Connect with us

Telecom

How Sophos Uncovered ‘Black Kingdom’ Ransomware Taking Advantage of ProxyLogon Vulnerabilities

Published

on

Kindly share this post

Following the reporting of the Microsoft Exchange vulnerabilities and the out-of-band release of security patches on March 2, a growing number of new adversaries are exploiting these bugs to launch attacks, a global cyber security company, Sophos, has discovered.  

Last week Sophos reported on attacks by DearCry ransomware.

To this end, Sophos has published “Black Kingdom Ransomware Begins Appearing on Exchange Servers,” detailing Black Kingdom ransomware that has been targeting Exchange servers that remain unpatched against the ProxyLogon vulnerabilities.

In the report, Sophos said that the Black KingDom ransomware is far from the most sophisticated payload we’ve seen. In fact, the early analysis by Sophos reveals that it is somewhat rudimentary and amateurish in its composition, but it can still cause a great deal of damage.

“It may be related to a ransomware of the same name that appeared last year on machines that, at the time, were running a vulnerable version of the Pulse Secure VPN concentrator software”, Sophos said.

Delivered through a webshell that was sent over Tor

The delivery of Black KingDom was orchestrated from a remote server with an IP address that geolocates to Germany, 185.220.101.204, while the attacker operated from 185.220.101.216.

Unfortunately, because both IP addresses belong to a Tor exit node, it’s impossible to know where the attackers are physically located.

The threat actor exploited the on-premises versions of Microsoft Exchange Server, abusing the remote code execution (RCE) vulnerability also known as ProxyLogon (CVE-2021-27065).

After successfully breaching the Exchange server, the adversary delivered a webshell. This webshell offers remote access to the server and allows the execution of arbitrary commands.

Some of the key findings are summarized in the following commentary from Mark Loman, a ransomware expert at Sophos and director, engineering technology office, thus:

It’s been three weeks since the release of security patches for the ProxyLogon vulnerabilities, and adversaries are racing against time to target still unpatched Exchange servers. As we saw with DearCry ransomware, this can lead to the release of prototype, rushed or poor quality code created by less experienced developers. Today we report on another example of this, perpetrated by the operators behind Black Kingdom ransomware. 

“The Black Kingdom ransomware targeting unpatched Exchange servers has all the hallmarks of being created by a motivated script-kiddie. The encryption tools and techniques are imperfect but the ransom of $10,000 in bitcoin is low enough to be successful. Every threat should be taken seriously, even seemingly low-quality ones.

“Defenders should take urgent steps to install Microsoft’s patches to prevent exploitation of their Exchange Server. In addition, the Exchange server should be scanned for web shells that allow attackers to run commands on the server. If this is not possible, the server should be disconnected from the internet or closely monitored by a threat response team.”  – Mark Loman, director, engineering technology office, Sophos

 Sophos Intercept X and Sophos Intercept X with EDR against threats attempting to exploit the ProxyLogon Exchange vulnerabilities. 


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Telecom

SIM Boxing, And the Unboxing of Crime Syndicate

Published

on

Kindly share this post

By Suleiman Bala Bakori

Boxes have a multitude of uses, and the word “box”, lends itself to diverse contexts.

SIM Boxing, And the Unboxing of Crime Syndicate

For “Ajala Travelers,” the box is a necessity for keeping goods for their endless journeys. In literature, idiomatically, it can be said that “one has been boxed into a corner;” another might say to deal with a conundrum: “think outside the box;” then there is the “Pandora’s box” that no one wants opened.

To “box one’s ear’s” refers to a hit on the head, especially around one’s ears. For those who celebrate Christmas, “Boxing Day,” which is the 26th of December, the second day of Christmastide is not to be joked with: A day to unbox gifts. So much for the box.

Another type of boxes exists in the telecommunications world: The SIM Box. Have you ever received an international call but saw a local phone number ring in?

That is SIM Boxing in action. Let me explain.

SIM boxing happens when a person uses a special equipment, what is called a SIM Box containing tens to hundreds of SIM Cards—from 32, to 96, to 512 and more SIMs —to terminate international calls by bringing in the international call into the SIM Box using internet connections and regenerating the calls to the called party from one of the hundred SIMs in the box.

This way, the called party will see the local number of the SIM from the SIM Box, and not the original international number calling.

With SIM Boxes, the syndicate charges international call carriers lower rates than what regular Nigerian telecommunications operators would charge, as they do not have to pay the full cost of maintaining and operating a phone network.

Basically, they are bypassing the normal route for international phone call termination to terminate international calls cheaply and making windfall profits off it.

Take for instance, a telecommunications operator in Nigeria would ordinarily charge international carriers 10cents per minute for terminating an international call in Nigeria. However, by routing the call through a SIM Boxing syndicate, the international telecommunications carrier only pays a fraction of the charge to the syndicate, say 5cents per minute and does not have to pay the full 10cents per minute charge.

