Broadcasting
Sophos Research Details How Conti Gang, Karma Dual Ransomware Attack Hold Businesses Hostage
Sophos, a global leader in next-generation cybersecurity, on Wednesday released findings of a dual ransomware attack where extortion notes left by Karma ransomware operators were encrypted 24 hours later by Conti, another ransomware gang that was in the target’s network at the same time.
Sophos details the dual attacks in the article, “Conti and Karma Actors Attack Healthcare Provider at Same Time Through ProxyShell Exploits,” explaining how both operators gained access to the network through an unpatched Microsoft Exchange Server, but then used different tactics to implement their attacks.
“To be hit by a dual ransomware attack is a nightmare scenario for any organization. Across the estimated timeline there was a period of around four days when the Conti and Karma attackers were simultaneously active in the target’s network, moving around each other, downloading and running scripts, installing Cobalt Strike beacons, collecting and exfiltrating data, and more,” said Sean Gallagher, senior threat researcher, Sophos.
“Karma deployed the final stage of its attack first, dropping an extortion notice on computers demanding a bitcoin payment in exchange for not publishing stolen data.
“Then Conti struck, encrypting the target’s data in a more traditional ransomware attack. In a strange twist, the Conti ransomware encrypted Karma’s extortion notes.
“We have seen several cases recently where ransomware affiliates, including affiliates of Conti, used ProxyShell exploits to penetrate targets’ networks.
“We have also seen examples of multiple actors exploiting the same vulnerability to gain access to a victim.
“However, very few of those cases involved two ransomware groups simultaneously attacking a target and it shows, literally, how crowded and competitive the ransomware landscape has become.”
The Dual Attack
Sophos believes that the first incident started on Aug. 10, 2021, when attackers, possibly Initial Access Brokers, used a ProxyShell exploit to gain access to the network and establish a foothold on the compromised server. The Sophos investigation showed that almost four months passed before Karma appeared on Nov. 30, 2021, and exfiltrated more than 52 gigabytes of data to the cloud.
On Dec. 3, 2021, three things happened:
· The Karma attackers dropped an extortion note on 20 computers, demanding a ransom and explaining that they did not encrypt the data because the target was a healthcare provider
· Conti was quietly operating in the background also exfiltrating data
· The target started onboarding Sophos’ incident response team to help with Karma
While Sophos was onboarding, Conti deployed its ransomware on Dec. 4, 2021. Sophos subsequently tracked the start of the Conti attack to another ProxyShell exploit leveraged on Nov. 25, 2021.
“Whether the initial access broker sold access to two different ransomware affiliates, or whether the vulnerable Exchange server was just an unlucky target for multiple ransomware operators, the fact that a dual attack was possible is a powerful reminder to patch widely known, internet-facing vulnerabilities at the earliest opportunity,” said Gallagher.
“Defense-in-depth is vital for identifying and blocking attackers at any stage of the attack chain, while proactive, human-led threat hunting should investigate all potentially suspicious behavior, such as unexpected remote access service logins or the use of legitimate tools outside the normal pattern, as these could be early warning signs of an imminent ransomware attack.”
Sophos endpoint products, such as Intercept X, protect users by detecting the actions and behaviors of ransomware and other attacks, such as those described in this Sophos research.
For further information read the article, “Conti and Karma Actors Attack Healthcare Provider at Same Time Through ProxyShell Exploits.”
Additional Resources
- Further details on the evolving cyberthreat landscape can be found in the Sophos 2022 Threat Report
- Tactics, techniques, and procedures (TTPs) and more for different types of threats are available on SophosLabs Uncut, which provides Sophos’ latest threat intelligence
- Information on attacker behaviors, incident reports and advice for security operations professionals is available on Sophos News SecOps
- Learn more about Sophos’ Rapid Response Service that contains, neutralizes and investigates attacks 24/7
- The four top tips for responding to a security incident from Sophos Rapid Response and the Managed Threat Response Team
- Read the latest security news and views on Sophos’ award-winning news website Naked Security and on Sophos News
MTN Group has begun rolling out MTN One TV, a new entertainment proposition designed to make digital video content more accessible, relevant, and flexible for customers across African markets.
Introduced in line with MTN’s Ambition 2030 strategy, MTN One TV brings together local storytelling, live channels, international programming, and market-specific viewing options tailored to how customers across the continent access and pay for digital entertainment.
The proposition is designed to give customers greater choice in how they watch content, with viewing models that may vary by market and can include free-to-view content, advertising-funded experiences, pay-as-you-watch access, and subscription offerings.
Depending on local availability, customers may also be able to pay through airtime, Mobile Money, and other locally supported payment methods, helping to reduce common barriers to streaming access.
Beyond enhancing customer experiences, MTN One TV creates new opportunities for African creators, broadcasters, advertisers, and ecosystem partners by helping connect content to wider audiences through MTN’s scale across connectivity, payments, and digital services.
By bringing together a broad mix of content experiences under a single proposition, MTN aims to support greater content discovery, broader audience reach, and sustainable growth across Africa’s digital entertainment ecosystem.
Anchored in MTN’s strategic platforms of Connectivity, Fintech, and Digital Infrastructure, MTN One TV forms part of the Group’s broader ambition to build digital experiences that create value for customers while enabling participation and growth across Africa’s digital economy.
“Entertainment is increasingly becoming an important gateway to digital participation,” said Selorm Adadevoh, MTN group chief commercial, strategy and transformation officer.
