Telecom
Sophos “Pacific Rim” Report Details its Defensive and Counter-Offensive Operation with Multiple Interlinked Adversaries
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released “Pacific Rim,” a report detailing its defensive and counter-offensive operation over the last five years with multiple interlinked nation-state adversaries based in China targeting perimeter devices, including Sophos Firewalls.
The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well as overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups including Volt Typhoon, APT31 and APT41.
The adversaries targeted both small and large critical infrastructure and government targets, primarily located in South and South-East Asia, including nuclear energy suppliers, a national capital’s airport, a military hospital, state security apparatus, and central government ministries.
Throughout Pacific Rim, Sophos X-Ops, the company’s cybersecurity and threat intelligence unit, worked to neutralize the adversaries’ moves and continuously evolved defenses and counter-offensives.
After Sophos successfully responded to the initial attacks, the adversaries escalated their efforts and brought in more experienced operators. Sophos subsequently uncovered a vast adversarial ecosystem.
While Sophos released details starting in 2020 on the campaigns associated, including Cloud Snooper and Asnarök, the company is sharing the overall investigation analysis to raise awareness of the persistence of Chinese nation-state adversaries and their hyperfocus to compromise perimeter, unpatched and end-of-life (EOL) devices, often via zero-day exploits they are creating for those devices.
Sophos is also encouraging all organizations to urgently apply patches for vulnerabilities discovered in any of their internet-facing devices and to migrate any older unsupported devices to current models.
Sophos regularly updates all of its supported products based on new threats and indicators of compromise (IoCs) to protect customers. Sophos Firewall customers are protected via rapid hotfixes that are now turned on by default.
“The reality is that edge devices have become highly attractive targets for Chinese nation-state groups like Volt Typhoon and others as they look to build operational relay boxes (ORBs) to obfuscate and support their activity.
“This includes directly targeting an organization for espionage, or indirectly leveraging any weak points for onward attacks – essentially becoming collateral damage. Even organizations that are not targets are getting hit.
“Network devices designed for businesses are natural targets for these purposes – they are powerful, always on, and have constant connectivity,” said Ross McKerchar, CISO at Sophos.
“When a group seeking to build a global network of ORBs targeted some of our devices, we responded by applying the same detection and response techniques we use to defend our corporate endpoints and network devices.
“This allowed us to burn multiple operations and tap into a valuable stream of threat intelligence that we applied to protect our customers from both future widespread attacks and highly targeted operations.”
Highlights of the Report
● On Dec. 4, 2018, a low-privileged computer connected to an overhead display began to scan the Sophos network—seemingly on its own—at the India headquarters of Cyberoam, a company Sophos acquired in 2014. Sophos found a payload quietly listening for specialized inbound internet traffic on the computer that contained a novel type of backdoor and a complex rootkit — “Cloud Snooper.”
● In April 2020, after several organizations reported a user interface pointing to a domain with “Sophos” in its name. Sophos worked with European law enforcement, which tracked down and confiscated the server the adversaries used to deploy malicious payloads in what Sophos later dubbed Asnarök. Sophos neutralized Asnarök, which the company was able to attribute to China, by taking over the malware’s command and control (C2) channel. It also allowed Sophos to neutralize a planned wave of botnet attacks.
● After Asnarök, Sophos advanced its intelligence operations by creating an additional threat actor tracking program focused on identifying and disrupting adversaries looking to exploit Sophos devices deployed in customer environments; the program was built using a combination of open-source intelligence, web analytics, telemetry monitoring, and targeted kernel implants deployed to the attackers’ research devices.
● Next, the attackers showed an increasing level of persistence, upleveling their tactics and deploying increasingly stealthy malware. However, using its threat actor tracking program and enhanced telemetry gathering capabilities, Sophos was able to pre-empt several attacks and obtain a copy of a UEFI bootkit and custom exploits before they could be deployed broadly.
● A few months later, Sophos tracked some of the attacks to an adversary who has demonstrated links to China and Sichuan Silence Information Technology’s Double Helix Research Institute in the country’s Chengdu region.
● In March 2022, an anonymous security researcher reported a zero-day remote code execution vulnerability, designated CVE-2022-1040, to Sophos as part of the company’s bug bounty program. Further investigation revealed that this CVE was already being exploited in the wild in multiple operations—operations that Sophos was then able to stop impacting customers. After deeper analysis, Sophos determined the person reporting the exploit may have had a connection to the adversaries.
“This was the second time Sophos received a suspiciously timed “tip” about an exploit before it was used maliciously.
“Recent advisories from CISA have made it clear that Chinese nation-state groups have become a perennial threat to nations’ critical infrastructure,” McKerchar continued.
