day remote code execution vulnerability, designated CVE-2022-1040, to Sophos as part of the company’s bug bounty program. Further investigation revealed that this CVE was already being exploited in the wild in multiple operations—operations that Sophos was then able to stop impacting customers. After deeper analysis, Sophos determined the person reporting the exploit may have had a connection to the adversaries.
“This was the second time Sophos received a suspiciously timed “tip” about an exploit before it was used maliciously.
“Recent advisories from CISA have made it clear that Chinese nation-state groups have become a perennial threat to nations’ critical infrastructure,” McKerchar continued.
“What we tend to forget is that small- and medium-sized businesses—those that form the bulk of the supply chain for critical infrastructure—are targets since they are often the weak links in this supply chain.
“Unfortunately, these businesses often have fewer resources to defend against such sophisticated threats. Further complicating matters is the tendency for these adversaries to gain a foothold and dig in, making it hard to evict them.
“The modus operandi of China-based adversaries is creating long-term persistence and complex obfuscated attacks. They won’t stop until they’re disrupted.”
Industry Quotes About Sophos’ Pacific Rim Report
“Through the JCDC, CISA obtains and shares crucial intelligence on the cybersecurity challenges we face, including the advanced tactics and techniques used by People’s Republic of China (PRC) state-sponsored cyber actors.
“The expertise of partners like Sophos and reports like its Pacific Rim report, provides the global cyber community more insights into the PRC’s evolving behaviors.
“By working side-by-side, we are helping cyber defenders understand the scale and widespread exploitation of edge network devices and implement mitigation strategies,” said Jeff Greene, executive assistant director for cybersecurity at CISA. “CISA continues to highlight how classes of vulnerabilities, including SQL injections and memory safety vulnerabilities, continue to be exploited en masse.
“We urge software manufacturers to review our Secure by Design resources and, as Sophos has done in this case, put its principles into practice. We encourage others to take the pledge and to review our alerts on how to eliminate common classes of defects.”
“Many cybersecurity vendors conduct adversarial research operations, but few are able to successfully do so against such a challenging set of nation-state adversaries for such a long period of time,” said Eric Parizo, managing principal analyst with the cybersecurity research group at Omdia.
“Sophos made the most of a highly unique opportunity, and it should be lauded for delivering research and tactical takeaways that will help better defend its customers now and well into the future.”
“At NCSC-NL, one of our tasks is to share information and connect organisations.
“Facilitating communication and cooperation between national and international organisations is of great importance to improve cyber resilience.
“We are happy to have been able to make a contribution to this investigation with Sophos,” said Hielke Bontius, head of operations, NCSC-NL.
Advice for Defenders
Organizations should expect all internet-facing devices are prime targets for nation-state adversaries, especially those devices in critical infrastructure. Sophos encourages organizations to take the following actions to strengthen their security posture.
● Minimize internet-facing services and devices when possible
● Prioritize patching with urgency for internet-facing devices and monitor these devices
● Enable hotfixes for edge devices to be allowed and applied automatically
● Collaborate with law enforcement, public-private partners, and government to share and act on relevant IoCs
● Create a plan for how your organization deals with EOL devices
“We need to work collaboratively across the public and private sector, law enforcement and governments, and the security industry, to share what we know about these adversarial operations. Targeting the very same edge devices that are deployed to protect networks is a bold and clever tactic. Organizations, channel partners and Managed Service Providers need to understand that these devices are top targets for attackers and should ensure they are appropriately hardened, and critical patches are applied as soon as they are released.
In fact, we know that attackers are actively hunting for EOL devices. Vendors play a big part here, too. They need to help customers by supporting reliable and well-tested hot fixing, making it easy to upgrade from EOL platforms, systematically refactoring or removing legacy code that can harbor lingering vulnerabilities, continuously improving secure by default designs to offload the customer burden of hardening, and monitoring the integrity of our deployed devices,” concluded McKerchar.
As Africa edges toward an estimated 750 million internet users by the end of 2025, the continent’s expanding digital footprint is increasingly matched by vulnerabilities that threaten its economic and national security.
Happiness Obioha, Managing Director and Chief Executive Officer of Tizel Cybersecurity
This concern took centre stage at the Africa Tech Alliance Forum (AfriTech 5.0), where Happiness Obioha, the Managing Director and Chief Executive Officer of Tizel Cybersecurity, delivered one of the event’s most compelling arguments for a new cybersecurity paradigm rooted in African intelligence rather than foreign technology.
Speaking on the theme “Beyond Firewalls: The Case for Homegrown Cybersecurity Intelligence in Africa,” Obioha maintained that Africa’s cybersecurity risks cannot be effectively mitigated with imported solutions that were never designed for the continent’s distinct digital realities.
She described Africa’s cyber landscape as one defined by unique threat actors, infrastructural limitations, cultural nuances, and business patterns that global security platforms often fail to understand.
According to her, relying solely on perimeter-based defenses such as firewalls is no longer adequate in a world where cyberattacks grow more adaptive, persistent, and sophisticated.
