TECHDIGEST – IT professionals have listed data exfiltration, theft by an external attacker, as one of the top threats that will affect organisations in 2023, according to a new report by Sophos.

The report, titled ‘The State of Cybersecurity 2023: The Business Impact of Adversaries on Defenders’, disclosed that 99 per cent of the IT professionals surveyed stated that they were concerned about affecting their organisations in 2023.

The IT experts singled out data exfiltration and phishing as their major concerns for the year.

It noted, “It’s important to remember that these three threats are often interlinked: a phishing email often starts an attack that results in data exfiltration and ransomware.”

The firm said about 94 per cent of the firm it surveyed experienced some sort of cyberattack in 2022.

READ ALSO: APPLY: NITDA Opens Entries for NSIA Prize for Innovation 

It said, “The concerns of IT professionals closely match the reality of what is happening on the front lines with 94 per cent of organisations experiencing at least one cyberattack in the last year.

“While ransomware was the most reported attack, adversaries execute a wide range of attacks at scale. This breadth and depth of attacks create a considerable and growing challenge for defenders. Behind these numbers is the increasing professionalisation of the cybercriminal economy, including the growth of the ‘as a service’ model, including ‘access-as-a-service’, ‘phishing-as-a-service’, and ‘scamming-as-a-service.’

“This evolution in cybercrime operations has lowered the barriers to entry for would-be cybercriminals.”

While there was observed growth in the sophistication of cybercriminals, surveyed IT professionals revealed that the in-house shortage of cybersecurity skills/expertise will be a major threat in 2023.

The study revealed that most surveyed organisations struggled with the day-to-day delivery of core security operations tasks.

The Field CTO, commercial, Sophos, John Shier, added, “Today’s threats require a timely and coordinated response.

“Unfortunately, too many organisations are stuck in reactive mode. Not only is this having an impact on core business priorities, but it also has a sizeable human toll, with over half of respondents stating that cyberattacks are keeping them up at night. Eliminating the guesswork and applying defensive controls based on actionable intelligence will let IT teams focus on enabling the business instead of trying to douse the eternal flame of active attacks.”

The post ‘Rising data theft worries IT professionals appeared first on Tech Digest News.

TECH DIGEST – National information Technology Development Agency (NITDA) has alerted government agencies, businesses and citizens on new tricks deployed by cybercriminals to harvest their data.

NITDA’s mandate is to create frameworks for the planning, research, development, standardization, application, coordination, monitoring, evaluation and regulation of Information Technology practices in Nigeria.

In a tweet, the Agency explained how cybercriminals use Telegram Bots and Google Forms to automate phishing activities.

It is pronounced ‘fishing’ and that is basically what it means. It is a process where attackers deceitfully coerce or fish out the passwords and financial information from unsuspecting victims.

TechEconomy.ng recalls that during the peak of COVID-19 pandemic, Sophos Security Team exposed such scam used by cybercriminals to lure unsuspecting members of the public using fake United Nations (UN) and World Health Organisation (WHO) emails.

The scam pages look incredibly simple – and probably didn’t take the crooks more than a few minutes to put together – and visually effective.

The fake pages consist of the official, current home page of the World Health Organisation (WHO), with an unassuming popup form on top of it.

Well, NITDA alerted Nigerians on new tricks deployed by the cybercrime syndicates:

“Hackers use legitimate services such as Google Forms and Telegram Bot to obtain user data stolen during phishing attacks.

“Various ready-to-go platforms which are available on the darknet are used to manage the entire process of the phishing attack and keep financial records linked to them”.

The Agency said that such platforms are distributed under the cyber-as-a-service model, which subsequently leads to more groups conducting attacks.

“Cybercriminals mainly resort to free email services to obtain data of victims (all the info harvested on phishing websites is automatically sent) and gain access to the data of linked bank cards.

To stay safe, NITDA advised internet users should be mindful/avoid open-source software application.

The post NITDA Warns: Cybercriminals Use Bots, Forms To Automate Phishing appeared first on Tech Digest News.

TECH DIGEST – A research firm, Sophos, has joined in the call for African mobile money, and internet users generally, to guard their data jealously as fintech growth appears to be astronomical in the continent.

According to Sophos, as data explosion sets to happen in Africa considering the growth in mobile money and other financial services accounts, users in Africa should adopt the method of first considering every mail as a potential threat before opening it.