“What we tend to forget is that small- and medium-sized businesses—those that form the bulk of the supply chain for critical infrastructure—are targets since they are often the weak links in this supply chain.
“Unfortunately, these businesses often have fewer resources to defend against such sophisticated threats. Further complicating matters is the tendency for these adversaries to gain a foothold and dig in, making it hard to evict them.
“The modus operandi of China-based adversaries is creating long-term persistence and complex obfuscated attacks. They won’t stop until they’re disrupted.”
Industry Quotes About Sophos’ Pacific Rim Report
“Through the JCDC, CISA obtains and shares crucial intelligence on the cybersecurity challenges we face, including the advanced tactics and techniques used by People’s Republic of China (PRC) state-sponsored cyber actors.
“The expertise of partners like Sophos and reports like its Pacific Rim report, provides the global cyber community more insights into the PRC’s evolving behaviors.
“By working side-by-side, we are helping cyber defenders understand the scale and widespread exploitation of edge network devices and implement mitigation strategies,” said Jeff Greene, executive assistant director for cybersecurity at CISA. “CISA continues to highlight how classes of vulnerabilities, including SQL injections and memory safety vulnerabilities, continue to be exploited en masse.
“We urge software manufacturers to review our Secure by Design resources and, as Sophos has done in this case, put its principles into practice. We encourage others to take the pledge and to review our alerts on how to eliminate common classes of defects.”
“Many cybersecurity vendors conduct adversarial research operations, but few are able to successfully do so against such a challenging set of nation-state adversaries for such a long period of time,” said Eric Parizo, managing principal analyst with the cybersecurity research group at Omdia.
“Sophos made the most of a highly unique opportunity, and it should be lauded for delivering research and tactical takeaways that will help better defend its customers now and well into the future.”
“At NCSC-NL, one of our tasks is to share information and connect organisations.
“Facilitating communication and cooperation between national and international organisations is of great importance to improve cyber resilience.
“We are happy to have been able to make a contribution to this investigation with Sophos,” said Hielke Bontius, head of operations, NCSC-NL.
Advice for Defenders
Organizations should expect all internet-facing devices are prime targets for nation-state adversaries, especially those devices in critical infrastructure. Sophos encourages organizations to take the following actions to strengthen their security posture.
● Minimize internet-facing services and devices when possible
● Prioritize patching with urgency for internet-facing devices and monitor these devices
● Enable hotfixes for edge devices to be allowed and applied automatically
● Collaborate with law enforcement, public-private partners, and government to share and act on relevant IoCs
● Create a plan for how your organization deals with EOL devices
“We need to work collaboratively across the public and private sector, law enforcement and governments, and the security industry, to share what we know about these adversarial operations. Targeting the very same edge devices that are deployed to protect networks is a bold and clever tactic. Organizations, channel partners and Managed Service Providers need to understand that these devices are top targets for attackers and should ensure they are appropriately hardened, and critical patches are applied as soon as they are released.
In fact, we know that attackers are actively hunting for EOL devices. Vendors play a big part here, too. They need to help customers by supporting reliable and well-tested hot fixing, making it easy to upgrade from EOL platforms, systematically refactoring or removing legacy code that can harbor lingering vulnerabilities, continuously improving secure by default designs to offload the customer burden of hardening, and monitoring the integrity of our deployed devices,” concluded McKerchar.
WhatsApp’s introduction of usernames ostensibly to increase privacy for users so they don’t have to swap phone numbers – could backfire if hackers turn usernames into a new avenue for privacy attacks.
This is according to two experts, who both note that usernames will be fair game for hackers, while also being accessible to governmental agencies and advertisers, upending WhatsApp’s key to success: conversations and calls are end-to-end encrypted by default.
WhatsApp has always stated that its encryption “ensures that only you and the person you are communicating with can read or listen to them, preventing anyone in between – including WhatsApp, Meta, or cyber criminals – from accessing your data”.
Over the weekend, the messaging app said it was introducing usernames so that users provide these as contact details instead of phone numbers, which it calls “a major privacy feature”. It is encouraging users to “reserve your username now, before the feature launches later this year”.
“Sometimes you just want to chat without handing over your digits,” WhatsApp says, noting that a phone number is personal and tied to many parts of a user’s life.
The Facebook and Instagram owner says: “This is also true for group conversations. You want to join the parent chat for the soccer team but you’re not ready to give your phone number to people you’ve never met.”
Trading View, a financial markets analysis platform, says: “The approach could help Meta position the update as a controlled privacy tool rather than a discovery feature, while bringing WhatsApp closer to rival messaging apps such as Signal, which already allows username-based conversations.”
It adds there will be no directory or username suggestions, so users will need to know a person’s exact username to contact them for the first time. An optional username key can be enabled to further restrict who is able to message them.