The SIM Boxer will terminate this call to the called subscriber at a rate of, say N15 per minute using one of the SIM cards in their SIM Box.

The SIM Boxer thus makes a killing from the differential between the rate charged to the international carrier and the rate paid to telecommunications operators whose SIM they utilise in their SIM Boxes, at the expense of our national security and income of mobile network operators and quality of our service to consumers.

Asides the revenue loss that local mobile network operators suffer courtesy the activities of these syndicates, networks face congestion around areas where the illegal call routings via SIM Boxing occurs.

With the huge traffic from the boxes, callers around the area see more dropped calls, poor call quality, and slower data speeds.

The introduction of the linking of National Identity Numbers (NIN) to SIMs is one way the Federal Government has worked to tackle this criminal enterprise.

With every SIM in the country being linked to an NIN, an identity is tied to the owner of each line, and regulators now have visibility of ownership.

That is not all. There is also the “Max-4 Rule” where a subscriber is not allowed to have more than four lines per network operator linked to his NIN.

With this rule in place, coupled with the NIN-SIM Linkage, every telephone subscriber in Nigeria would not just be accurately identifiable but limited to having only four telephone lines per subscriber.

To enforce this rule, the Nigerian Communications Commission (NCC) on the 29th of March 2024 announced the deadline for Mobile Network Operators to bar all subscribers who had five lines and above, and whose NIN failed the verification test of biometrics matching.

Over the last few weeks, sources within the NCC have confirmed cases where a single NIN was linked to over 100,000 lines.

Some NINs had well over 10,000 SIMS linked to them, others over a thousand, others had hundreds.

Many have questioned the reports and asked, what would any single reasonable person be doing with these number of lines? Justifiable questions, because no sane person—who is not running a business—should own more than five SIM cards.

Given the ‘Max 4 Rule’ in place and the NIN-SIM Linkage Policy, SIM Boxers have been boxed into a corner.

The applications they use require tens to thousands of SIM Cards, and the imperative to stay anonymous.

If these policies are well and fully implemented, this is the death knell for SIM Boxing merchants.

But the regulator, NCC needs to be fast and ready for the battle ahead. SIM Boxing is a billion-dollar criminal enterprise.

They are not going to go down without a fight. It is like taking a bone being chewed from the mouth of a bulldog.

Already, the battle seems to have kicked off.

A lawyer, Barrister Olukoya Ogunbeje has recently taken the Federal Government, NCC and Mobile Network Operators to court, claiming that the barring of SIMs not linked to NINs goes against his fundamental human rights, and has cost him the loss of business opportunities.

Anyone who has Nigeria’s interest at heart ordinarily supports this policy. It then does not add up seeing a so-called activist lawyer take up such a matter that is clearly against the public interest—unless this is the Haka cry of SIM Boxers.

A most interesting observation with his case is that it is not even a class action, but individually driven. It begs the question then, who is funding Barr. Olukoya Ogungbeje?

What is his interest in fighting this policy that puts paid to the business of a criminal enterprise? Is he funded by interests in the SIM Boxing world?

Time would tell. But in the meantime, NCC must go head on without fear or intimation and clean the Augean stable of SIM ownership in Nigeria.

Suleiman Bala Bakori is a researcher, and writes from the FCT.

 

 


Kindly share this post
Continue Reading

Telecom

SHELT SI Achieves Cisco Select Partner Certification

Published

on

Kindly share this post

SHELT System Integration (SHELT SI) has announced its achievement of Cisco Select Partner certification in Nigeria, marking a significant milestone in its commitment to delivering top-tier networking and security solutions to businesses across the region.

This certification underscores SHELT SI’s dedication to excellence in providing innovative networking and security solutions tailored to meet the evolving needs of the market.

The Cisco Select Partner certification is a validation of SHELT SI’s technical expertise and commitment to customer satisfaction, as well as its ability to deliver cutting-edge networking and security solutions that drive business success. With this recognition, SHELT SI is affirming its ability to further enhance its offerings and support its clients in navigating the complexities of the digital landscape.

Cisco Nigeria General Manager Sebastine Nzeadibe comments: “We are delighted to welcome SHELT SI to the ranks of Cisco Select Partners in Nigeria.

“Their demonstrated commitment to excellence and customer satisfaction aligns perfectly with our values, and we look forward to collaborating closely together to empower businesses with transformative networking and security solutions.”

Youssef Abillama, CEO of SHELT, comments: “Achieving this certification strengthens our relationship with CISCO and is a testament to our team’s dedication and expertise in delivering best-in-class solutions.

“This milestone reinforces our commitment to empowering businesses in Nigeria with innovative technology solutions that will enable them to thrive in the digital age through cutting-edge technology solutions.”

