NCC-CSIRT Urges Strong Cybersecurity

The Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has emphasized the importance of implementing robust cybersecurity measures to protect against ransomware attacks. In an advisory issued on August 12, 2022, the NCC-CSIRT urged organizations to adopt practices such as using strong and unique passwords for each account and enabling multi-factor authentication (2FA) wherever possible. They also stressed the significance of regularly backing up systems to mitigate potential damage.

This advisory from the NCC-CSIRT came in the wake of a security breach where the Yanluowang threat actors infiltrated Cisco’s network by exploiting stolen credentials from an employee’s personal Google account. The compromised credentials were synchronized from the employee’s browser, enabling unauthorized access to Cisco’s network. Ransomware, a form of malware, was then employed to restrict access to files until the attackers’ demands were met.

Cisco promptly reported the security incident on its corporate network, although it stated that no discernible impact on its business operations had occurred. Nevertheless, the threat actors publicized a list of files from the security breach on the dark web on August 10, causing concern. The NCC-CSIRT estimated that the incident had the potential for critical damage, with ransomware deployment leading to compromised computer systems, theft and exposure of sensitive data belonging to customers, substantial financial losses, indirect costs, and possible reputational harm to affected organizations.

The NCC-CSIRT outlined the initial steps to prevent ransomware attacks, emphasizing the importance of employees using strong and unique passwords for their accounts and enabling multi-factor authentication wherever available. As a response to the attack, Cisco implemented an immediate company-wide password reset. Cisco product users were advised to ensure a successful password reset. Additionally, the company created two Clam AntiVirus signatures (Win.Exploit.Kolobko-9950675-0 and Win.Backdoor.Kolobko-9950676-0) to disinfect any potentially compromised assets. Clam AntiVirus Signatures (ClamAV) is a versatile antimalware toolkit capable of detecting various types of malware and viruses.

The NCC-CSIRT stressed the significance of user education in thwarting such attacks and similar ones. Employees should be educated on legitimate channels through which support personnel will contact them to help identify fraudulent attempts to obtain sensitive information. The advisory also reiterated the importance of regular system backups, which can serve as a critical safeguard against ransomware attacks.

The Computer Security Incident Response Team (CSIRT) established by the NCC is dedicated to addressing cybersecurity incidents in the telecom sector, particularly those that may impact telecom consumers and citizens. The CSIRT collaborates with the Nigeria Computer Emergency Response Team (ngCERT), established by the Federal Government, to proactively protect and secure the Nigerian cyberspace, minimize future risks, and prevent potential attacks or related events.

ncc.gov.ng