Connect with us

News

Zero-day in Microsoft Windows Used in Nokoyawa Ransomware Attacks

Published

on

Kindly share this post

In February, Kaspersky experts discovered an attack using zero-day vulnerability in the Microsoft Common Log File System (CLFS). A cybercriminal group used an exploit developed for different versions and builds of Windows OS including Windows 11 and attempted to deploy Nokoyawa ransomware.

Microsoft assigned CVE-2023-28252 to this vulnerability and patched it on April 11th. The threat actor also attempted to execute similar elevation of privilege exploits in attacks on different small and medium-sized businesses in the Middle East and North America, and previously in Asia regions.

While most of the vulnerabilities discovered by Kaspersky are used by APTs, this one turned out to be exploited for cybercrime purposes by a sophisticated group that carries out ransomware attacks.

This group stands out by the usage of similar but unique Common Log File System (CLFS) exploits.  Kaspersky has seen at least five different exploits of this kind. They were used in attacks on retail and wholesale, energy, manufacturing, healthcare, software development and other industries.

Microsoft assigned CVE-2023-28252 to the discovered zero-day. This is the Common Log File System elevation of privilege vulnerability which gets triggered by the manipulation of file format used by this subsystem.

Kaspersky researchers uncovered the vulnerability in February as a result of additional checks into a number of attempts to execute similar elevation of privilege exploits on Microsoft Windows servers belonging to different small and medium-sized businesses in the Middle Eastern and North American regions.

CVE-2023-28252 was first spotted by Kaspersky in an attack where cybercriminals attempted to deploy a newer version of Nokoyawa ransomware. Older variants of this ransomware were just “rebranded” variants of JSWorm ransomware, but in the aforementioned attack the Nokoyawa variant was quite distinct from JSWorm in terms of a codebase.

The exploit used in the attack was developed to support different versions and builds of Windows OS including Windows 11. Attackers used CVE-2023-28252 vulnerability to elevate privileges and steal credentials from the Security Account Manager (SAM) database.

“Cybercrime groups are becoming increasingly more sophisticated using zero-day exploits in their attacks. Previously it was primarily a tool of Advanced Persistent Threat actors (APTs), but now cybercriminals have the resources to acquire zero-days and routinely use them in attacks.

There are also exploit developers willing to help them and develop exploit after exploit. It’s very important for businesses to download the latest patch from Microsoft as soon as possible, and use other methods of protection, such as EDR solutions,” said Boris Larin, Lead Security Researcher with the Global Research and Analysis Team (GReAT) at Kaspersky.

 


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

News

Police Suspends eMotor Registry Enforcement Following Outcries

Published

on

Kindly share this post

Kayode Egbetokun, inspector general of police, has announced the suspension of the the enforcement of electronic central motor registry registration otherwise e-CMR for vehicle owners in the country.

Police Suspends eMotor Registry Enforcement Following Outcries

Muyiwa Adejobi, force spokesperson, had on Saturday said the IG ordered that the enforcement of the e-CMR should commence on July 29.

The enforcement order sparked an outcry from Nigerians, who accused the police of creating an opportunity to extort vehicle owners.

John Aikpokpo-Martins, chairman of the Nigerian Bar Association (NBA) Section on Public Interest and Development Law, said the directive by Egbetokun to begin enforcing the digitised Central Motor Registry was a blatant disregard for the rule of law.

But in a statement on Sunday, Adejobi announced that the IG has suspended the enforcement of the e-CMR.

He added that there was the need to sensitise the citizens on the initiative, which he said was designed to secure vehicles.

He said, “Following the reconfiguration and commencement of the electronic central motor registry registration process the Police have deemed it necessary to highlight the benefits and effectiveness of the e-CMR initiative which is designed to ensure the safety and security of all types of vehicles including motorcycles by collating data imputed into the system by vehicle owners and acting on such to flag the vehicles if reported stolen.

“The e-CMR will provide a firsthand database to the Force for curbing vehicular crimes as dedicated officers can access real-time comprehensive data of every vehicle on their tablets.

“Similarly, the e-CMR will prevent multiple registrations of vehicles and serve as a database to collate biometric and other data of vehicle owners and individuals, adding value to the national database and incident report portal generated from other Ministries, Departments and Agencies towards general security.”

Adejobi denied that the e-CMR was a revenue-generating platform.

He said, “Furthermore, contrary to news making the rounds and insinuations about the e-CMR, the NPF wishes to state categorically that the e-CMR is not a revenue-generating platform but an initiative to digitalize policing for effectiveness and general safety of lives and property of Nigeria residents. “

Adejobi said the IG ordered the immediate suspension he had earlier given.