A report released recently by the company revealed that a new information stealer, Agent Tesla which spreads through malicious email spam is being used to destroy hapless internet users and vulnerable corporate organisations.

Although Sophos says the hacking method is seven-year-old and goes through new phases, it has, however, remained a powerful threat to people. The research firm warned that people should be cautious with email attachments from unknown senders.

According to the company, Agent Tesla steals information from web browsers, email clients, virtual private network clients, and other software that stores usernames and passwords.

It explained that it can capture keystrokes while users are typing, for example entering their password, and record screenshots, so it can see what is on their screen.

It noted that the more recent version of the info-stealer can use the Telegram messaging service to communicate with its operators, as well as a software programme called Tor (that’s very popular on the dark web) to hide activity like the removal of stolen data. It also tries to alter software code to block security protection.

Senior Security Researcher at the company, Sean Gallagher said: “Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users.

“The most widespread delivery method for Agent Tesla is malicious spam attachments. The email accounts used to spread Agent Tesla are often legitimate accounts that have been compromised. Organisations and individuals should, as always, treat email attachments from unknown senders with caution, and verify all attachments before opening them.”

The firm recommended that Information Technology, IT admin checklist for email security should include:

*Installation of an intelligent security solution that can screen, detect and block suspicious emails and their attachments before they reach users.

*Implementing the recognised authentication standards to verify emails are what they claim to be.

*Educating employees to spot the warning signs of suspicious emails and what to do if they encounter one.

*Advising users to double-check that emails come from the address and the person they claim.

*Advising users to never open attachments or click on links in emails from unknown senders.

*Sophos endpoint protection, Intercept X, detects Agent Tesla malware.

Another internet security outfit recently disclosed that out of over one billion mobile money accounts in the global financial technology space, Africa has about 46 per cent of the accounts. The one billion accounts were said to be processing up to $1.9 billion daily, meaning that 46 per cent of that is processed in Africa. The continent is also expected to exceed half a billion accounts before the end of first quarter 2021.

The post CYBER SECURITY: Beware of New Hacking Method, Says Sophos appeared first on Tech Digest News.

TECH DIGEST – Cyber security software company, Sophos, has revealed the pattern cyber attackers will adopt to ravage individuals and corporate organizations 2021.

According to the company, the report provides a three-dimensional perspective which includes the gap between ransomware operators at different ends of the skills and resource spectrum will increase.

It said: “At the high end, the big-game hunting ransomware families will continue to refine and change their tactics, techniques and procedures (TTPs) to become more evasive and nation-state-like in sophistication, targeting larger organizations with multimillion-dollar ransom demands. In 2020, such families included Ryuk and RagnarLocker.”

At the other end of the spectrum, Sophos anticipates an increase in the number of entry level, apprentice-type attackers looking for menu-driven, ransomware-for-rent, such as Dharma that allows them to target high volumes of smaller prey.

Another ransomware trend is “secondary extortion,” where alongside the data encryption the attackers steal and threaten to publish sensitive or confidential information, if their demands are not met. In 2020, Sophos reported on Maze, RagnarLocker, Netwalker, REvil, and others using this approach.

“The ransomware business model is dynamic and complex. During 2020, Sophos saw a clear trend towards adversaries differentiating themselves in terms of their skills and targets.

Principal research scientist of the company, Chester Wisniewski, said: “We have also seen ransomware families sharing best-of-breed tools and forming self-styled collaborative ‘cartels,’.

“Some, like Maze, appeared to pack their bags and head for a life of leisure, except that some of their tools and techniques have resurfaced under the guise of a newcomer, Egregor.’’

“The cyber threat landscape abhors a vacuum. If one threat disappears another one will quickly take its place. In many ways, it is almost impossible to predict where ransomware will go next, but the attack trends discussed in Sophos’ threat report this year are likely to continue into 2021.”

In another dimension, the company said that everyday threats such as commodity malware, including loaders and botnets, or human-operated Initial Access Brokers, will demand serious security attention.

It said: “Such threats can seem like low-level malware noise, but they are designed to secure a foothold in a target, gather essential data and share data back to a command-and-control network that will provide further instructions.

If human operators are behind these types of threats, they’ll review every compromised machine for its geolocation and other signs of high value, and then sell access to the most lucrative targets to the highest bidder, such as a major ransomware operation. For instance, in 2020, Ryuk used Buer Loader to deliver its ransomware.’’

