GRTech
Sophos Threat Report Flags Cyberattack Trends Expected To Shape IT Security In 2021


Sophos, a global leader in next-generation cybersecurity, today published the Sophos 2021 Threat Report, which flags how ransomware and fast-changing attacker behaviors, from advanced to entry level, will shape the threat landscape and IT security in 2021.
The report, written by SophosLabs security researchers, as well as Sophos’ threat hunters, rapid responders, and cloud security and AI experts, provides a three-dimensional perspective on security threats and trends, from their inception to real-world impact.
Three key trends analyzed in the Sophos 2021 Threat Report include:
1. The gap between ransomware operators at different ends of the skills and resource spectrum will increase. At the high end, the big-game hunting ransomware families will continue to refine and change their tactics, techniques and procedures (TTPs) to become more evasive and nation-state-like in sophistication, targeting larger organizations with multimillion-dollar ransom demands. In 2020, such families included Ryuk and RagnarLocker.
At the other end of the spectrum, Sophos anticipates an increase in the number of entry level, apprentice-type attackers looking for menu-driven, ransomware-for-rent, such as Dharma, that allows them to target high volumes of smaller prey.
Another ransomware trend is “secondary extortion,” where alongside the data encryption the attackers steal and threaten to publish sensitive or confidential information, if their demands are not met. In 2020, Sophos reported on Maze, RagnarLocker, Netwalker, REvil, and others using this approach.
“The ransomware business model is dynamic and complex. During 2020, Sophos saw a clear trend towards adversaries differentiating themselves in terms of their skills and targets. However, we’ve also seen ransomware families sharing best-of-breed tools and forming self-styled collaborative ‘cartels,’” said Chester Wisniewski, principal research scientist, Sophos.
“Some, like Maze, appeared to pack their bags and head for a life of leisure, except that some of their tools and techniques have resurfaced under the guise of a newcomer, Egregor. The cyberthreat landscape abhors a vacuum.
If one threat disappears another one will quickly take its place. In many ways, it is almost impossible to predict where ransomware will go next, but the attack trends discussed in Sophos’ threat report this year are likely to continue into 2021.”
2. Everyday threats such as commodity malware, including loaders and botnets, or human-operated Initial Access Brokers, will demand serious security attention. Such threats can seem like low level malware noise, but they are designed to secure a foothold in a target, gather essential data and share data back to a command-and-control network that will provide further instructions.
If human operators are behind these types of threats, they’ll review every compromised machine for its geolocation and other signs of high value, and then sell access to the most lucrative targets to the highest bidder, such as a major ransomware operation. For instance, in 2020, Ryuk used Buer Loader to deliver its ransomware.
“Commodity malware can seem like a sandstorm of low-level noise clogging up the security alert system. From what Sophos analyzed, it is clear that defenders need to take these attacks seriously, because of where they might lead.
Any infection can lead to every infection. Many security teams will feel that once malware has been blocked or removed and the compromised machine cleaned, the incident has been prevented,” said Wisniewski.
“They may not realize that the attack was likely against more than one machine and that seemingly common malware like Emotet and Buer Loader can lead to Ryuk, Netwalker and other advanced attacks, which IT may not notice until the ransomware deploys, possibly in the middle of the night or on the weekend. Underestimating ‘minor’ infections could prove very costly.”
3. All ranks of adversaries will increasingly abuse legitimate tools, well known utilities and common network destinations to evade detection and security measures and thwart analysis and attribution.
The abuse of legitimate tools enables adversaries to stay under the radar while they move around the network until they are ready to launch the main part of the attack, such as ransomware. For nation-state-sponsored attackers, there is the additional benefit that using common tools makes attribution harder. In 2020, Sophos reported on the wide range of standard attack tools now being used by adversaries.
“The abuse of everyday tools and techniques to disguise an active attack featured prominently in Sophos’ review of the threat landscape during 2020. This technique challenges traditional security approaches because the appearance of known tools doesn’t automatically trigger a red flag.
