Connect with us

Telecom

How Sophos Uncovered ‘Black Kingdom’ Ransomware Taking Advantage of ProxyLogon Vulnerabilities

Published

on

Kindly share this post

Following the reporting of the Microsoft Exchange vulnerabilities and the out-of-band release of security patches on March 2, a growing number of new adversaries are exploiting these bugs to launch attacks, a global cyber security company, Sophos, has discovered.  

Last week Sophos reported on attacks by DearCry ransomware.

To this end, Sophos has published “Black Kingdom Ransomware Begins Appearing on Exchange Servers,” detailing Black Kingdom ransomware that has been targeting Exchange servers that remain unpatched against the ProxyLogon vulnerabilities.

In the report, Sophos said that the Black KingDom ransomware is far from the most sophisticated payload we’ve seen. In fact, the early analysis by Sophos reveals that it is somewhat rudimentary and amateurish in its composition, but it can still cause a great deal of damage.

“It may be related to a ransomware of the same name that appeared last year on machines that, at the time, were running a vulnerable version of the Pulse Secure VPN concentrator software”, Sophos said.

Delivered through a webshell that was sent over Tor

The delivery of Black KingDom was orchestrated from a remote server with an IP address that geolocates to Germany, 185.220.101.204, while the attacker operated from 185.220.101.216.

Unfortunately, because both IP addresses belong to a Tor exit node, it’s impossible to know where the attackers are physically located.

The threat actor exploited the on-premises versions of Microsoft Exchange Server, abusing the remote code execution (RCE) vulnerability also known as ProxyLogon (CVE-2021-27065).

After successfully breaching the Exchange server, the adversary delivered a webshell. This webshell offers remote access to the server and allows the execution of arbitrary commands.

Some of the key findings are summarized in the following commentary from Mark Loman, a ransomware expert at Sophos and director, engineering technology office, thus:

It’s been three weeks since the release of security patches for the ProxyLogon vulnerabilities, and adversaries are racing against time to target still unpatched Exchange servers. As we saw with DearCry ransomware, this can lead to the release of prototype, rushed or poor quality code created by less experienced developers. Today we report on another example of this, perpetrated by the operators behind Black Kingdom ransomware. 

“The Black Kingdom ransomware targeting unpatched Exchange servers has all the hallmarks of being created by a motivated script-kiddie. The encryption tools and techniques are imperfect but the ransom of $10,000 in bitcoin is low enough to be successful. Every threat should be taken seriously, even seemingly low-quality ones.

“Defenders should take urgent steps to install Microsoft’s patches to prevent exploitation of their Exchange Server. In addition, the Exchange server should be scanned for web shells that allow attackers to run commands on the server. If this is not possible, the server should be disconnected from the internet or closely monitored by a threat response team.”  – Mark Loman, director, engineering technology office, Sophos

 Sophos Intercept X and Sophos Intercept X with EDR against threats attempting to exploit the ProxyLogon Exchange vulnerabilities. 


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

General News

Why Elon Musk Halted Sales of Starlink in Lagos, Abuja

Published

on

Kindly share this post

Starlink, the satellite internet provider operated by Elon Musk’s SpaceX, has stopped taking new orders for residential kits in parts of Lagos and in Abuja after network capacity was reached, the company’s online ordering page shows.

starlink

Neighborhoods listed as sold out include Victoria Island, Ikoyi, Lagos Island and Surulere.

Prospective customers in those areas can join a wait list by paying a deposit and will be notified when service space opens.

At Chevyville Estate in Lekki, one resident trying to subscribe was met with a message that read: “Starlink service is currently at capacity in your area. However, you can place a deposit now to reserve your spot on the waitlist and receive a notification as soon as service becomes available again.”

That experience mirrors what consumers in other busy districts are seeing.

A Starlink engineer who spoke on condition of anonymity to discuss internal limits said the company temporarily closes new sales in zones where adding customers would degrade service for existing users.

“It happens when the area cannot take a new customer due to its designed capacity at the time,” the engineer said.

“This also helps preserve a steady connection for people already online.” Remedies can include adding more ground infrastructure, securing regulatory clearances, or expanding satellite coverage.

Since entering Nigeria, Starlink’s monthly fee has climbed: the service began at about N38,000 (roughly $25), rose to about N45,000 ($30) and — by 2025 — was charging roughly N56,000 ($37).

Starlink has cited naira depreciation, higher operating expenses and costs tied to meeting rules set by the Nigerian Communications Commission for the increases.

Those higher prices, and the service interruptions, appear to have affected subscription numbers. After a near eight-month pause that began in November 2024 and was tied to limited bandwidth and regulatory issues, orders resumed in late June 2025.

Still, data from the NCC show active Starlink users in Nigeria fell from 65,564 in the fourth quarter of 2024 to 59,509 in the first quarter of 2025, a decline of more than 6,000 users, or about 9 percent.

Analysts point to the price rises, service holds and economic pressure as key reasons for the drop; some customers have switched to cheaper alternatives or stopped service.

As Elon Musk maintains his position as the world’s richest individual, with a net worth of $429 billion (according to the Bloomberg Billionaires Index), his commitment to global digital inclusion through Starlink remains a central focus.

Starlink’s activity in Nigeria is part of a wider push across Africa.