Also, it noted that in the last dimension, “All ranks of adversaries will increasingly abuse legitimate tools, well-known utilities and common network destinations to evade detection and security measures and thwart analysis and attribution.’’

The abuse of legitimate tools enables adversaries to stay under the radar while they move around the network until they are ready to launch the main part of the attack, such as ransomware. For nation-state-sponsored attackers, there is the additional benefit that using common tools makes attribution harder.

The post Cyber Security Group Reveals Cyber Threat Patterns for 2021 appeared first on Tech Digest News.

TECH  DIGEST – A new survey by Sophos, a global leader in next-generation cybersecurity, has revealed that organizations are never the same after being hit by ransomware, adding that the confidence of IT managers and their approach to battling cyberattacks differ significantly depending on whether or not their organization has been attacked by ransomware.

The global survey titled “Cybersecurity: The Human Challenge”, also noted that outsourcing IT security is already the norm, with 65 percent doing it in some capacity: 43percent use a combination of in-house and outsourcing while 22percent wholly outsource their IT security.

Meanwhile, the survey revealed regional variations. Top of the outsourcing list are China (76%), the UAE (74%), and Malaysia and Singapore (both 73%) where around three quarters of respondents already include outsourcing in their IT security delivery.

However, at the other end of the scale, in Belgium (52%), France (54%) and Nigeria (54%) just over half of respondents are currently using third party security providers.

The global trend is for outsourcing to increase over the next two years, from the current 65% to almost three quarters (72%) in 2022.

The biggest change will be in the percentage of organizations that exclusively use in-house staffing: this is set to drop from 34% to 26%. There will be increases both in the percentage that fully outsource their IT security and in those that use a combination of in-house and outsourced expertise.

Flip back to part on ransomware, the report shows that IT managers at organizations hit by ransomware are nearly three times as likely to feel “significantly behind” when it comes to understanding cyberthreats, compared to their peers in organizations that were unaffected (17% versus 6%).

More than one third (35%) of ransomware victims said that recruiting and retaining skilled IT security professionals was their single biggest challenge when it comes to cybersecurity, compared with just 19% of those who hadn’t been hit.

When it comes to security focus, the survey found that ransomware victims spend proportionally less time on threat prevention (42.6%) and more time on response (27%) compared to those who haven’t been hit (49% and 22% respectively), diverting resources towards dealing with incidents rather than stopping them in the first place.

“The difference in resource priorities could indicate that ransomware victims have more incidents to deal with overall. However, it could equally indicate that they are more alert to the complex, multi-stage nature of advanced attacks and therefore put greater resource into detecting and responding to the tell-tale signs that an attack is imminent,” said Chester Wisniewski, principal research scientist at Sophos.

The fact that ransomware attackers continue to evolve their tactics, techniques and procedures (TTPs) contributes to pressure on IT security teams, as evidenced by SophosLabs Uncut’s article, “Inside a New Ryuk Ransomware Attack”. The article deconstructs a recent attack involving Ryuk ransomware. Sophos incident responders found that the Ryuk attackers used updated versions of widely available and legitimate tools to compromise a targeted network and deploy ransomware. Unusually, the attack progressed at great speed – within three and a half hours of an employee opening a malicious phishing email attachment, the attackers were already actively conducting network reconnaissance. Within 24 hours, the attackers had access to a domain controller and were preparing to launch Ryuk.

“Our investigation of the recent Ryuk ransomware attack highlights what defenders are up against. IT security teams need to be on full alert 24 hours a day, seven days a week and have a full grasp of the latest threat intelligence on attacker tools and behaviors. The survey findings illustrate clearly the impact of these near-impossible demands. Among other things, those hit by ransomware were found to have severely undermined confidence in their own cyberthreat awareness. However, their ransomware experiences also appear to have given them a greater appreciation of the importance of skilled cybersecurity professionals, as well as a sense of urgency about introducing human-led threat hunting to better understand and identify the latest attacker behavior,” said Wisniewski. “Whatever the reasons, it is clear that when it comes to security, an organization is never the same again after being hit by ransomware.”

The full report, “Inside a New Ryuk Ransomware Attack”, is available on SophosLabs Uncut, where Sophos researchers regularly publish their latest research and breakthrough findings, such as Maze leveraging Ragnar Locker. Threat researchers can follow SophosLabs Uncut in real time on Twitter at @SophosLabs.

The post New Survey Shows Organizations Are Never The Same After Being Hit By Ransomware- Sophos appeared first on Tech Digest News.