This is where the rapidly growing field of human-led threat hunting and managed threat response really comes into its own,” said Wisniewski. “Human experts know the subtle anomalies and traces to look for, such as a legitimate tool being used at the wrong time or in the wrong place.
To trained threat hunters or IT managers using endpoint detection and response (EDR) features, these signs are valuable tripwires that can alert security teams to a potential intruder and an attack underway.”
Additional trends analyzed in the Sophos 2021 Threat Report include:
· Attacks on servers: adversaries have targeted server platforms running both Windows and Linux, and leveraged these platforms to attack organizations from within
· The impact of the COVID 19 pandemic on IT security, such as the security challenges of working from home using personal networks protected by widely varying levels of security
· The security challenges facing cloud environments: cloud computing has successfully borne the brunt of a lot of the enterprise needs for secure computing environments, but faces challenges different to those of a traditional enterprise network
· Common services like RDP and VPN concentrators, which remain a focus for attacks on the network perimeter. Attackers also use RDP to move laterally within breached networks
· Software applications traditionally flagged as “potentially unwanted” because they delivered a plethora of advertisements, but engaged in tactics that are increasingly indistinguishable from overt malware
· The surprising reappearance of an old bug, VelvetSweatshop – a default password feature for earlier versions of Microsoft Excel – used to conceal macros or other malicious content in documents and evade advanced threat detection
· The need to apply approaches from epidemiology to quantify unseen, undetected and unknown cyberthreats in order to better bridge gaps in detection, assess risk and define priorities
Sophos’ Wisniewski provides an overview of the Sophos 2021 Threat Report in the video below:
GRTech
Governor Soludo’s Solution Innovation District Earns Prestigious Global Recognition at Beijing Innovation Forums
Report by ORJI ISRAEL


The Anambra State Government, under the visionary leadership of Prof Chukwuma Charles Soludo, as governor, has powerfully positioned the state as a leading hub for innovation in Africa, following a series of impactful presentations, engagements and a prestigious award win at two major international forums in Beijing.
Ms. Chinwe Okoli, special adviser to the Governor on Innovation and Business Incubation, represented the state at both the Triple Helix Association & CASSSP Innovation Summit and the International Association of Science Parks (IASP) 42nd World Conference held in Beijing, China this September.
Her engagements culminated in the Solution Innovation District (SID) – the flagship project of the Soludo administration – being named among the top 3 winners at the conference’s prestigious IASP Inspiring Solutions Awards 2025, a definitive validation of its transformative model.
From Global Theory to Award-Winning Local Practice
At the Triple Helix Summit, Ms. Okoli’s presentation, “The Anambra Story – From Theory to Transformation,” detailed how Governor Soludo’s vision is being executed through the Triple Helix model, strategically aligning government, academia, and industry. She showcased the SID as a practical, homegrown application of global best practices, already delivering impressive outcomes:
- 80,000+ citizens trained in various digital skills, building a future-proof workforce and talent for technology development.
- Dozens of new startups launched, catalyzing a new creative and digital economy.
- Over $2 Million in ecosystem investment secured, demonstrating early international investment confidence.
Building on this momentum at the 42nd IASP World Conference, Ms. Okoli delivered a presentation titled “Bridging Continents Through Innovation: SID and the Power of International Collaboration.”
She detailed Governor Soludo’s strategy of using the SID as a gateway for global partnerships, emphasizing that tackling Africa’s digital growth and youth unemployment requires cross-border cooperation. This theme set the stage for a monumental endorsement of the Anambra model.
The IASP Inspiring Solutions Award, announced during the conference’s Gala Dinner, specifically recognized the “Anambra Digital Tribe” and its ambitious goal to train one million youths, celebrating it as a “transformational, inspiring, and impactful blueprint for building a sustainable, homegrown innovation economy”
“This award is a powerful testament to Governor Soludo’s foresight and firm commitment,” said Ms. Okoli. “His strategic investments in technology infrastructure and youth empowerment have proven that emerging economies can not only participate in but excel on the global innovation stage. Our message in Beijing was clear: Anambra is building global bridges for talent, technology, and capital, and this award confirms that the world is taking notice. Anambra is open for business and ripe for strategic investment.”