Meta is also introducing safeguards as the feature rolls out to reduce the risk of impersonation and scams, Trading View explains. Existing Facebook and Instagram usernames will be reserved for their current owners during the reservation period, and certain usernames associated with public figures, celebrities and government entities will remain permanently protected.
ICT veteran commentator Adrian Schofield, however, questions whether the feature will deliver the privacy benefits users expect. “Short usernames will not be difficult to find and are likely to become a new ‘game’ for those who enjoy breaking privacy protection,” he says.
The big issue is privacy, says T4i director Mark Walker, formerly with research company IDC. WhatsApp built its reputation on shielding users’ identities regardless of which groups they joined, or who they associated with. That promise, he argues, is now being quietly redefined.
“‘Privacy’ now means protection from impersonation by other users, not privacy from the platform’s own surveillance, data linkage, or other entities. It’s a security feature rebranded for a privacy-sensitive audience, directly trading away individual privacy for a form of collective safety,” he says.
Walker adds: “Users value WhatsApp for its privacy; none of the groups you join or people you associate with are shared externally with advertisers. That is what is being eroded.”
This move, Walker says, is “a sophisticated monetisation play,” using privacy, security and regulation to motivate users to verify their identities – for a fee – while positioning Meta as what he calls “the all-seeing trusted eye” attractive to both advertisers and government agencies.
In its announcement, Meta says users can reserve a username to use later this year when the feature launches. “A lot of names overlap, which is why we’re opening reservations early so everyone has the opportunity to select the username that matters to them.”
Content creators, small businesses and organisations that want to maintain a consistent online presence will be able to claim their existing Instagram or Facebook username on WhatsApp through reserved username options, says Meta.
“For most people, choosing a WhatsApp username should be something unique that only people you want to contact you will know. If you need help picking one, we have a username generator to make one work just for you,” Meta says.
WhatsApp had reached three billion users globally as of Meta’s 2025 first quarter results, or 36% of the world’s population. “WhatsApp now has more than three billion monthly actives, with more than 100 million people in the US and growing quickly there,” CEO Mark Zuckerberg said at the time.
During Meta’s latest results, Zuckerberg said: “WhatsApp continues to see strong momentum too, including in the US.”
Schofield questioned whether desirable short usernames could become targets for impersonation. “Look at the older Gmail accounts! Time to take a good look at alternative platforms? This feature will be rolled out in tranches,” Meta says.
Telecom
Airtel Nigeria CEO Urges Adoption of Intelligent Technology Platforms to Accelerate National Growth
Dinesh Balsingh, Airtel Nigeria’s Chief Executive Officer, has called on business leaders to accelerate Nigeria’s digital future by embracing intelligent technology platforms that drive innovation, productivity, and sustainable economic growth.
Speaking at the Lagos Business School (LBS) Breakfast Club on the theme, “From Telco to Techno,” Balsingh said the telecommunications industry is evolving beyond connectivity to become the foundation for enterprise transformation and the country’s digital economy.
Balsingh explained that while previous generations of mobile technology connected people through voice, internet access, and mobile broadband, the future lies in intelligent ecosystems powered by artificial intelligence (AI), the Internet of Things (IoT), satellite connectivity, and integrated enterprise solutions.
“The role of telecommunications has fundamentally changed. Businesses are no longer asking only for connectivity; they want solutions that improve productivity, strengthen security, and accelerate digital transformation. That is the journey Airtel is leading. We are evolving from a telecommunications company into a technology partner that helps organisations unlock growth and create long-term value,” he said.
Noting that value is no longer measured by the volume of data consumed but by the business outcomes technology delivers, he highlighted a key shift in telecommunications to AI-powered customer protections, industry-specific digital solutions, IoT platforms, and hybrid satellite-terrestrial networks that extend reliable connectivity to underserved communities and remote business locations.
“Technology should do more than connect people. It should protect them, simplify operations, and help businesses make better decisions. Investments are now focused on building smarter, more resilient digital infrastructure that supports organisations across every sector of the economy.”
He added that sectors including retail, education, healthcare, government, manufacturing, and oil and gas increasingly require integrated digital solutions that combine connectivity with cloud services, intelligent networking, surveillance, automation, and data analytics.
Balsingh also urged business leaders to rethink their digital priorities, noting that future competitiveness will depend on how connected, intelligent, secure, automated, and resilient their organisations become.
“The organisations that will lead the next decade are those that invest today in intelligent digital infrastructure. Our customers are no longer buying connectivity alone. They are investing in productivity, intelligence, and digital transformation.”
The session, which also featured the IMF Resident Representative for Nigeria, Christian Ebeke, formed part of the Lagos Business School Breakfast Club, a platform that brings together business executives and industry leaders to examine emerging trends shaping the future of enterprise and economic development.