SHELT’s Country General Manager, Walid Bou Abssi, added, “The Cisco Select certification empowers us to provide an increased level of support and further enhances our ability to address the requirements of our clients’ evolving needs in Nigeria.

“It is an acknowledgement of the ability of our pre-sales, sales, and client support teams to design, quote, deploy, and support Cisco solutions.”

 

 

 


Kindly share this post
Continue Reading

Telecom

Nigeria May Re-introduce Telecom Tax to Obtain new $750m World Bank Loan

Published

on

Kindly share this post

Nigeria may reinstate a previously suspended telecom tax and other fiscal measures as it seeks to secure a new $750 million loan from the World Bank, as per Nairametrics report.

Nigeria May Re-introduce Telecom Tax to Obtain new $750m World Bank Loan

This is according to the Stakeholder Engagement Plan for Nigeria – Accelerating Resource Mobilisation Reforms (ARMOR) P-For-R (P177308) program dated March 2024, between Nigeria and the World Bank.

A copy of the plan’s document was obtained and seen by Nairametrics suggest the government reintroduces the excises on telecom services, EMT levy on electronic money transfers through the Nigerian Banking System among other taxes.

President Bola Tinubu in July 2023 ordered the suspension of the 5% excise duty on telecommunications and the Import Tax Adjustment levy on certain vehicles.

However, it appears that this suspension may be lifted to meet the program targets for a new, yet-to-be-approved World Bank loan.

Nairametrics has confirmed that negotiations are ongoing between the Federal Government and the World Bank.

The program’s development objective is to strengthen the government’s financial position by enhancing its capacity to manage and mobilize domestic resources effectively, which includes improving tax and customs compliance and protecting oil revenues.

Affected stakeholders and sectors

The planned tax reforms under the ARMOR program are expected to have significant implications across various economic sectors.

According to the plan, affected stakeholders will include manufacturers of goods such as alcoholic beverages, tobacco products, and sugar-sweetened beverages (SSBs), telecom and banking service providers, as well as the general tax-paying public.

Importers and international traders will also feel the impact of these new fiscal policies.

Key industry groups such as the Association of Licensed Telecom Operators of Nigeria (ALTON) are engaged regarding the excise duties on telecom services.

The banking sector, represented by the Committee of Bankers, are engaged regarding the introduction of an Electronic Money Transfer (EMT) levy on transactions processed through Nigerian banks.

Additionally, the Manufacturers Association of Nigeria (MAN) will play a crucial role, particularly for those involved in producing targeted products such as tobacco and alcoholic beverages.

The plan document read:

“Domestic Revenue Mobilisation drive in the government ARMOR program seeks to increase revenue on some targeted industries and sectors of the economy. Specific groups and agencies within affected sectors include

“1. Association of Licensed Telecom Operators of Nigeria: The introduction of excises on telecom services requires that all telcos are mobilised to fully participate in the collection of such revenue.

“2. Committee of Bankers: Introduction of EMT levy on electronic money transfers through the Nigerian Banking System would need the buy-in all banking institutions

“3. Manufacturer’s Association of Nigeria: Manufacturers of tobacco products, sugar sweetened beverages(SSBs) and alcoholic beverages who would be required to collect excises on their products are critical stakeholders for the introduction of the new excise regime. They are currently organised into various sectoral groups under the Manufacturer’s Association of Nigeria (MAN). Producers of alcoholic beverages organised under the Distillers and Blenders Association of Nigeria also need to key into the reforms

“4. Importers: Strategic partners involved in importation of different items into the country will be mobilised to participate in the ARMOR program. A key stakeholder group is the Association of Nigeria Customs Agents (ANCLA).

“5. Vehicle Importers and Manufacturers: Stakeholders in the automobile trade industry must be engaged on reforms involving the introduction of green taxes on high GHG emission vehicles. Local manufacturing and assembly of vehicles is growing through a phase of growth in Nigeria. The demand for vehicles is mostly met through importation by vehicle importers under the aegis of Association of Motor Dealers of Nigeria (AMDON).”

The document also emphasized the importance of engaging vulnerable groups to ensure they are not disproportionately affected by these changes.

It also said:

“Services that will be subjected to the newly introduced excises are regulated by key public sector agencies. The introduction of the new revenue measures will require the application of existing regulatory mechanisms available within these institutions. The concerned institutions include

“1. Nigerian Communication Commission

“2. Central Bank of Nigeria.

“There are also agencies with the mandate for making policies on some of the issues covered in the ARMOR program with respect to policy framework on matters of public interest in Health and Environmental Protection. The government institutions relevant to ARMOR in this regard are.

“1. Federal Ministry of Environment

“2. National Environmental Standards Regulatory and Enforcement Agency (NESREA)

“3. Federal Ministry of Health”


Kindly share this post
Continue Reading

Trending