A Compelling Case for Investors and Global Partners
The back-to-back presentations in Beijing highlighted key investor-friendly attributes of the Anambra ecosystem, driven by the Governor’s policies:
A Clear, Government-Backed Vision: Anambra is the first subnational government in Nigeria to fully invest in a dedicated innovation district, turning the historic Old Government House into a 13.7-hectare hub- designed to have AI labs, robotics centers, office spaces, residences and advanced research facilities. Opportunity for investment at the district-real estate development, technology infrastructure, R&D etc are now open.
Proven Partnerships: The state has already secured collaborations with global giants like the UNDP, Meta, Microsoft, Connekt Broadband, Circum Technologies etc signposting opportunity for future partners.
Massive Talent Pipeline: The “1 Million Anambra Digital Tribe” initiative directly addresses the talent needs of the global digital economy, creating a deep pool of skilled developers, creatives, and tech entrepreneurs.
Strategic Positioning: With Africa’s digital economy projected to surge from $180 billion to $712 billion by 2050, Anambra is positioning itself as a strategic gateway and a model for market growth.
This one-two punch of influential speaking engagements and a competitive international award proves that the “Anambra Model” is not just a local initiative but a globally relevant ecosystem. It affirms to every young innovator in Anambra that their ideas have global relevance and assures international investors that the state, under Governor Soludo’s leadership, is a credible and high-potential destination for partnership and growth.
The Solution Innovation District(SID) is the flagship project of the Anambra State Government, envisioned by the Governor, Prof Chukwuma Charles Soludo, to serve as the epicenter for technology, creativity, and entrepreneurship in Southeastern Nigeria. It is designed to catalyze economic transformation through strategic partnerships, world-class infrastructure, and massive human capital development. Opportunity for investment in real estate at the district, technology infrastructure, R&D etc are now open.
GRTech
Sophos Releases State of Ransomware in Education report
97% Data Recovery in Schools Shows Progress against Ransomware, But IT Burnout Grows – Sophos


Sophos, a global leader and innovator of advanced security solutions for defeating cyberattacks, has released its fifth annual Sophos State of Ransomware in Education report.
Sophos, a global leader and innovator of advanced security solutions for defeating cyberattacks, has released its fifth annual Sophos State of Ransomware in Education report.
The global study of 441 IT and cybersecurity leaders shows the education sector is making measurable progress in defending against ransomware, with fewer ransom payments, dramatically reduced costs, and faster recovery rates.
Yet, these gains are accompanied by mounting pressures on IT teams, who report widespread stress, burnout, and career disruptions following attacks – nearly 40% of respondents reported dealing with anxiety.
Over the past five years, ransomware has emerged as one of the most pressing threats to education, with attacks becoming a daily occurrence. Primary and secondary institutions are seen by cybercriminals as “soft targets”, often underfunded, understaffed, and holding highly sensitive data.
The consequences are severe: disrupted learning, strained budgets, and growing fears over student and staff privacy. Without stronger defenses, schools risk not only losing vital resources but also the trust of the communities they serve.
Indicators of Success against Ransomware
The new Sophos study demonstrates that the education sector is getting better at reacting and responding to ransomware, forcing cybercriminals to evolve their approach.
Trending data from the Sophos study reveals an increase in attacks where adversaries attempt to extort money without encrypting data.
Unfortunately, paying the ransom remains part of the solution for about half of all victims.
However, the payment values are dropping significantly, and for those who have experienced data encryption in ransomware attacks, 97% were able to recover data in some way. The study found several key indicators of success against ransomware in education:
• Stopping More Attacks: When it comes to blocking attacks before files can be encrypted, both lower and higher education institutions reported their highest success rate in four years (67% and 38% of attacks, respectively)
• Following the Money: In the last year, ransom demands fell 73% (an average drop of $2.83M), while average payments dropped from $6M to $800K in lower education and from $4M to $463K in higher education.
• Plummeting Cost of Recovery: Outside of ransom payments, average recovery costs dropped 77% in higher education and 39% in lower education. Despite this success, lower education reported the highest recovery bill across all industries surveyed.
