The international policing agency’s Africa Cyberthreat report highlights a sharp rise in ransomware and extortion campaigns across the continent, with Nigeria accounting for a significant share of reported incidents.

The report attributes the increase to the rapid expansion of digital services and remote work, combined with inadequate cyber defences among businesses and public institutions. Small and medium-sized enterprises (SMEs) have been identified as especially vulnerable due to limited technical capacity and a lack of incident response plans.

Cybersecurity experts have described the trend as an urgent wake-up call for both the government and private sector. Many have renewed calls for updated cybercrime legislation, mandatory breach reporting, and stronger coordination between law enforcement and the tech industry.

The post Nigeria Ranks Third in Africa for Ransomware Attacks — INTERPOL appeared first on Tech Digest News.

TECHDIGEST – The Nigerian Communications Commission (NCC) has alerted the country’s telecommunications community about the activities of cybercriminals who have perfected a New year scheme to deliver ransomware to targeted organizational networks.

The new ransomware uncovered by security experts has been categorised, by the Nigerian Computer Emergency Response Team’s (ngCERT) advisory released over the weekend, as high-risk and critical.

According to the ngCERT advisory contained in a statement issued on Saturday, January 15, 2022, Dr. Ikechukwu Adinde, director, Public Affairs at NCC, the criminal group is said to have been mailing out (BadUSB) USB thumb drives to many organisations in the hope that recipients will plug them into their PCs and install the ransomware on their networks.

While businesses are being targeted, criminals could soon begin sending infected USB drives to individuals.

Describing how the cybercrime group runs the ransomeware, the ngCERT advisory says the USB drives contain so-called ‘BadUSB’ attacks.

The BadUSB exploits the USB standards versatility and allows an attacker to reprogram a USB drive to emulate a keyboard to create keystrokes and commands on a computer. It then installs malware prior to the operating system booting, or spoofs a network card to redirect traffic.

Numerous attack tools are also installed in the process that allows for exploitation of personal computers (PCs), lateral movement across a network, and installation of additional malware. The tools were used to deploy multiple ransomware strains, including BlackBatter and REvil.

According to ngCERT, the attack has been seen in the US where the USB drives were sent in the mail through the Postal Service and Parcel Service.

One type contained a message impersonating the US Department of Health and Human Services and claimed to be a COVID-19 warning. Other malicious USBs were sent in the post with a gift card claiming to be from Amazon.

However, ngCERT has offered recommendations that will enable corporate and individual networks to mitigate the impact of this new cyber-attack and be protected from the ransomware.

These recommendations include a call on individuals and organisations not to insert USB drives from unknown sources, even if they’re addressed to you or your organization.

In addition, if the USB drive comes from a company or a person one is not familiar with and trusts, it is recommended that one contacts the source to confirm they actually sent the USB drive.

Finally, ngCERT has advised Information and Communication Technology as well as other Internet users to report any incident of system compromises to ngCERT via incident@cert.gov.ng, for technical assistance.

The post NCC alerts telcos, subscribers on planned ‘BadUSB’ ransomware appeared first on Tech Digest News.

TECH DIGEST – Cyber security software company, Sophos, has revealed the pattern cyber attackers will adopt to ravage individuals and corporate organizations 2021.

According to the company, the report provides a three-dimensional perspective which includes the gap between ransomware operators at different ends of the skills and resource spectrum will increase.

It said: “At the high end, the big-game hunting ransomware families will continue to refine and change their tactics, techniques and procedures (TTPs) to become more evasive and nation-state-like in sophistication, targeting larger organizations with multimillion-dollar ransom demands. In 2020, such families included Ryuk and RagnarLocker.”

At the other end of the spectrum, Sophos anticipates an increase in the number of entry level, apprentice-type attackers looking for menu-driven, ransomware-for-rent, such as Dharma that allows them to target high volumes of smaller prey.

Another ransomware trend is “secondary extortion,” where alongside the data encryption the attackers steal and threaten to publish sensitive or confidential information, if their demands are not met. In 2020, Sophos reported on Maze, RagnarLocker, Netwalker, REvil, and others using this approach.

“The ransomware business model is dynamic and complex. During 2020, Sophos saw a clear trend towards adversaries differentiating themselves in terms of their skills and targets.

Principal research scientist of the company, Chester Wisniewski, said: “We have also seen ransomware families sharing best-of-breed tools and forming self-styled collaborative ‘cartels,’.

“Some, like Maze, appeared to pack their bags and head for a life of leisure, except that some of their tools and techniques have resurfaced under the guise of a newcomer, Egregor.’’

“The cyber threat landscape abhors a vacuum. If one threat disappears another one will quickly take its place. In many ways, it is almost impossible to predict where ransomware will go next, but the attack trends discussed in Sophos’ threat report this year are likely to continue into 2021.”

In another dimension, the company said that everyday threats such as commodity malware, including loaders and botnets, or human-operated Initial Access Brokers, will demand serious security attention.