He stated, “The Inspector-General of Police, IGP Kayode Egbetokun has ordered an immediate suspension of the proposed enforcement of the e-CMR initially scheduled to commence on the 29th of July, 2024. This is to give ample opportunity for mass enlightenment and education of all citizens and residents on the process, benefits and effectiveness in solving the challenge of vehicle-related crimes, and protection of individual and corporate vehicle ownership.”

Adejobi sought the understanding of the citizens and key into the initiative.


Kindly share this post
Continue Reading

News

Osagie Okunbor, Shell Nigeria MD Honoured for Exemplary Leadership

Published

on

Kindly share this post

Osagie Okunbor, managing director, Shell Petroleum Development Company of Nigeria Limited, and country chair, Shell Companies in Nigeria, has been recognised for his “Invaluable contributions to the  Nigerian energy sector and his service to humanity.”

Osagie Okunbor, Shell Nigeria MD Honoured for Exemplary Leadership

Former Deputy Governor, Central Bank of Nigeria, and Director, Heritage for Life Foundation, Tunde Lemo (left), presenting the Foundation’s  Award for Exemplary Leadership and Service to Humanity to the Managing Director, Shell Petroleum Development Company and Country Chair, Shell Companies in Nigeria, Osagie Okunbor, at a ceremony in Lagos on Thursday.

Osagie received the Award for Exemplary Leadership and Service to Humanity from a Lagos-based NGO, Heritage for Life Foundation, at a ceremony held in Lagos.

Tunde Lemo, director of the Foundation, and former deputy governor, Central Bank of Nigeria (CBN), handed out the award which he said was instituted to promote “moral qualities and attitudes pivotal to the growth of a stable and functional society” by recognising individuals who exbibit the virtues.

An elated Okunbor said: “I’m pleased at this recognition which calls for greater commitment to the highest standards of leadership and service to humanity. With the support of my colleagues and other stakeholders, I hope to continue to  contribute to the development of our country.”

The award from the foundation was the second bestowed on the longest serving Country Chair of Shell companies in Nigeria in the past month.

At the 60th anniversary of the Nigerian Institute of Public Relations (NIPR), Okunbor was conferred with the Diamond Ambassador of Brand Nigeria as part of NIPR’s Diamond Jubilee National Awards.

Presenting the award, Dr. Ike Neliaku, president and chairman of Council, NIPR noted that Okunbor earned the award having demonstrated exceptional leadership as Chairman of the largest energy company in Nigeria that had made significant contributions to the socio-economic development of Nigeria in more than seven decades.

Okunbor’s contributions to the energy sector are the highlights of a career in Shell which has seen him serve in Nigeria, the UK, Brunei and the Netherlands before his appointment as Managing Director, SPDC and Country Chair in 2015.

In May, the executive council of the Nigerian Gas Association recognised Okunbor for “outstanding contributions towards the advancement of Nigeria’s gas sector.”

 

 

 

 

 


Kindly share this post
Continue Reading

News

NNPC Cuts Investment In Dangote Refinery From 20 Percent to 7.2 Percent 

Published

on

Kindly share this post

Nigerian National Petroleum Company (NNPC) Limited has reduced its investment in the Dangote Refinery from 20 per cent to 7.2 per cent, according to Aliko Dangote, chief executive officer, Dangote Refinery.

NNPC Cuts Investment In Dangote Refinery From 20 Percent to 7.2 Percent 

Aliko Dangote

Dangote, who made this known in Lagos on Sunday and the NNPC confirmed the development, saying it assessed its investment portfolio to align with its goals.

“NNPC no longer owns a 20 per cent stake in the Dangote refinery. They were met to pay their balance in June, but have yet to fulfil the obligations. Now, they only own a 7.2% stake in the refinery,” Dangote said.

In September 2021, NNPC had acquired a 20 per cent stake in the Dangote Refinery for $2.76 billion.

NNPC had initially financed the 20 per cent stake through a $1.036 billion funding from Lekki Refinery Funding Limited, of which $1 billion was paid to Dangote Refinery and $36 million was for transaction costs.

The remaining $1.76 billion was to be paid through a combination of a $2.5/barrel discount on 300,000 barrels per day of crude oil supplied to the refinery, and 100 per cent of NNPC’s portion of any dividends declared by the refinery.

Reacting to the statement by Dangote, the NNPC in a press release on Sunday evening, said the company “made a commercial decision to cap our investment at the amount already paid.”

“Several months ago, we made a commercial decision to cap our investment at the amount already paid. This decision was taken by NNPC Ltd and has no impact on our business.

“NNPC Limited periodically assesses its investment portfolio to ensure alignment with the company’s strategic goals.

“The decision to cap its equity participation at the paid-up sum was made and communicated to Dangote Refinery several months ago,” Olufemi Soneye, spokesman, NNPC, said in a statement on Sunday evening.

 

 

 

 

 

 

 


Kindly share this post
Continue Reading

Trending