Obioha argued that Africa’s dependence on generic global tools has created a critical gap in the continent’s ability to detect, interpret, and respond to emerging threats, and explained that foreign cybersecurity systems frequently misread local attack patterns or fail to anticipate region-specific vulnerabilities.
As a result, many African organizations operate with a false sense of safety while facing increasingly complex threats ranging from ransomware and financial fraud to targeted breaches on government infrastructure.
The Tizel CEO emphasised that Africa’s long-term security lies in adopting intelligence-led approaches that draw from local insights, indigenous expertise, and continental research, and noted that such solutions allow faster and more precise threat detection because they are built with an understanding of local behaviour patterns and digital environments.
Beyond security improvements, she stressed that homegrown cybersecurity also strengthens national sovereignty, reduces capital flight, expands technical capacity, and creates jobs in one of the world’s fastest-growing sectors.
Obioha cited Tizel Cybersecurity as an example of what locally grounded innovation can achieve, explaining that the company’s model integrates contextual intelligence, real-time monitoring, rapid incident response, and strict adherence to regulatory frameworks.
According to her, Tizel’s work with banks, telecom operators, government agencies, and SMEs demonstrates the measurable impact of Africa-specific cybersecurity architecture.
Among the results she highlighted were the prevention of a major ransomware attack in the financial sector, a significant reduction in network downtime for a telecom operator, and the deployment of effective real-time monitoring systems for a government agency.
She reinforced that Tizel’s success is built on its deep understanding of the African digital ecosystem, a familiarity she described as indispensable for delivering cybersecurity that genuinely protects African institutions.
The region’s business culture, infrastructural diversity, and evolving digital habits, she said, can only be accurately interpreted by experts who operate within the same environment.
Obioha urged African enterprises and governments to take a more deliberate approach toward securing their digital future, and encouraged them to re-examine their cybersecurity posture, invest in indigenous intelligence-driven solutions, and build internal teams equipped to respond to emerging threats.
The survival and competitiveness of African businesses, she noted, will increasingly depend on their ability to align security strategies with the realities of the continent’s rapidly evolving digital economy.
“Africa’s digital future is promising,” she concluded, “but it must be secured with intelligence and innovation that come from within the continent.”
MTN Nigeria and the Small and Medium Enterprises Development Agency of Nigeria (SMEDAN) have signed a strategic partnership aimed at accelerating the growth, digital capacity, and sustainability of Nigeria’s 40 million Micro, Small and Medium Enterprises (MSMEs).
L-R: Julcit Onigbogi, Head of Legal, SMEDAN; Charles Odii, Director General, SMEDAN; Lynda Saint-Nwafor, Chief Enterprise Business Officer, MTN Nigeria and Ayham Moussa, Chief Operating Officer, MTN Nigeria, during the MTN, SMEDAN Seal Strategic Partnership Signing held at the MTN Plaza, Ikoyi on Thursday, November 27, 2025.
The signing ceremony was held at the MTN Plaza, Lagos, on Thursday, November 27, 2025.
MTN Nigeria’s Chief Operating Officer, Ayham Moussa, reiterated MTN’s commitment to supporting Nigeria’s economic development, stating that MSMEs are the lifeline of Nigeria’s economy.
He said: “SMEs are the backbone of the economy and the backbone of employment in Nigeria. We are delighted to power SMEDAN’s platform and provide tools that help MSMEs reach customers, obtain funding, and access wider markets.
“This collaboration serves both our business and social development objectives.”
Chief Enterprise Business Officer, Lynda Saint-Nwafor, MTN Nigeria described the MoU as a tool to “meet SMEs at the point of their needs,” noting that nano, micro, small, and medium businesses each require different resources to scale.
She stated: “Some SMEs need guidance, some need resources; others need opportunities or workforce support. This platform allows them to access whatever they need.
“We are committed to identifying opportunities across financial inclusion, digital inclusion, and capacity building that help SMEs to scale.”
Speaking at the event, the Director General of SMEDAN, Charles Odii, emphasised the significance of the collaboration, noting that the agency cannot meet its mandate without leveraging technology and private-sector expertise.
He said: “We have approximately 40 million MSMEs in Nigeria, and only about 400 SMEDAN staff. We cannot fulfil our mandate without technology, data, and strong partners.
“MTN already has the infrastructure and tools to support MSMEs from payments to identity, hosting, learning, and more. With this partnership, we are confident we can achieve in a short time what would have taken years.”
Odii highlighted that the SMEDAN-MTN collaboration would support businesses across their growth needs, guided by their four-point GROW model – Guidance, Resources, Opportunities, and Workforce Development.
He added that SMEDAN has already created over 100,000 jobs within its two-year administration and expects the partnership to significantly boost job creation, business expansion, and nationwide enterprise modernisation.
The partnership will feature joint initiatives focused on digital inclusion, financial access, capacity building, and providing verified information for MSMEs. With millions of small businesses depending on accurate guidance and easy-to-access support, MTN and SMEDAN say their shared platform will address gaps in communication, misinformation, and access to opportunities.
The event concluded with the formal signing of the Memorandum of Understanding (MoU), setting the stage for the immediate roll-out of tools, content, and resources that will support MSMEs nationwide.
