Security Advisories

Advisory ID: ngCERT-2026-040009

SUMMARY

ngCERT alerts all critical sectors to the persistent and escalating threat of Distributed Denial-of-Service (DDoS) attacks within Nigeria's cyberspace. Threat actors are leveraging botnets, amplification techniques, and exploitation of known vulnerabilities to disrupt the availability of essential services within government and private systems. These attacks are increasingly multi-vector and may be combined with other malicious activities, posing significant risks to national resilience and economic stability. Organisations are strongly advised to review this advisory, align it with their DDoS preparedness posture, and ensure it aligns with national incident response frameworks.

DESCRIPTION

A DDoS attack is a coordinated cyber operation in which multiple compromised systems, often forming botnets of infected servers, endpoints, and Internet of Things (IoT) devices, are used to overwhelm a target system, network, or application with excessive traffic, thereby exhausting its resources and rendering services unavailable to legitimate users. These attacks may manifest as volumetric floods that saturate bandwidth, protocol-based attacks that exploit weaknesses in network layers, or application-layer attacks that mimic legitimate user requests to evade detection. Threat actors frequently exploit known vulnerabilities such as CVE-2018-10561, CVE-2021-44228, CVE-2019-19781, CVE-2018-7600, and CVE-2020-25705 to compromise systems and expand botnet infrastructure, while also employing reflection and amplification techniques (e.g., DNS, NTP, Memcached) to significantly magnify attack traffic.

Damage: Critical

Probability: High (CVSS Score 6.6 -10.0)

Platform(s): All web Domain

CONSEQUENCES

If successfully exploited, this campaign may result in:

Disruption of critical services and prolonged system downtime.
Financial losses due to operational interruption and mitigation costs.
Degradation of national critical infrastructure resilience.
Reputational damage and erosion of public trust.
Exploitation as a diversion for ransomware or data exfiltration attacks.
Exposure to regulatory and compliance sanctions.

SOLUTION/MITIGATION

ngCERT recommends the following:

Activate incident response and escalate internally.
Engage ISPs for traffic filtering and mitigation.
Enable DDoS protection (scrubbing, rate limiting, filtering).
Block malicious IPs and restrict non-essential traffic.
Patch vulnerabilities, including CVE-2021-44228, CVE-2019-19781, and CVE-2018-7600.
Harden systems and disable unused services.
Deploy Web Application Firewalls and Intrusion Prevention Systems, and anti-DDoS solutions.
Implement anti-spoofing per Internet Engineering Task Force (IETF) Best Current Practices 38.
Ensure redundancy, load balancing, and auto-scaling.
Monitor traffic continuously and detect anomalies.
Report any incidents to ngCERT and share IOCs.

HYPERLINK

Advisory ID: ngCERT-2026-040004

SUMMARY

ngCERT alerts on multiple critical Remote Code Execution (RCE) vulnerabilities in the Windows Routing and Remote Access Service (RRAS), tracked as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. These vulnerabilities affect enterprise Windows systems leveraging RRAS for VPN and remote access management. Successful exploitation could allow attackers to execute arbitrary code over a network, leading to full system compromise. Organisations and individuals are strongly advised to apply the Microsoft-released security updates, including out-of-band hot patches, to address these flaws.

DESCRIPTION

Windows RRAS is a Windows service that provides routing, VPN, and remote connectivity features. It is affected by multiple critical remote code execution (RCE) vulnerabilities identified as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, arising from improper handling of network responses and memory structures. These flaws can be exploited when an authenticated attacker tricks a domain user into interacting with a malicious RRAS server or sending crafted network requests via the RRAS management interface. The vulnerabilities, particularly CVE-2026-26111, involve integer overflow conditions that lead to memory corruption and enable execution of attacker-controlled code over the network. Collectively, these issues allow low-privileged attackers to leverage legitimate RRAS operations to gain remote code execution capabilities in affected systems.

Damage: Critical (CVSS 8.0)

Probability: High

Platform(s): Windows

CONSEQUENCES

Exploitation of these vulnerabilities may result in:

Remote Code Execution (RCE)
Full System Compromise.
Unauthorized Access.
Lateral Movement.
Service Disruption.

