Telecom
Sophos Report: Identity Attacks Drive 67% of Cyber Incidents as Threat Groups Surge in 2025
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released the 2026 Sophos Active Adversary Report.
John Shier
It reveals that 67% of all incidents investigated by Sophos Incident Response (IR) and Managed Detection and Response (MDR) teams last year were rooted in identity-related attacks.
The findings highlight how attackers continue to exploit compromised credentials, weak or missing multifactor authentication (MFA), and poorly protected identity systems, often without needing to deploy new tools or techniques.
Key findings include:
- A shift from exploited vulnerabilities toward compromised credentials, with brute-force activity (15.6%) drawing almost level with exploitation (16%) as an initial access method
- Median dwell time declined to three days. This was driven by attackers’ movements, but also by defenders reacting more swiftly. This was particularly notable in MDR environments.
- Attackers are getting faster at reaching Active Directory (AD). Once an attacker is inside an organization it takes them just 3.4 hours to get to the AD server.
· Ransomware remains a firmly off-hours activity. 88% of ransomware payloads are deployed out of hours, and 79% of data exfiltration actions take place out of hours, emphasising the continued need for 24/7 coverage.
- Lack of telemetry undermines defense efforts. Missing logs due to data retention issues doubled over last year. This rise was largely driven by firewall appliances where the default was only seven days, and in some cases, 24 hours.
Identity Attacks Accelerate While MFA Gaps Persist
The report shows a continued rise in attacks rooted in identity compromise, including stolen credentials, brute-force activity, and phishing.
While exploited vulnerabilities remain a factor, attackers increasingly rely on valid accounts to gain initial access, allowing them to bypass traditional perimeter defenses.
There was also a lack of MFA in 59% of cases, facilitating the abuse of stolen and compromised credentials to penetrate an organization.
“The most concerning finding in the report has actually been years in the making: The dominance of identity-related root causes for successful initial access.
“Compromised credentials, brute-force attacks, phishing, and other tactics leverage weaknesses that can’t be addressed by simple patch hygiene. Organizations must take a proactive approach to identity security,” said John Shier, Field CISO and lead author of the report.
More Threat Groups, Broader Risk
Sophos researchers observed the highest number of active threat groups recorded in the report’s history, expanding the overall threat landscape and increasing the challenge of attribution.
- Akira (GOLD SAHARA) and Qilin (GOLD FEATHER) were the most active ransomware brands observed, with Akira dominating across 22% of incidents
- 51 ransomware brands appeared across cases, including 27 returning brands and 24 new ones
- Only four brands or techniques, LockBit, MedusaLocker, Phobos, and abuse of BitLocker, have persisted continuously since 2020, the first year of Active Adversary Report data
“Law enforcement action continues to cause disruption in the ransomware ecosystem. Although we still see activity from LockBit, the dominance and reputation it once had has clearly been impacted.
“However, it means we are seeing a raft of other groups vying for dominance and many more emerging groups. For defenders, it’s important to understand the groups and their TTPs in order to best protect your organization,” continued Shier.
AI Hype Meets Reality
Despite widespread predictions, Sophos found no evidence of a major AI-driven transformation in attacker behavior. While generative AI has increased the speed and polish of phishing and social engineering, it has not yet produced fundamentally new attack techniques.
“AI is adding scale and noise but not yet replacing attackers. While in the future GenAI could be the next accelerator, right now the fundamentals still matter: strong identity protection, reliable telemetry, and the ability to respond quickly when something goes wrong,” said Shier.
Defensive Takeaways
Based on the findings of the 2026 Active Adversary Report, Sophos recommends organizations:
- Deploy phishing-resistant MFA and validate its configuration
- Reduce exposure of identity infrastructure and internet-facing services
- Patch known vulnerabilities promptly, especially on edge devices
- Ensure 24/7 monitoring through MDR or equivalent capabilities
- Preserve and retain security logs to support rapid detection and investigation
The 2026 Sophos Active Adversary Report analyzed 661 IR and MDR cases handled between November 1, 2024 and October 31, 2025, spanning organizations across 70 countries and 34 industries.
