Cybersecurity: NCC-CSIRT releases fresh advisories on consumer protection against threat actors

*The Nigerian Communications Commission’s Computer Security Incident Response Team, in fresh advisories, urges telecoms consumers not to give out sensitive information through untrusted online platforms in regard to recent discovery of several phishing apps on Google Play Store

Isola Moses | ConsumerConnect

As part of the Commission’s central mandate to protect consumers, the Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has issued some advisories in the first few weeks of the year 2023 as cyberthreat actors continue to devise means of compromising their targets.

ConsumerConnect reports the telecoms sector regulator’s latest of such advisories urged technology users to be mindful after attackers use Microsoft OneNote attachments in phishing e-mails that infect victims with remote access malware.

READ AfricaNXT 2023: Stakeholders Commend NCC On Regulatory Impact, Digital Economy

According to NCC-CSIRT, the vulnerability may allow hackers to remotely access vital information on victims’ devices.

How to protect yourself against cyberthreats

Mr. Reuben Muoka, Director of Public Affairs at NCC, Tuesday, February 8, 2023, stated that the Team advised users not open files from people they do not know, not to click ‘OK’ and immediately exit the application if they receive a warning that opening an attachment or link can damage their computer or files.

Consumers are also encouraged to promptly share an unknown e-mail they believe to be genuine with a security or Windows administrator to assist in determining whether the file is secure or otherwise.

READ Special Report – NGCC: NCC’s Digital Gender, Youth Engagement For ICT Literacy And Skills

The advisories further noted that the Team recently urged people to not open attachments in suspicious e-mails, and to only purchase or download applications from official Web sites in response to the discovery of phishing malware that can gain unauthorised access to sensitive user data and download further malware.

It stated: “The team reported that cybersecurity analysts at ASEC (South Korea’s cybersecurity emergency response centre), discovered a NetSupport RAT malware being distributed by threat actors from a phishing Web site disguised as a popular Pokemon card game.

“The malware is a remote access tool that easily controls its victims’ Personal Computers and may allow the attackers to remotely control the compromised computer’s mouse and keyboard, access the system’s file management and history and even execute commands allowing them to install additional malware.”

READ: NCC’s Umar Danbatta Receives ‘Award For Exemplary Leadership In Public Service’

The researcher explained the CRAFTED Web site that spread the malware is still online.

“It claims to be home to a new NFT card game built around the Pokemon franchise, offering users strategic fun together with NFT investment profits,” said NCC-CSIRT.

Caution on phishing apps in Google Play Store

In a related advisory, and sequel to the discovery of several phishing apps on the Google Play Store, NCC-CSIRT had also advised users not to give out sensitive information through untrusted platforms.

READ Cybersecurity: NCC-CSIRT Alerts Consumers To Google Chrome Extensions Malware

NCC-CSIRT’s advisory on the discovery said the apps, which have been downloaded 450,000 times in total, could be games or investment services, but that they are designed to steal sensitive user information.

The Team cautioned while some of the malicious apps have been removed, others are still active on the store, with the affected apps listed as Golden Hunt, Reflector, Seven Golden Wolf Blackjack, Unlimited Score, Big Decisions, Jewel Sea, Lux Fruits Game, Lucky Clover, King Blitz, and Lucky Hammer.

The advisory as well noted after installing and opening the app, it will contact a remote server which will reply with instructions on what to do.

“These instructions typically include phishing pages that will be displayed to unsuspecting users to collect their sensitive information,” it said.

Meanwhile, NCC-CSIRT also advised users to update their Galaxy App Store, following the discovery of multiple vulnerabilities in the Samsung Galaxy App Store Application can lead to unwanted app installations and code execution.

It disclosed that Ken Gannon, a cybersecurity researcher from NCC Group, discovered the vulnerabilities in the Galaxy App Store application on Samsung devices that are running Android 12 and older.

The CSIRT is the telecoms sector’s cybersecurity incidence centre set up by the NCC to focus on incidents in the telecoms sector, and as they may affect telecoms consumers and Nigerians at large.

The CSIRT also works collaboratively with ngCERT, established by the Federal Government to reduce the volume of future computer risk incidents by preparing, protecting, and securing Nigerian cyberspace to forestall attacks, and problems or related events.