The company has recently moved to enter markets including Lesotho and Somalia and secured permission to operate in the Democratic Republic of Congo after earlier restrictions,

SpaceX is also working with operators such as Airtel Africa to reach rural areas where wired internet is scarce.

For many users in Nigeria, the appeal of Starlink remains clear: a reliable option where terrestrial networks falter.

But until the company expands capacity or adjusts pricing, consumers in dense urban pockets may have to wait for access or turn to other providers.

 

Credit excluding Headline: Pm News

 

 

 


Kindly share this post
Continue Reading

Telecom

Google Expands Digital Infrastructure with Four New Subsea Cable Hubs and $9m AI Fund for Africa

Published

on

Kindly share this post

Google has announced a new set of investments in Africa, reaffirming its nearly two-decade commitment to the continent’s digital transformation.

The latest commitments focus on empowering Africa’s next generation through AI, unlocking opportunities and expanding on the innovation capacity of young Africans. They cover internet connectivity; youth-led learning and innovation; and skills training.

Connectivity

Google is announcing four strategic subsea cable connectivity hubs in the north, south, east and west regions of Africa. This investment creates new digital corridors within Africa and between Africa and the rest of the world – ultimately deepening international connectivity and resilience, as well as spurring economic growth and opportunity.

This is the latest addition to Google’s Africa Connect infrastructure program, which sees the company build vital connectivity across the continent: including the Google Cloud region in Johannesburg serving users across the continent, the Equiano cable running along the entire western seaboard of the continent, and Umoja, the first fiber optic route to directly connect Africa with Australia (running through Kenya, Uganda, Rwanda, Democratic Republic of the Congo, Zambia, Zimbabwe and South Africa).

Google’s investments to date have enabled 100 million Africans to access the internet for the first time, and the Equiano cable alone is expected to increase real GDP this year in Nigeria, South Africa and Namibia by an estimated $11.1 billion, $5.8 billion and $290 million, respectively.

Youth-led learning and innovation

Enabling Africa’s young people to learn, innovate and lead is critical to Africa’s development and economic growth. That’s why Google is today also announcing free one-year subscriptions to Google AI Pro plan for college students (18 or older) across the continent – starting with Egypt, Ghana, Kenya, Morocco, Nigeria, South Africa, Rwanda and Zimbabwe. The subscription provides advanced AI to students – from Deep Research, which helps save time with custom research reports and in-depth information from hundreds of sources across the web, to Gemini 2.5 Pro, which provides help with assignments or writing.

Building skills and solutions

Equipping people with AI skills is critical. To date, Google has trained 7 million Africans and plans to train an additional 3 million students, young people, and teachers by 2030. Google is also bolstering local capacity by providing African universities and research institutions with over $17 million in funding, curriculum, training and compute and access to advanced AI models over the past four years – with an additional $9 million planned for the coming year.

On the announcements, Alex Okosi, Managing Director for Google in Africa, said: “Africa’s digital economy holds immense potential, and it will be driven by the talent and ingenuity of its next generation. Today’s announcements, spanning AI education, advanced tools for students, and expanded connectivity, are a unified investment into the upward trajectory of the continent.

“We are committed to providing the foundational infrastructure, the cutting-edge tools, and the financial support necessary for Africa’s youth to innovate, lead, and build a thriving digital world.”

Google’s long term partnership

These announcements are the latest chapter in Google’s long-term investment in the continent, which has delivered on $1 billion of investment. Google’s sustained commitment to Africa has included driving connectivity; training more than 7 million people across the continent in digital skills to support the future workforce; and supporting 153 startups from 17 African nations through the Google for Startups Accelerator Africa, helping them raise $300 million and create 3,500 jobs.

AI creates an unprecedented opportunity to benefit everyone, and Google is committed to making that a reality for people, businesses and communities across Africa. Today’s announcements are another example of how Google is continuing to expand connectivity, increase product access and skills across the continent and enable African-led innovation – with more to come.


Kindly share this post
Continue Reading

Telecom

MTN Nigeria to Lease Spectrum from T2 Mobile, Ends Agreement with Ntel

Published

on

Kindly share this post

MTN Nigeria Communications Plc has secured regulatory approval from the Nigerian Communications Commission (NCC) to lease frequency spectrum from T2 Mobile Limited (formerly 9Mobile), marking a strategic shift in its network expansion plans.

Effective October 1, 2025, MTN will lease 5MHz in the 900MHz band and 15MHz in the 1800MHz band from T2 Mobile for a period of three years.

This move supports MTN’s national roaming agreement with T2, enabling shared infrastructure to manage growing network traffic and improve service delivery

According to MTN Nigeria CEO Karl Toriola, the agreement aligns with the company’s Ambition 2025 strategy, which emphasizes cost-effective, sustainable growth, industry collaboration, and digital inclusion.

In a related development, MTN Nigeria has announced it will not renew its current spectrum lease with Natcom Development and Investment Ltd (Ntel). That lease—covering 5MHz in the 900MHz band and 10MHz in the 1800MHz band across 17 states—is set to expire on November 29, 2025.

MTN reaffirmed its commitment to investing in infrastructure and strategic partnerships to deliver high-quality, innovative telecom services across Nigeria.


Kindly share this post
Continue Reading

Trending