You can read the full report here[SE1] . https://www.sophos.com/en-us/blog/2026-sophos-active-adversary-report
Nigerian Communications Commission (NCC) has thrown its weight behind the upcoming Telecom Sector Sustainability Forum (TSSF 7.0), confirming its role as the headline keynote speaker for the Lagos event.
Over the years, the Telecoms Sector Sustainability Forum (TSSF) has evolved into a landmark industry convergence platform and an actionable catalyst for policy alignment, driving critical dialogue around the regulatory, economic, and infrastructural frameworks required to sustain Nigeria’s digital economy.
Taking place on 16th September, 2026, at the Radisson Blu Hotel, Ikeja, Lagos State, the seventh edition of the Telecoms Sector Sustainability Forum (TSSF 7.0), organised under the aegis of Business Remarks, will bring together key stakeholders driving the next phase of Nigeria’s telecommunications and digital growth.
Themed “Rethinking Nigeria’s Digital Infrastructure Strategy to Attract Investment and Drive Innovation”, TSSF 7.0 will address some of the sector’s most pressing priorities, such as policies, digital infrastructure expansion, digital inclusion, good connectivity, partnerships and investments needed to accelerate Nigeria’s next wave of innovations, digital transformation and economic growth.
Organised by Business Remarks, the forum has consistently brought together policymakers, mobile network operators (MNOs), infrastructure providers, data centre operators, policy advocates and financial technology stakeholders to dissect the pressing challenges facing the telecommunications ecosystem and chart a sustainable path forward.
Past editions have successfully addressed pivotal industry shifts, ranging from broadband penetration strategies, human capital flight, mobile virtual network operators (MVNOs) sustainability and infrastructure deficit funding to the operational integration of emerging technologies. By providing a neutral, high-level platform where regulators like the Nigerian Communications Commission (NCC) can interface directly with private sector players, the forum plays a vital role in ensuring that regulatory frameworks evolve in tandem with market realities.
Speaking about the event, the Convener, Bukola Olanrewaju, said the Nigerian telecoms sector investment has grown to $75.6 billion as of 2025, with a planned investment of over $1.38 billion in network capacity upgrades in 2026 targeted to enhance infrastructure resilience, boost coverage and improve quality of service for subscribers nationwide.
“As the industry faces a new frontier defined by deepening 5G and 4G penetration, expanding fibre optic networks, and complex macroeconomic pressures, the need to meet the growing demands for digital services while remaining profitable has become the defining challenge of the modern telecommunications landscape.”
At a time when investment in connectivity, subsea cables, fibre networks, data centres, cloud infrastructure and cybersecurity is reshaping the country’s digital landscape, TSSF remains a vanguard of thought leadership and industry engagement, fostering the public-private collaborations necessary to safeguard the backbone of Nigeria’s digital transformation.
MTN Nigeria is accelerating investments in network expansion and modernization to address rising demand for mobile and data services across the country.
The operator is deploying additional base stations, upgrading existing infrastructure, and expanding fiber connectivity to improve network capacity, coverage, and service quality.
The investments are designed to support increasing smartphone adoption, higher data consumption, and the growing use of digital services by consumers and businesses.
MTN said the expansion aligns with its long-term strategy to enhance customer experience while strengthening Nigeria’s digital infrastructure.
The company expects the ongoing upgrades to improve connectivity, support economic growth, and enable broader access to reliable telecommunications services as demand for high-speed broadband continues to increase.
Airtel Africa’s CEO, Sunil Taldar, has announced the telco’s commitment to connecting 5,000 schools across its operating countries in Africa to the internet by 2027 through its philanthropic arm, Airtel Africa Foundation, in partnership with the United Nations Children’s Fund (UNICEF).
