The Nigerian Communications Commission (NCC) has discovered two cyber threats targeting Windows platforms and routers respectively.
The discoveries were made known earlier this week in two separate advisories released by the computer security incidents response team (CSIRT) set up by the NCC for the telecoms sector.
The first cyber threat is a ransomeware known as Lokilocker which is capable of wiping data from all version of Windows systems or platforms. It causes data loss, and denial of service (DoS), which reduces user’s productivity.
Lokilocker is a relatively new ransomware that has been discovered by security researchers and belonging to the ransomware family. Lokilocker operates by encrypting user files and renders the compromised system useless if the victim does not pay the demanded ransom in time.
To hide the malicious activity, the ransomware displays a fake window update screen, cancel specific processes and services, and completely disables the task manager, windows error reporting, machine firewall and windows defender of the compromised system.
“To protect against infections by LokiLocker and similar ransomware, the best rule is to always have a backup copy of your data, which should be stored offline,” the advisory stated.
Additionally, according to CSIRT, “all downloads and email attachments should be opened with caution, even if they are from trusted sites or senders. Users should also ensure they attachments are scanned with an up-to-date antimalware solution, before opening.”
The second cyber threat discovered by the NCC CSIRT is a Botnet that targets the Microtik version of routers. As CSIRT revealed, thousands of routers from Microtik which have been found to be vulnerable are being used to constitute what has been named one of the largest botnets in history
This botnet exploits an already-known vulnerability, which allows unauthenticated remote attackers to read arbitrary files and authenticated remote attackers to write arbitrary files, due to a directory traversal vulnerability in the WinBox interface. The vulnerability which was previously fixed allowed the perpetrators to enslave all the routers and then rent them out as a service.
The threat types emanating from the botnet include bypass authentication, data loss, denial of service, remote code execution, sniff password and unauthorized access. These situations result in dangers to victims of this cyber threat including malware distribution, mining cryptocurrency, thereby increasing the use system resources, remote code execution and data theft.
To be protected against this botnet, NCC CISRT advised users to update or apply the latest patches to their routers early, set strong router passwords, disable the administration interface of the routers from the public, stay away from illegitimate or cracked software versions of legitimate applications, and use decent antivirus software with in-built web-filtering, and apply the latest patches as soon as they arrive.