Airtel Nigeria’s participation reinforced its commitment to supporting Nigeria’s digital transformation by enabling businesses with innovative technologies that improve efficiency, strengthen resilience, and unlock new opportunities for growth across the country’s rapidly evolving digital economy.
Nigerian Communications Commission (NCC) has called for accelerated deployment of Fibre-to-the-Home (FTTH) infrastructure, saying robust broadband connectivity is critical to achieving Nigeria’s ambition of building a one trillion-dollar economy.
Dr Aminu Maida, Executive Vice Chairman of the NCC, made the call while delivering a keynote address at the Association of Telecommunications Companies of Nigeria (ATCON) High-Level Industry Forum on FTTH in Lagos.
Maida said that although demand for high-speed internet continues to rise due to the growth of artificial intelligence, cloud computing, streaming services and digital businesses, fixed fibre broadband remains significantly underdeveloped in Nigeria.
According to him, the country currently has about 265,000 active FTTH subscriptions, a penetration level below the African average of 2.5 per cent and far behind the 47 per cent average recorded in more mature broadband markets.
“This low base should not discourage us. It should focus us.
“It shows the scale of the opportunity before Nigeria and reinforces the need to create the right conditions for fibre infrastructure to expand more rapidly, more sustainably and more widely across the country,” he said.
Maida said fibre infrastructure provides the speed, resilience and scalability required to support increasingly data-intensive applications and future technology upgrades.
He added that improved broadband infrastructure would enhance business competitiveness, expand digital services, improve productivity and attract greater investment into the country’s digital economy.
The NCC boss disclosed that the commission is conducting a Wholesale Fixed Broadband Market Assessment to evaluate competition in the wholesale broadband segment and identify measures to encourage infrastructure investment.
He said the assessment would also promote infrastructure sharing, strengthen open access models and improve affordability for consumers.
Maida renewed the commission’s call on state governments to remove barriers to fibre deployment, identifying Right of Way (RoW) approvals as one of the major obstacles to broadband expansion.
He said excessive RoW charges, prolonged approval timelines and multiple permitting requirements continue to increase deployment costs and delay network rollout.
According to him, 13 states have completely waived Right of Way charges, while 16 others have adopted the National Economic Council’s recommended rate of N145 per linear metre.
He said the commission would continue engaging the remaining states to eliminate impediments to broadband investment.
The NCC also disclosed that it had launched an Ease of Doing Business Portal to provide investors and network operators with state-by-state information on Right of Way charges, approval procedures and regulatory requirements.
Maida urged governments, property developers and urban planners to incorporate telecommunications infrastructure into the design of new residential and commercial developments.
He also stressed the need to enforce technical and safety standards in fibre deployment projects, warning that poor installation practices and substandard materials could lead to service disruptions and increased maintenance costs.
“Our priority is not simply that fibre is deployed quickly, but that it is built to last and capable of supporting Nigeria’s digital ambitions for decades to come,” he said.
Court Asks CBN, NIBSS to Seek Settlement in N98.5Bn Patent Suit
World Bank Approves Fresh $1.25Bn Loan for Nigeria
WhatsApp Usernames Spark Privacy Fears
Report Reveals More than Half of Users Encountered Fraud or Scams Online
Airtel Nigeria CEO Urges Adoption of Intelligent Technology Platforms to Accelerate National Growth
Mobile Internet Gender Gap Widest in Africa – GSMA
London Strengthens Global Investment Ties with Africa @ First Ever London-Africa Business Summit
FG Targets Alleged N3tn Capital Flight, Opens Airtime Credit Market to Nigerian Fintechs
Japan, UNESCO Boost Digital Learning in 15 CoEs with Donation of ICT Equipment
African Electric Vehicle Platform Raises $215m to Scale Electric Mobility in Nigeria, Others
E-Financial2 days agoWema Bank Suspends Telegram Operations over Scams
E-Financial2 days agoNDIC Says 281m Depositors Protected against Bank Failure
E-Financial2 days agoNAICOM Moves to Deepen Penetration Through Licensing of a New Insurtech
Telecom2 days agoNCC Ranked Among Nigeria’s Top 3 Best-Performing Federal Agencies
E-Business2 days agoKaspersky Reveals Malware Attacks on SMBs Disguised as AI Services Surged by Five Times in 2026
Telecom2 days agoWomenovate, MTN Foundation Lead Charge for Inclusive Tech at Women in Technology and Engineering Summit
General News2 days agoEVC NCC, Aminu Maida, to Lead Speakers @ Business Journal Fintech & Financial Inclusion Roundtable 2026
News2 days agoFG Captures 32m Students DNEMIS ahead July 1 Rollout