Gaps Still Need to be Addressed
While the education sector has made progress in limiting the impact of ransomware, serious gaps remain. In the Sophos study, 64% of victims reported missing or ineffective protection solutions; 66% cited a lack of people (either expertise or capacity) to stop attacks; and 67% admitted to having security gaps. These risks highlight the critical need for schools to focus on prevention, as cybercriminals develop new techniques, including AI-powered attacks.
Highlights from the study that shed light on the gaps that still need to be addressed include:
• AI-powered threats: Lower education institutions reported that 22% of ransomware attacks had origins in phishing. With AI enabling more convincing emails, voice scams, and even deepfakes, schools risk becoming test grounds for emerging tactics.
• High-value data: Higher education institutions, custodians of AI research and large language model datasets, remain a prime target, with exploited vulnerabilities (35%) and security gaps the provider was not aware of (45%) as leading weaknesses that were exploited by adversaries.
• Human toll: Every institution with encrypted data reported impacts on IT staff. Over one in four staff members took leave after an attack, nearly 40% reported heightened stress, and more than one-third felt guilt they could not prevent the breach.
“Ransomware attacks on schools are among the most disruptive and brazen crimes,” said Alexandra Rose, Director, CTU Threat Research, Sophos. “It’s encouraging to see schools getting better at responding and recovering, but the real opportunity is to stop attacks before they start. Prevention, backed by strong incident response planning and collaboration with trusted public and private partners, is essential as adversaries adopt new tactics, including AI-driven threats.”
Holding on to the Gains
Based on its work protecting thousands of educational institutions, Sophos experts recommend several steps to maintain momentum and prepare for evolving threats:
• Focus on Prevention: The dramatic success of lower education in stopping ransomware attacks before encryption offers a blueprint for broader public sector organizations. Organizations need to couple their detection and response efforts with preventing attacks before they compromise the organization.
• Secure Funding: Explore new avenues such as the U.S. Federal Communications Commission’s E-Rate subsidies to strengthen networks and firewalls, and the UK’s National Cyber Security Centre initiatives, including its free cyber defence service for schools, to boost overall protection. These resources help schools both prevent and withstand attacks.
• Unify Strategies: Educational institutions should adopt coordinated approaches across sprawling IT estates to close visibility gaps and reduce risks before adversaries can exploit them.
• Relieve Staff Burden: Ransomware takes a heavy toll on IT teams. Schools can reduce pressure and extend their capabilities by partnering with trusted providers for managed detection and response (MDR) and other around-the-clock expertise.
• Strengthen Response: Even with stronger prevention, schools must be prepared to respond when incidents occur. They can recover more quickly by building robust incident response plans, running simulations to prepare for real-world scenarios, and enhancing readiness with 24/7/365 services like MDR.
Data for the State of Ransomware in Education 2025 report comes from a vendor-agnostic survey of 441 IT and cybersecurity leaders – 243 from lower education and 198 from higher education institutions hit by ransomware in the past year.
The organizations surveyed ranged from 100 – 5,000 employees and across 17 countries.
The survey was conducted between January and March 2025, and respondents were asked about their experience of ransomware over the previous 12 months.
Download the State of Ransomware in Education 2025 report on Sophos.com.
GRTech
Sophos Endpoint Now Integrated with Taegis MDR and XDR Strengthening Cybersecurity ROI


Sophos, a global leader of innovative security solutions for defeating cyberattacks, today announced that Sophos Endpoint is now natively integrated and automatically included in all Taegis Extended Detection and Response (XDR) and Taegis Managed Detection and Response (MDR) subscriptions.
This milestone gives customers immediate access to combined prevention, detection, and response capabilities in a single platform, while lowering costs and simplifying operations.
The integration follows Sophos’ acquisition of Secureworks in February 2025 and represents a major milestone in combining the companies’ strengths to help customers defeat cyberattacks with a higher ROI.
Endpoint protection remains one of the most critical layers of defense against today’s cyberthreats, delivering both frontline prevention and vital telemetry for detection and response.
