Connect with us

GRTech

Cybercriminals Disabled or Wiped Out Logs in 82% of Ransomware Attacks with Missing Telemetry in Cases Analyzed – Sophos Finds

“Fast” Ransomware Attacks Hinder Fast Defender Response, says Sophos in thie report by SANDRA ANI

Published

on

Sophos’ Annual State of Ransomware

38% of “Fast” Ransomware Attacks in Report Occurred within 5 Days of Initial Access

Sophos, a global leader in innovating and delivering cybersecurity as a service, has released its Active Adversary Report for Security Practitioners, which found that telemetry logs were missing in nearly 42% of the attack cases studied. In 82% of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks.

The report covers Incident Response (IR) cases that Sophos analyzed from January 2022 through the first half of 2023.

Gaps in telemetry decrease much-needed visibility into organizations’ networks and systems, especially since attacker dwell time (the time from initial access to detection) continues to decline, shortening the time defenders have to effectively respond to an incident.

“Time is critical when responding to an active threat; the time between spotting the initial access event and full threat mitigation should be as short as possible. The farther along in the attack chain an attacker makes it, the bigger the headache for responders. Missing telemetry only adds time to remediations that most organizations can’t afford. This is why complete and accurate logging is essential, but we’re seeing that, all too frequently, organizations don’t have the data they need,” said John Shier, field CTO, Sophos.

In the report, Sophos classifies ransomware attacks with a dwell time of less than or equal to five days as “fast attacks,” which accounted for 38% of the cases studied. “Slow” ransomware attacks are those with a dwell time greater than five days, which accounted for 62% of the cases.

When examining these “fast” and “slow” ransomware attacks at a granular level, there was not much variation in the tools, techniques, and living-off-the-land binaries (LOLBins) that attackers deployed, suggesting defenders don’t need to reinvent their defensive strategies as dwell time shrinks. However, defenders do need to be aware that fast attacks and the lack of telemetry can hinder fast response times, leading to more destruction.

“Cybercriminals only innovate when they must, and only to the extent that it gets them to their target. Attackers aren’t going to change what’s working, even if they’re moving faster from access to detection. This is good news for organizations because they don’t have to radically change their defensive strategy as attackers speed up their timelines. The same defenses that detect fast attacks will apply to all attacks, regardless of speed. This includes complete telemetry, robust protections across everything, and ubiquitous monitoring,” said Shier. “The key is increasing friction whenever possible—if you make the attackers’ job harder, then you can add valuable time to respond, stretching out each stage of an attack.

“For example, in the case of a ransomware attack, if you have more friction, then you can delay the time until exfiltration; exfiltration often occurs just before detection and is often the costliest part of the attack. We saw this happen in two incidents of Cuba ransomware. One company (Company A) had continuous monitoring in place with MDR, so we were able to spot the malicious activity and halt the attack within hours to prevent any data from being stolen. Another company (Company B) didn’t have this friction; they didn’t spot the attack until a few weeks after initial access and after Cuba had already successfully exfiltrated 75 gigabytes of sensitive data. They then called in our IR team, and a month later, they were still trying to get back to business as usual.”

The Sophos Active Adversary Report for Security Practitioners is based on 232 Sophos Incident response (IR) cases across 25 sectors from Jan. 1, 2022, to June 30, 2023. Targeted organizations were located in 34 different countries across six continents. Eighty-three percent of cases came from organizations with fewer than 1,000 employees.

The Sophos Active Adversary Report for Security Practitioners provides actionable intelligence on how security practitioners should best shape their defensive strategy.

To learn more about attacker behaviors, tools and techniques, read the Active Adversary Report for Security Practitioners on Sophos.com.

GrassRoots.ng is on a critical mission; to objectively and honestly represent the voice of ‘grassrooters’ in International, Federal, State and Local Government fora; heralding the achievements of political and other leaders and investors alike, without discrimination. This daily, digital news publication platform serves as the leading source of up-to-date information on how people and events reflect on the global community. The pragmatic articles reflect on the life of the community people, covering news/current affairs, business, technology, culture and fashion, entertainment, sports, State, National and International issues that directly impact the locals.

GRTech

Samsung Expands Accessibility with Local Language Integration on Galaxy S25, A56, A36, and A26 Devices

By SANDRA ANI

Published

on

Samsung local Language integration launch
L-R: Stephen Okwara, Head, Product Management, Mobile Experience, Samsung Electronics West Africa; Joy Tim-Ayoola, Group Head, Mobile Experience, Samsung Electronics West Africa; Tae Sun Lee, Samsung Electronics West Africa CEO; Oge Maduagwu, Head of Marketing Samsung Electronics West Africa, and Nathan Lee, Regional Business Lead, Mobile Experience, Samsung Electronics West Africa, at the launch of Nigeria local language integration on Galaxy S25, A56, A36, and A26 devices, on April 03, 2025.

