Tag: cyber

Cyber criminals are on the prowl as they are increasingly targeting Nigerian businesses with a total of 586,130 threats detected during the first half of this year, according to data compiled by a cyber-security firm, Cybervergent.

The data which was gathered by the firm’s
security
operations
centre (SOC) showed that
of the total 586,130 total threats
detected during the period, 19,920 endpoints
were protected while a total of 116,580 detection
analytics
were applied.

A total of 42,200 potentially
malicious
events were analysed while 226,103 events were resolved
by
automation; 13,305 false
positives
were identified by the platform and
pared
down while 304,522 events
were analysed
by
SOC
 analysts.

“Our
security
operations
centre
is
like
a
personal
trainer
for
your
digital
fitness.
We’ve
been
closely
monitoring

cyber
health
by
analysing
the
sweat
and
grime or
rather, the
alerts,
events,
and
threat
indicators—from
hundreds
of
clients.
Think
of
these
clients
as
gym
members
with
diverse
fitness
goals.

“By
studying
their
workout
routines
(IT
environments)
and
injury
reports
(securityincidents),
we’ve
identified
the
most
common
workout
mistakes
(cyber
threats)
and
developed
a
personalised
training
plan
(security
recommendations)
to
help
achieve
fitness
goals
(a
secure
organisation),” Chief Solutions Officer at Cybervergent, Gbolabo Awelewa, said.
He said the country’s digital
landscape
is
exploding
like
a
pre‑workout
protein
shake.
“It’s
energetic, it’s
powerful, but
it
also
requires
the
right
supplements
to
avoid crashes.
In
this
high‑octane
environment, cyber
threats
lurk
like
shadow
boxers, waiting
to
land
a
knockout
blow
on
your
data
and
operations.

“This
report
is
your
ultimate
cyber‑defense
performance
enhancer.
Below we will identify the most aggressive
threat
actors
that
targeted
Nigeria
in
first half
2024, providing
battle‑tested
strategies
to
build
your
cyber
resilience
like
iron.
Forget
genericgym
routines
–
we’re
talking
advanced
techniques, threat intelligence on
steroids,
and
the
agility
of
a
seasoned
Muay
Thai
fighter,” Awelewa said.

He identified the attackers to include Gelsemium which he said is a sophisticated cyber espionage group known for its targeted attacks on high‑profile organisations across various sectors.

The group has been active since at least 2014 and is known for its stealthy and persistent attack methods.

They
use
custom
malware
and
advanced
techniques to
evade
detection targeting public
administration, educational
services, national
security
and international
affairs, arts, entertainment
and
recreation.
Its associated malware/software include Cobalt
Strike, Win.owlproxy, Gelsemium, STA‑0046 and Session Manager
IIS.
Another one is Equation
Group
which
is
a
highly
sophisticated
cyber‑ attack
group
believed
to
be
tied
to
the
U.S.
National
Security
Agency.

They
are
known
for
their
advanced
hacking
techniques
and
long‑term
persistent
attacks.


Read Also: Barau distributes PG admission letters to 70 AI, Robotics, Cybersecurity students

The
group
has
been
active
since
at
least
2001
and
has
targeted
numerous high‑profile
individuals
and
organisations.
Targeted sectors include public
administration, educational
services, mining, quarrying, oil
and
gas, extraction and the telecommunications sector. Lyceum, also
known
as
Hexane, is
a
cyber-espionage
group
primarily
targeting
the energy
and
telecommunications
sectors
in
the
Middle
East
and
Africa.

They
employ
a
mix
of
spear‑phishing, social
engineering,
and
custom‑built
malware
to infiltrate
systems
and
exfiltrate
sensitive
data.

Their
tactics
include
the
use
of
backdoors
and
PowerShell
scripts
to
maintain
persistent
access, often
exploiting
vulnerabilities
in
remote
access
services
to gain
initial
entry.
Telecommunications, agriculture, forestry, ,fishing
and
hunting computer
and
 electronic
products, manufacturing, commercial
banking, finance
and
insurance professional,
scientific,
and
technical
services. Others are health
care
and
social
 assistance.
Another one, Gamaredon which is a
cyber-espionage
group
linked
to
 Russian
intelligence, has
relentlessly
targeted
Ukrainian
entities
since
2013.

Employing
a mix of phishing, malware, and
social engineering, they
focus on government
and
critical
infrastructure.

Their toolkit includes custom‑built malware and the exploitation of
remote access services to maintain persistent access and
exfiltrate
sensitive
data.

Public
administration, national
security
and
international
affairs are their focal points.

Another is the Circus
Spider, a cybercrime group specializing in
ransomware attacks against large enterprises.

Operating as a Ransomware‑as‑a‑Service (RaaS) since
at
least
2020, they
employ
a versatile
toolkit
including
phishing,
brute
force,
and
custom
ransomware.
Initial access is often gained through exploited RDP vulnerabilities. The group’s rapid adaptation to
new
tactics
poses
a
significant
threat
to
businesses worldwide.
The group focuses its targets on utilities, manufacturing, transportation, warehousing, educational services, healthcare and social assistance and public administration.
Mirage
a
suspected
Chinese
state‑sponsored
group, specializes in cyber espionage targeting
aerospace
and
defense
sectors.

Known
for
advanced
persistent
threat (APT) operations,
they
employ
custom
malware, spear‑phishing,
and
compromised
websites
to
infiltrate
their
targets
and steal
sensitive
information.
Targeted sectors include air
transportation, manufacturing, public
administration, space research and technology, utilities, chemical, manufacturing, (chemical & pharmaceutical manufacturing).
Common
Raven
is
a
persistent
threat
actor
targeting
government
and
financial sectors.
Operating
since
2018, they specialize
in covert
operations using
advanced malware and spear‑phishing
tactics.

Their ability to maintain long‑term access and
exploit zero‑day
vulnerabilities
underscores
their sophistication.

Their focus of attack includes other services (except public
administration) and telecommunications.

The last is the Earth
Krahang
which is
a
cyber- threat
group
originating
 from Southeast
Asia, targeting
organizations across the Asia‑Pacific
region
since 2018.


Known
for
advanced
phishing
campaigns
and
exploitation
of
vulnerabilities, they’ve been implicated in numerous data breaches and espionage
operations.


Their
expertise
in
social
engineering
and
custom
malware
development
enable persistent
access
to
compromised networks.
This group of attackers focuses on manufacturing, public
administration, educational services, national security and international affairs, telecommunication, retail trade, finance and insurance, health
care
and
social
assistance.