NITDA cautions Nigerians on new email-based attack from Solarwindhackers

By Emmanuel Elebeke

The National Information Technology Development Agency (NITDA), has cautioned Nigerians against a new email-based attack from Solarwindhackers.

According to NITDA, Microsoft, a world-renown multinational technology company uncovered a widespread malicious email campaign undertaken by the hacking group- NOBELIUM and warned Nigerians not to fall for it.

According to NITDA, the cybercriminals leverage the legitimate mass-mailing service to masquerade as a US-based development organisation and distribute malicious URLs to a wide variety of organisations especially government organisations, non-government organisations (NGOs), think-tanks, military, IT service providers, health technology, and research, and telecommunications providers.

ALSO READ: UPDATED: Property worth millions of naira destroy as fire guts Ladipo spare parts market, building in Lagos

“Their antics involve the use of emails claiming to be an alert from USAID about new documents published by former President Donald Trump about “election fraud.”

“Once users click the link in the email, the URL would direct them to the legitimate Constant Contact Service and then redirect to Nobelium-controlled infrastructure through a URL that delivers a malicious ISO file. This, in turn, enables the criminals to execute further malicious objectives, such as lateral movement, data exfiltration, and delivery of additional malware,” it said.

ALSO READ: I’m repulsed by such premeditated, gruesome murder of Gulak — Buhari expresses outrage

The agency is therefore advising Nigerians to be wary of such criminals masquerading as USAID and follow the following recommendation: Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent to cover rapidly evolving attacker tools and technique; Run EDR in block mode to enable antivirus to block malicious artifacts (EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach; enable network protection to prevent applications or users from accessing malicious domains and other malicious content on the Internet; enable investigation and remediation in full automated mode to allow antivirus take immediate action on alerts to resolve breaches; use device discovery to increase your visibility into your network by finding unmanaged devices on your network and onboarding them; enable multifactor authentication (MFA) to mitigate compromised credentials; block all Office applications from creating child processes.

Also, users and administrators are advised to review and apply the above mitigations.

To report an incident, users are advised to contact NITDA CERRT via email [email protected] or via telephone +2348178774580.

Vanguard News Nigeria

The post NITDA cautions Nigerians on new email-based attack from Solarwindhackers appeared first on Vanguard News.