Samsung Electronics has taken a bold step in enhancing user experience and inclusivity by introducing Hausa, Igbo, and Yoruba as official language options on selected Samsung Galaxy devices.

The feature, which is now available on the Galaxy S25, A56, A36, and A26 devices, reaffirms Samsung’s commitment to delivering innovative technology that speaks the language of its users.

With this groundbreaking update, Samsung users across Nigeria can now navigate their smartphones in their preferred local language, making technology more accessible, while also upholding our cultural heritage.

A Celebration of Culture and Technology

To mark the launch, Samsung hosted a cultural-themed press briefing featuring traditional music, local cuisine, and a showcase of the new language feature. Employees and guests attended in traditional Yoruba, Igbo, and Hausa attires, celebrating Nigeria’s rich cultural diversity.

Samsung also announced plans to expand local language support to more devices in the near future, reinforcing its dedication to making technology more inclusive for African users.

Empowering Users Through Language

The integration of Hausa, Igbo and Yoruba on Samsung devices reflects the brand’s mission to bridge the digital gap and enhance user engagement. Speaking at the press conference, Oge Maduagwu, Head of Marketing, Samsung Electronics West Africa, said, “At Samsung, we understand that technology is most powerful when it is accessible to all. By incorporating our local Nigerian languages, we are making our devices more intuitive and relatable, ensuring that millions of Nigerians can interact with their smartphones in the language they love and understand best”.

Seamless Language Transition on Galaxy Devices

Stephen Okwara, Head of Product Management, Samsung Electronics West Africa added, “The new local language feature is designed to deliver a seamless user experience, allowing customers to easily switch between languages. Users can activate Hausa, Igbo, or Yoruba on the Galaxy S25, A26, A36, and A56 by navigating to:

Settings > Language & Input > Select Language

“This update enhances smartphone usability, particularly for those who prefer their native language over English, ensuring greater digital inclusivity, enhancing digital literacy and encouraging more users to engage with technology in their native tongues”, he concluded.

Availability

Customers can visit all Samsung Experience Stores or authorized retailers in Nigeria to learn more and experience the feature firsthand.

Continue Reading

TechNews

NITDA DG Inaugurates National Technical Working Group on Cloud Infrastructure

REPORTER: Sandra Ani

Published

on

Kashifu Inuwa DG NITDA during virtual inauguration of TWG on National Cloud Infrastructure
The Director General of NITDA, Kashifu Inuwa, during the virtual inauguration of the Technical Working Group on National Cloud Infrastructure

In a significant move to bolster Nigeria’s digital infrastructure, the National Information Technology Development Agency (NITDA) has inaugurated the Technical Working Group (TWG) on National Cloud Infrastructure.

This initiative aims to enhance local cloud capabilities, attract hyper-scale investments, and position Nigeria as a leading technology hub in Africa. 

Speaking at the inauguration, NITDA’s Director-General, Kashifu Inuwa, CCIE, emphasised the need for accurate data and regulatory frameworks to support these initiatives, necessary for Nigeria to control its digital infrastructure, data, and technological future noting that,

“Without this foundation, we cannot achieve true digital sovereignty. Our goal is to build an ecosystem where both local data centre providers can scale, and global hyper-scalers see Nigeria as a viable investment destination.” 

While identifying lack of accurate data on Nigeria’s IT infrastructure as significant challenge, Inuwa noted that while Africa comprises nearly 19% of the world’s population, it hosts less than 1% of global data centres.

“This disparity, coupled with limited insights into Nigeria’s existing IT capacity, hampers investment efforts and without clear data on our infrastructure, attracting investment becomes challenging,” he said.  

The NITDA boss maintained that, to address this, NITDA commissioned comprehensive research to assess Nigeria’s digital landscape which findings have highlighted the need for improved regulatory frameworks, clearer investment incentives, and stronger public-private collaboration. He added that subsequently upon this, NITDA has engaged global consultants to redefine strategies for cloud development. 

As the TWG embarks on its mission, NITDA urges industry experts, policymakers, and stakeholders to contribute their expertise and resources. “With collective effort, Nigeria can emerge as the premier digital hub for West and Central Africa,” Inuwa concluded.

