The National Information Technology Development Agency (NITDA) has advised Nigerians to be on the lookout for a malicious email campaign by a hacking group, Nobelium.
The hackers are masquerading as the United States Agency for International Development (USAID).
Hadiza Umar, NITDA Head of External Relations, in a statement said the attackers were uncovered by Microsoft.
They leverage on the mass-mailing service to masquerade as USAID and distribute malicious Uniform Resource Locator (URLs) to a wide variety of organisations.
The group targets government and non-government organisations, think-tanks, the military, IT service providers, health, technology and telecommunications providers.
The hackers use emails claiming to be an alert from USAID about new documents published by former President Donald Trump about election fraud.
Once clicked, the URL would direct the email user to the legitimate Constant Contact Service and then redirect to Nobelium-controlled infrastructure through a URL that delivers a malicious International Organisation for Standardisation (ISO) file.
“This enables the criminals to execute further malicious objectives, such as lateral movement, data exfiltration and delivery of additional malware,” the statement read.
Umar urged citizens to run Endpoint Detection and Response (EDR) in block mode to enable antivirus to detect malicious artifacts as the EDR in block mode works behind the scenes to remediate malicious artifacts.
NITDA further advised users to enable network protection to prevent applications or users from accessing malicious domains and other malicious content on the Internet.
“Use device discovery to increase your visibility into your network by finding unmanaged devices on your network and onboarding them
“Enable Multi-Factor Authentication (MFA) to mitigate compromised credentials and block all office applications from creating child processes,” the agency added.
America’s Cybersecurity and Infrastructure Security Agency (CISA) under the Department of Homeland Security has commenced an investigation.
“We are aware of the potential compromise at USAID through an email marketing platform and are working with the FBI and USAID to better understand the extent of the compromise and assist potential victims”, CISA noted.
Karine Jean-Pierre, White House deputy press secretary, told reporters that the U.S. government was “aware of the latest phishing incident” and “monitoring the situation.”
