The Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has warned Nigerians on the discovery of a new attack that compromises victims’ VPN (Virtual Private Network) accounts to attach messaging app, Telegram.
Based on this, the NCC advised Telegram users in Nigeria to adopt two-factor authentication to protect their accounts and to avoid downloading unknown Advanced IP Scanner Software.
According to the latest advisory from the NCC-CSIRT, Ukrainian cyber experts discovered the attack which uses Vidar Malware (Vidar Stealer) to steal Telegram session data. In the absence of configured two-factor authentication and a passcode, this allows unauthorized access to the victim’s telegram account and corporate account or network.
The malware targets platforms across iOS, Android, Linux, Mac and Windows Operating Systems.
The threat: The CSIRT said the Ukrainian CERT alleged that a Somnia Ransomware was created to be used on Telegram that tricks users to download an installer that mimics ‘Advanced IP Scanner’ software, which contains Vidar Malware. The installer infects the system with the Vidar stealer, which steals the victim’s Telegram session data to take control of their account.
- “The threat actors abuse the victim’s Telegram account in some unspecified manner to steal VPN connection data (authentication and certificates). If the VPN account is not protected by two-factor authentication passcode, the hackers use it to gain unauthorized access to the victim’s employer’s corporate network”, the alert and advisory states.
- “Once inside, the intruders conduct reconnaissance work using tools like Netscan, Rclone, Anydesk, and Ngrok, to perform various surveillance and remote access activities, and then deploy a Cobalt Strike beacon, exfiltrating data using the Rclone program,” it added.
What you should know: The CSIRT is the telecom sector’s cyber security incidence centre set up by the NCC to focus on incidents in the telecom sector and as they may affect telecom consumers and citizens at large. The CSIRT also works collaboratively with ngCERT, established by the Federal Government to reduce the volume of future computer risk incidents by preparing, protecting, and securing Nigerian cyberspace to forestall attacks, and problems or related events.