So far, the $57m partnership, which was launched in 2021, has cumulatively connected 3,296 schools and provided access to over 2 million learners and about 40,000 teachers. 64 digital learning platforms have been zero-rated thereby enabling more than 11m users to access educational content at no cost.
Speaking during a visit to St. Monica’s Girls School in Lusaka, which is one of the 300 schools already connected to the internet in Zambia, the Airtel Africa CEO stated that the initiative is having a profound impact on the quality of education by expanding access to digital learning resources for African children, in collaboration with governments.
Mr Taldar added: “Students are accessing best-in-class education from the curriculum developed by UNICEF in partnership with various Ministries of Education and provided through Airtel’s connectivity.
“We are also training teachers, so that they deliver digital education effectively. We aim to continue deepening meaningful connectivity in schools by providing free internet access, zero‑rated platforms and training teachers across the continent”.
Expressing her appreciation, the Headmistress of St. Monica’s Girls’ School, Sr Matilda Soloko said: “Being among the first schools connected in the initial stage, our learners have been able to study using the learning portal and their studies have been intensified. We remain grateful to Airtel and UNICEF.”
UNICEF’s Country Representative for Zambia, Dr Saja Farooq Abdullah said: “What this partnership has brought is really bridging the equality gap and the digital divide. It is making sure that every child learns wherever they are. It was exciting and interesting to see and hear from the girls how they can learn at their own pace, how they can review the materials, and how they do their homework with comfort.
The Director of Secondary Education in Zambia’s Ministry of Education, Yvonne Mwemba Chuulu lauded UNICEF and Airtel for the partnership saying: “At the Ministry of Education, we cannot do it alone, and we are grateful for the partnership that we have today.
“Our children are able to learn in a blended fashion, where we have a teacher who is also employing digital devices. We have also heard from the learners that they are able to access the portal when they are at home, which is a good thing because our learners continue to learn in the comfort of their homes”.
The School Connection programme is expanding digital learning to learners in 13 countries: Chad, Congo, Democratic Republic of Congo, Gabon, Kenya, Madagascar, Malawi, Niger, Nigeria, Rwanda, Tanzania, Uganda, and Zambia. By equipping these schools with internet connectivity and training teachers on using the digital tools, it is providing children, particularly in underserved and remote regions, with the digital tools and skills they need to thrive.
Airtel Africa Foundation is advancing inclusive development across four strategic pillars, Financial Inclusion, Education, Environmental Sustainability and Digital Inclusion.
Xora Finance, Fintech Firm Refuses to Hire Nigerians over Alleged Dishonesty
FG Secures Fresh $208.3m World Bank Loan for Cash Transfer
How Ponzi Scheme Victims can Seek Legal Remedies — Lawyers
SERAP Sues INEC over Alleged N800Bn 2027 Tinubu Campaign Fund
Kaigama,Catholic Archbishop of Abuja Warns against Misuse of AI
Nigeria Launches FreeTV Nationwide
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
NRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
Lebara Nigeria Launches Lebara Play, Africa’s First Telecom-Owned Micro-Drama Platform
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
Telecom2 days agoDStv, GOtv Owner MultiChoice Officially Joins Canal+ Group
News2 days agoPolice Busts Syndicate Who Allegedly Stole N3Bn from Financial Institution
Telecom2 days agoMTN Accelerates Network Expansion to Meet Surging Telecom Demand
E-Financial2 days agoSEC Unveils Plans to Enforce Mandatory ESG Reporting for Large Firms Next Year
Telecom2 days agoAirtel Africa to Connect 5,000 Schools to Free Internet by 2027
Broadcasting2 days agoFrom Scarcity to Scale: What Africa Can Learn from India’s Agricultural Transformation
E-Business2 days agoTeKnowledge, Equinix Partner to Advance Nigerian Digital Infrastructure
General News2 days agoNSIB Faults Runway Identification, Reveals Cockpit Disagreement in Asaba Jet Incident