Telecom
MTN Nigeria Launches Y’ello Data Gifting Campaign as Digital Connectivity Shapes Festive Celebrations
MTN Y’ello Tide is the gift that keeps giving, with MTN exciting Nigerians through a season filled with yellow gifting, digital rewards, and festive moments. This year, MTN is giving customers even more ways to stay connected and celebrate, and the Y’ello Data Gifting initiative stands as one of the many offerings under MTN Y’ello Tide.
MTN Nigeria
With Nigerians embracing more digital-led ways to connect and celebrate during the festive season, MTN Nigeria has introduced its Y’ello Data Gifting initiative as part of the broader MTN Y’ello Tide, designed to encourage customers to share data with loved ones while standing a chance to win prizes worth millions of naira. MTN Y’ello Tide continues to position digital connectivity as an exciting way to gift this season, reinforcing that MTN is giving Nigerians more value at a time they need it most.
The campaign runs from December 1 to 25, offering daily rewards such as Samsung smartphones and ₦20,000 shopping vouchers for the top 20 data gifters each day. As a core part of MTN Y’ello Tide, the data gifting experience helps customers enjoy more yellow moments through rewards, bonuses, and shared connections. Customers who participate also enjoy bonus data, with 1GB awarded to those gifting 10GB or more, and 500MB for gifts ranging between 5GB and 9.99GB. Participation is available through *321# or the myMTN NG app between 10am and 10pm daily.
Across Nigeria, digital behaviour continues to evolve. Internet consumption reached a record 973,455 terabytes in December 2024, marking a 36.5 percent year-on-year growth according to the Nigerian Communications Commission. MTN Y’ello Tide taps into this shift by offering exciting, value-driven digital gifting experiences that help people stay connected throughout the season.
While costs of food and non-alcoholic beverages have risen by over 92 percent in the last three years, and inflation stood at 34.60 percent in November 2024 with food inflation at 39.93 percent, Nigerians continue to prioritise meaningful and cost-efficient ways to stay connected. This shift has led many families to favour experiential or digital gifts, particularly as surveys show that 76 percent of Nigerians experienced income reductions in 2024, based on the PiggyVest Savings Report.
Festive spending has also adjusted to new realities. Items such as Christmas trees now range between ₦23,000 and ₦700,000, up from ₦17,000 to ₦450,000 last year. In this context, telco-led promotions like MTN Y’ello Tide’s Data Gifting campaign offer an alternative form of giving that aligns with today’s lifestyle needs. MTN is giving customers more ways to celebrate in yellow, creating exciting opportunities to share, connect, and enjoy festive rewards.
Nigeria remains a mobile-first market with 103 million internet users recorded at the start of 2024, representing 45.5 percent internet penetration according to DataReportal. Data now functions as a core utility supporting work, education, entertainment, and social connection across the country, making MTN Y’ello Tide’s digital gifting even more relevant this season.
As a Lagos civil servant noted earlier this month, the season remains a time for gratitude and connection, regardless of spending patterns. MTN Y’ello Tide strengthens this sentiment by making it easier for customers to stay connected and enjoy meaningful gifting in an exciting and accessible way.
The Y’ello Data Gifting campaign continues until December 25, with terms and conditions applying. As part of MTN Y’ello Tide, the initiative reinforces that MTN is giving Nigerians a festive season anchored on digital convenience, rewarding experiences, and yellow-themed celebration.
Dial *321# or download the myMTN NG app to start gifting data to your loved ones. Campaign runs until December 25, 2025. Terms and conditions apply.
PAPSS Cowry to Benefit Manufacturers, SMEs
Access Bank’s Digital Innovation Earns Top Financial Inclusion Award
NIPR Postpones Maiden PRICE Awards to January 25, 2026
CBN’s New Cash Policy: A Welcome Liberalisation or a Risky Retreat?
Africa Must Build Its Own Cybersecurity Intelligence, Says Tizel CEO At AfriTech 5.0
Kaspersky Introduces Cyber Pathways to Support Career Development in Cybersecurity
Nigeria’s $618m Tech Incubator Debuts
NITDA DG Tasks Youths to Drive Africa’s Digital Transformation
Firm Urges Organizations to Check Protection of their Websites Amid Search Engine Optimisation Attack Schemes
Hackers Breach Phones of Dangote and Otedola, Demand Ransom
Broadcasting3 days agoIt is Official, DStv Confirms Termination of 16 Major Channels
General News2 days agoManufacturers Block More Ransomware, But Data Theft Surges – Sophos Report
Telecom2 days agoMTN Nigeria Launches Y’ello Data Gifting Campaign as Digital Connectivity Shapes Festive Celebrations
E-Financial3 days agoSenate Considers Bill to Empower CBN to Regulate Fintech
Broadcasting3 days agoParamount Africa Shuts Down after 20 Years
Telecom3 days agoAfrica’s $1bn Biometric ID Rollout Raises Concerns Over Privacy and Exclusion
News2 days agoPAPSS Cowry to Benefit Manufacturers, SMEs
News3 days agoAfreximbank Taps Nigeria to Lead Africa’s Digital Trade Revolution