While corroborating the Director General’s point of views, Acting Director of Regulation and Compliance, Barrister Emmanuel Edet, underscored the importance of regulatory intervention in fostering a robust digital economy.

“Our objective is to establish policies and legal frameworks that support cloud development, enabling us to securely host and manage our data. This is crucial for the growth of our digital economy, he said.”  

He also highlights the necessity of capacity building, stating that, “Equipping ourselves with top-tier training and expertise is essential to fully leverage digital technologies.” Barrister Edet called on all stakeholders to actively participate in shaping Nigeria’s digital future.

“Collaboratively, we must develop a framework that reflects our national interests, and it should be widely accepted. This effort will define Nigeria’s role in the global digital arena, he observed. 

The TWG will help in the drive to attract hyperscale investments and enhance local cloud capabilities by proffering measures to encourage the use of accurate data, recommend the enactment and compliance to enabling policies.

Members of the TWG which includes Google, AWS, IBM, Oracle, Microsoft, HUAWEI Cloud, Equinix, Kasi, Rack Centre, Africa Data Centres, several other data centre operators and the Nigeria Data Protection Commission expressed support and readiness to volunteer and contribute resources.

Continue Reading

GRTech

Tips to Stay Secure during Black Friday & Cyber Monday

Sophos Special edition

Published

on

Sophos Cyber Monday

With Black Friday and Cyber Monday around the corner, we’re entering a high-risk period for cybersecurity.

A recent Sophos report highlights that malicious emails were the second most common root cause of ransomware attacks in critical sectors, responsible for 25% of cases.
During peak shopping days, this threat intensifies.

Here’s what happens: with the surge in online deals, more employees may be shopping from their work computers, feeling that Cyber Monday is a legitimate time to do so.

This increases the risk of them clicking more freely and potentially exposing the organization to malicious links or phishing attacks.
 
To keep your organization safe, encourage your team to follow these simple tips:
• Use an ad blocker – Advertisements are not only tracking your every movement and collecting enough information on your habits to make the FBI blush, but they are also a major source of malicious links and deceptive content on the internet. Not only is your browsing safer, but also faster and uses less bandwidth. Two of our favorites are uBlock Origin and Ghostery.
• Use private browsing or incognito mode – To prevent your shopping habits and interests from following you around from site to site (and potentially revealing what gifts you might be purchasing to others using your device, bonus!), you should enable private browsing (Firefox) or incognito mode (Chrome). This will block tracking cookies and help the internet forget your travels as the waves wash away your footprints in the sand.
• Make your browser “privacy smart” – The Electronic Frontier Foundation (EFF) provides a browser extension called Privacy Badger designed to automatically make all the right choices around browsing whilst maintaining our privacy and blocking invisible trackers.
• Avoid using one account on multiple services – When logging into an e-commerce site it is often tempting to use the “Sign in with Facebook” or “Sign in with Google” button. While it takes a few more minutes to create a new login, it will provide more privacy as you are not sharing all of the sites you shop at with these tech giants.
• Use guest login when available – In addition to letting you use an account from other websites, many have an option to use a guest login rather than creating a new account. This is a great option if you don’t expect to need technical support or to do business on a recurring basis. Fewer passwords, fewer personal details, fewer problems if they get hacked.
• Don’t save card details – Many e-commerce sites will default to storing your credit card information in your profile for your “convenience” (or their hope you’ll shop there again). They can’t lose what they don’t have, so tell them not to store your credit card unless it is absolutely necessary.
• Use temporary card numbers – Many financial institutions now offer temporary or one-time use credit card numbers. You can open the app on your phone or in your browser and get a single-use disposable credit card number preventing card fraud and tracking when merchants share card processors. Sometimes you’re even able to specify a card limit per temporary number to further protect your account.
• Use credit, not debit – All of us need to be wary of overspending during the holidays, but it is best to leave the debit card at home. Credit cards offer significantly more protection against online fraud, and you are in the power position in a dispute. You can simply not pay your bill while disputing the charge, rather than having criminals directly drain your bank account of your hard-earned cash.
• Beware of direct messages via social media/chat apps – With modern generative AI technology it is almost trivial to create an entire fake online store and lure people to share their personal information and payment data with you. It’s safest to shop at established sites or those personally recommended to you by friends and family. Many unsolicited messages lead to data collection or theft.
• Don’t click deals in email that look too good to be true or are from businesses you don’t have accounts from – these could be phishing emails hoping to bait you into clicking links to bogus, malicious web sites.
 
This season, small steps can make a big difference in protecting against cyber threats.

Continue Reading

Trending