The Nigerian Communications Commission (NCC) has issued a security advisory of a new cyber threat where the victims’ Virtual Private Network (VPN) account is compromised, thereby granting unauthorized access to users of the messaging app, Telegram. The advisory was issued by the Commission’s Computer Security Incident Response Team (CSIRT) which stated that malware exploits unauthorized access to Telegram accounts to steal data across operating systems such as iOS, Android, Linux, Mac, and Windows.
According to the advisory, “The Ukrainian CERT alleged that a Somnia Ransomware was created to be used on Telegram that tricks users to download an installer that mimics ‘Advanced IP Scanner’ software, which contains Vidar Malware. The installer infects the system with the Vidar Stealer, which steals the victim’s Telegram session data to take control of their account.
“The threat actors abuse the victim’s Telegram account in some unspecified manner to steal VPN connection data (authentication and certificates).
“Once inside, the intruders conduct reconnaissance work using tools like Netscan, Rclone, Anydesk, and Ngrok to perform various surveillance and remote access activities, and then deploy a Cobalt Strike beacon, exfiltrating data using the Rclone program”.
CSIRT advised VPN users to adopt two-factor authentication passcode to prevent hackers from gaining unauthorized access to their Telegram accounts.
CSIRT was set up as an incident center by the NCC with the aim of focusing on incidents in Nigerian cyberspace that may affect telecom users and the general public.