“Through MTN One TV, we are leveraging the scale of our connectivity, fintech, and digital capabilities to make relevant content more accessible while creating new opportunities for Africa’s creative and digital economies. This is aligned with our ambition to deliver digital solutions for Africa’s progress.”
MTN One TV is being introduced progressively across MTN markets through a phased rollout approach that reflects local market needs, existing services, and partnership opportunities.
Over time, MTN will bring together a combination of video capabilities, content partnerships, and customer experiences under the MTN One TV brand to create a more consistent and scalable entertainment proposition across its footprint.
Through MTN One TV, MTN continues to extend its role beyond connectivity by combining entertainment, payments, and digital services to deliver experiences tailored to the needs of African consumers.
The rollout supports MTN’s Ambition 2030 vision of leading digital solutions for Africa’s progress while expanding access to digital entertainment across the continent.
International Air Transport Association (IATA) has identified Nigeria as one of the most expensive countries in the world for airline operations, citing high taxes, charges and operational costs that continue to weigh heavily on local carriers.
IATA’s Regional Vice President for Africa and the Middle East, Kamil Al-Awadhi, disclosed this during the association’s Annual General Meeting held in Rio de Janeiro.
Al-Awadhi said that although Nigeria’s Minister of Aviation and Aerospace Development, Festus Keyamo, had been pursuing reforms aimed at improving the aviation sector, airlines operating in the country still faced enormous cost pressures.
According to him, the high-cost operating environment has continued to affect the profitability and competitiveness of Nigerian airlines, making it difficult for the industry to realise its full potential.
He noted that excessive taxes, regulatory charges and other operating expenses remained major obstacles to airline growth across the region, with Nigeria ranking among the most challenging markets from a cost perspective.
Al-Awadhi urged member states of the Economic Community of West African States to adopt a proposed 25 per cent reduction in aviation taxes and charges to ease the burden on airlines and passengers.
According to him, lowering taxes and charges would reduce airfares, stimulate passenger traffic and strengthen the competitiveness of carriers operating within West Africa.
He stressed that a more supportive policy environment was critical to unlocking the economic benefits of aviation, including increased trade, tourism and regional integration.
Industry stakeholders have consistently advocated lower taxes and regulatory fees, arguing that the current cost structure makes air travel less affordable and limits the growth of the sector.
IATA’s latest remarks add to calls for governments in West Africa to implement policies that will promote a more sustainable and competitive aviation industry across the region.
Broadcasting
NASENI Trains 50 Women in Kano on Renewable Energy Technologies Under She-Powers Initiative
The National Agency for Science and Engineering Infrastructure (NASENI), under the leadership of its Executive Vice Chairman/CEO, Khalil Suleiman Halilu, has trained 50 women in Kano State on inverter and battery technologies through its She-Powers Energy Initiative.
The three-day programme, held at the Technology Incubation Centre, Farm Centre, Kano which ended yesterday, was designed to equip participants with practical renewable energy skills, promote women-led enterprises, and enhance sustainable livelihoods.
The initiative forms part of NASENI’s broader commitment to empowering women, creating economic opportunities, and expanding participation in Nigeria’s growing clean energy sector. It also aligns with the Renewed Hope Agenda of President Bola Ahmed Tinubu by supporting job creation, entrepreneurship, and inclusive economic development.
Through targeted interventions such as the She-Powers Energy Initiative, NASENI continues to demonstrate its commitment to leveraging technology and innovation to improve lives and drive sustainable development across the country.
Photos: Participants at the She-Powers Energy Initiative training organised by the National Agency for Science and Engineering Infrastructure (NASENI) held at the the Technology Incubation Centre, Farm Centre, Kano yesterday.
Galaxy Backbone @ 20, Pledges Nationwide Connectivity, Data Sovereignty
KidsCook Showdown 2.0 Set to Empower Public School Pupils with Culinary, Life Skills
CBN Orders Banks, Fintechs to Host Payment Data Locally
PalmPay Joins Industry Leaders @ Digital Pay Expo 2026
UK Bans TikTok, Instagram, Facebook for Under-16s in Landmark Crackdown
CBN Extends PoS Geo-Fencing Enforcement Deadline to August 2026
NCC Drafts New Rules for Virtual Mobile Operators
TD Africa, HPE Drive Conversations on the Future of Intelligent Networking
London Strengthens Global Investment Ties with Africa @ First Ever London-Africa Business Summit
Easybuy Partners WAWUAfrica to Upskill 10 Million Youths and Women, Boosting Nigeria’s Economic and Financial Inclusion
E-Business2 days agoCSOs Raise Alarm over Nigeria’s Data Protection Crisis
E-Business1 day agoAI-Powered Cyber Threats Put Nigerian Banks on Alert
General News2 days ago₦5m up for Grabs as 10 Startups Clash at the Gathering on 100 Pitchathon Aba
E-Financial2 days agoCBN to Expand eNaira for Salaries, Pensions and Welfare Payments
General News2 days agoCBN Moves to Stop Banks From Using Customers’ Money for Fintech Subsidiaries
E-Financial2 days agoCBN to Bar HoldCos from Influencing Banks’ Lending Decisions
Telecom2 days agoNITDA Reveals Why AI Could Be Nigeria’s Biggest Wealth Creator, Not Oil
Telecom2 days agoNASENI Unveils Ambitious Plan to Produce 600 Million Diagnostic Kits Annually