With Sophos Endpoint included in all new and existing Taegis XDR and MDR subscriptions, customers can benefit from unmatched ransomware defenses and adversary mitigation capabilities that automatically deploy in the event of an attack.
The integration enables organizations to strengthen protection while lowering licensing costs, reduce management overhead through native integration, and accelerate threat mitigation with expanded response actions.
Taegis remains a fully open platform, ensuring customers continue to receive full value from their existing cybersecurity investments and maintain the freedom to use the endpoint protection solution of their choice.
This ensures that customers maximize ROI while allowing room in their budget for other cybersecurity priorities.
“Integrating Sophos Endpoint with Taegis delivers a best-in-class unified protection, detection, investigation, and response platform – while also reducing customer costs,” said Raja Patel, chief product officer at Sophos. “Too many organizations still treat endpoint protection like a commodity, and that’s exactly the mistake attackers are counting on. The reality is, not all endpoint products are built to stop today’s hands-on-keyboard attacks. Sophos Endpoint’s prevention-first capabilities, like CryptoGuard anti-ransomware protection and Adaptive Attack Protection, shut down attacks before they can escalate, which is a true game changer for enterprises managing thousands of devices. And by simplifying deployment and policy management, we’re helping organizations stay ahead of threats, lower their total cost of ownership, and maximize the return on their security investments.”
Key benefits for Taegis customers include:
- Lower costs and improved ROI: Sophos Endpoint is now automatically included with all Taegis XDR and Taegis MDR subscriptions, eliminating the need to purchase a separate endpoint security solution.
- Vendor choice preserved: Taegis remains an open platform, allowing organizations to continue using their preferred endpoint solution.
- Industry-leading protection: A 16-time leader in the Gartner® Magic Quadrant™ for Endpoint Protection Platforms, Sophos Endpoint provides unmatched defense against ransomware and other advanced threats, with features such as CryptoGuard and Adaptive Attack Protection, accessible directly from the Taegis console.
- Workflow continuity: Telemetry and detections from Sophos Endpoint are ingested into the Taegis platform, allowing customers to retain existing detection and response workflows.
- Simplified management: Customers can download, install and manage Sophos Endpoint directly from Taegis.
To support a range of environments, customers can now choose between three deployment options for endpoint protection:
- Sophos Endpoint: Natively integrated for comprehensive prevention, detection, and response in a single agent.
- Non-Sophos native integrations: Telemetry ingestion ensures full visibility from products such as CrowdStrike, Microsoft Defender, SentinelOne and Carbon Black by Broadcom.
- Other non-Sophos endpoint security solutions: Supported through a detection only sensor deployment option.
“This integration expands the value and flexibility we deliver to customers and partners,” said Chris Bell, senior vice president of Global Channel, Alliances and Corporate Development at Sophos. “By including Sophos Endpoint in Taegis, organizations gain stronger protection, reduced costs and simplified operations. For partners, it creates new opportunities to help customers consolidate tools, drive renewals and expand enterprise relationships.”
-
Events3 days ago
NOTAP Announces Plan for 2025 Technology and Innovation Summit
-
Entertainment3 days ago
African Voices Highlights Tems’s Path of Passion and Purpose
-
GRPolitics4 days ago
Certificate Scandal: CASER Asks Enugu Attorney General to Prosecute Ex-minister Nnaji
-
GRPolitics1 day ago
GOCOP CONFAB25: Ex-Speaker, Aminu Masari, Lists Four Conditions to Bridge Gap Between Campaign Promises, Realities
-
News1 day ago
NOA Tasks Media Practitioners to Probe Manifestos of Aspiring Political Office Holders
-
Education11 hours ago
Values for Daily Living Announces Winners of National Essay Competition, as VDL Ambassadors Emerge
-
GRPolitics1 day ago
GOCOP CONFAB25: Bode George Urges Online Publishers to Tackle Fake News and Uphold Journalism Ethics
-
GRPolitics24 hours ago
Enugu Commissioners Defect to APC Ahead of Governor’s likely Jump