It said: “Such threats can seem like low-level malware noise, but they are designed to secure a foothold in a target, gather essential data and share data back to a command-and-control network that will provide further instructions.

If human operators are behind these types of threats, they’ll review every compromised machine for its geolocation and other signs of high value, and then sell access to the most lucrative targets to the highest bidder, such as a major ransomware operation. For instance, in 2020, Ryuk used Buer Loader to deliver its ransomware.’’

Also, it noted that in the last dimension, “All ranks of adversaries will increasingly abuse legitimate tools, well-known utilities and common network destinations to evade detection and security measures and thwart analysis and attribution.’’

The abuse of legitimate tools enables adversaries to stay under the radar while they move around the network until they are ready to launch the main part of the attack, such as ransomware. For nation-state-sponsored attackers, there is the additional benefit that using common tools makes attribution harder.

The post Cyber Security Group Reveals Cyber Threat Patterns for 2021 appeared first on Tech Digest News.

TECH  DIGEST – A new survey by Sophos, a global leader in next-generation cybersecurity, has revealed that organizations are never the same after being hit by ransomware, adding that the confidence of IT managers and their approach to battling cyberattacks differ significantly depending on whether or not their organization has been attacked by ransomware.

The global survey titled “Cybersecurity: The Human Challenge”, also noted that outsourcing IT security is already the norm, with 65 percent doing it in some capacity: 43percent use a combination of in-house and outsourcing while 22percent wholly outsource their IT security.

Meanwhile, the survey revealed regional variations. Top of the outsourcing list are China (76%), the UAE (74%), and Malaysia and Singapore (both 73%) where around three quarters of respondents already include outsourcing in their IT security delivery.

However, at the other end of the scale, in Belgium (52%), France (54%) and Nigeria (54%) just over half of respondents are currently using third party security providers.

The global trend is for outsourcing to increase over the next two years, from the current 65% to almost three quarters (72%) in 2022.

The biggest change will be in the percentage of organizations that exclusively use in-house staffing: this is set to drop from 34% to 26%. There will be increases both in the percentage that fully outsource their IT security and in those that use a combination of in-house and outsourced expertise.

Flip back to part on ransomware, the report shows that IT managers at organizations hit by ransomware are nearly three times as likely to feel “significantly behind” when it comes to understanding cyberthreats, compared to their peers in organizations that were unaffected (17% versus 6%).

More than one third (35%) of ransomware victims said that recruiting and retaining skilled IT security professionals was their single biggest challenge when it comes to cybersecurity, compared with just 19% of those who hadn’t been hit.

When it comes to security focus, the survey found that ransomware victims spend proportionally less time on threat prevention (42.6%) and more time on response (27%) compared to those who haven’t been hit (49% and 22% respectively), diverting resources towards dealing with incidents rather than stopping them in the first place.

“The difference in resource priorities could indicate that ransomware victims have more incidents to deal with overall. However, it could equally indicate that they are more alert to the complex, multi-stage nature of advanced attacks and therefore put greater resource into detecting and responding to the tell-tale signs that an attack is imminent,” said Chester Wisniewski, principal research scientist at Sophos.

The fact that ransomware attackers continue to evolve their tactics, techniques and procedures (TTPs) contributes to pressure on IT security teams, as evidenced by SophosLabs Uncut’s article, “Inside a New Ryuk Ransomware Attack”. The article deconstructs a recent attack involving Ryuk ransomware. Sophos incident responders found that the Ryuk attackers used updated versions of widely available and legitimate tools to compromise a targeted network and deploy ransomware. Unusually, the attack progressed at great speed – within three and a half hours of an employee opening a malicious phishing email attachment, the attackers were already actively conducting network reconnaissance. Within 24 hours, the attackers had access to a domain controller and were preparing to launch Ryuk.

“Our investigation of the recent Ryuk ransomware attack highlights what defenders are up against. IT security teams need to be on full alert 24 hours a day, seven days a week and have a full grasp of the latest threat intelligence on attacker tools and behaviors. The survey findings illustrate clearly the impact of these near-impossible demands. Among other things, those hit by ransomware were found to have severely undermined confidence in their own cyberthreat awareness. However, their ransomware experiences also appear to have given them a greater appreciation of the importance of skilled cybersecurity professionals, as well as a sense of urgency about introducing human-led threat hunting to better understand and identify the latest attacker behavior,” said Wisniewski. “Whatever the reasons, it is clear that when it comes to security, an organization is never the same again after being hit by ransomware.”

The full report, “Inside a New Ryuk Ransomware Attack”, is available on SophosLabs Uncut, where Sophos researchers regularly publish their latest research and breakthrough findings, such as Maze leveraging Ragnar Locker. Threat researchers can follow SophosLabs Uncut in real time on Twitter at @SophosLabs.

The post New Survey Shows Organizations Are Never The Same After Being Hit By Ransomware- Sophos appeared first on Tech Digest News.