SOLUTION/MITIGATION

ngCERT recommends the following:

Apply Microsoft security patches immediately.
Restrict RRAS access to trusted networks.
Disable RRAS if not needed.
Implement network segmentation and enforce least privilege access controls.
Monitor for suspicious activity and configure firewall protections.
Use IDS/IPS solutions to detect and prevent attacks.

HYPERLINK

Advisory ID: ngCERT-2026-040003

SUMMARY

ngCERT is aware of multiple critical and high-severity vulnerabilities in Zoom products, including Zoom Workplace, Zoom Clients, Zoom Rooms, and VDI components. These vulnerabilities, tracked under several CVEs (CVE-2026-30900 to CVE-2026-30903), range from privilege escalation and command injection to improper input validation and path handling flaws. Successful exploitation may allow threat actors to achieve privilege escalation, unauthorized access, and system compromise. These flaws impact widely deployed enterprise collaboration tools, making them high-value targets for threat actors. Organisation and individuals are advised to immediately remediate these vulnerabilities.

DESCRIPTION

Zoom Products is a unified communications platform for video conferencing, chat, webinars, and collaboration across multiple operating systems. Multiple vulnerabilities stemming from multiple weaknesses in Zoom’s Windows-based components, including improper privilege management, insufficient input validation, and inadequate file path handling. The most critical flaw, CVE-2026-30903, involves external control of file names or paths within the Zoom Workplace Mail feature, allowing unauthenticated attackers to manipulate file operations and escalate privileges remotely. Additional vulnerabilities, CVE-2026-30902 (improper privilege management), CVE-2026-30901 (input validation flaw), and CVE-2026-30900 (improper version check), further enable attackers to elevate privileges or bypass security controls under certain conditions. These vulnerabilities expose Windows systems to both local and remote exploitation scenarios, particularly when systems are unpatched or misconfigured.

Damage: Critical (CVSS 7.8)

Probability: High

Platform(s): Windows

CONSEQUENCES

Exploitation of these vulnerabilities may result in:

Privilege escalation.
Denial of Service (DoS).
Sensitive data exposure.
Remote Code Execution (RCE).
Cross-Site Scripting (XSS) and data manipulation.
Operational and business disruption/risk.
Malware/Ransomware Deployment.

SOLUTION/MITIGATION

ngCERT recommends the following:

Update all Zoom products to the latest versions and apply patched releases (Zoom Security Bulletins - ZSB-26001 to ZSB-26005).
Enable automatic updates across all Zoom clients and components.
Monitor for abnormal privilege escalation events.
Remove or upgrade deprecated/unsupported Zoom versions.
Enforce endpoint protection (EDR/antivirus) and monitor for suspicious activity.

HYPERLINK

Advisory ID: ngCERT-2026-040001

SUMMARY

ngCERT is aware of an ongoing ClickFix (pastejacking) campaign targeting developers and users of AI tools. The campaign distributes Atomic macOS Stealer (AMOS), a sophisticated information-stealing malware affecting macOS systems. The attack leverages social engineering techniques to trick users into executing malicious terminal commands. Organisations and individuals are strongly advised to exercise caution and implement appropriate security controls.

DESCRIPTION

ClickFix (pastejacking) is a social engineering technique that manipulates users into copying and executing malicious commands from deceptive sources such as fake documentation pages, malicious advertisements, or AI-generated content. In this campaign, attackers disguise harmful terminal commands, often obfuscating them with encoding techniques such as base64, as legitimate setup or troubleshooting instructions. Once executed, these commands download and install AMOS. The malware establishes persistence on the compromised system, harvests sensitive information (including credentials and files), and may deploy additional backdoors to enable persistent remote access.

Damage: Critical

Probability: High

Platform(s): macOS

CONSEQUENCES

If successfully exploited, this campaign may result in:

Credential theft, including browser-stored passwords and Apple Keychain data.
Unauthorized remote access through backdoor mechanisms.
Data exfiltration, including sensitive files and developer assets.
Compromise of cryptocurrency wallets and financial information.
Deployment of additional malware and further system exploitation.
Organisational risks such as supply chain compromise and credential leakage.

SOLUTION/MITIGATION

ngCERT recommends the following:

Avoid executing terminal commands from untrusted sources, including advertisements, unknown websites, or unverified AI-generated content
Verify all documentation and instructions, ensuring they originate from official vendor domains
Educate users and developers on pastejacking techniques and social engineering risks
Deploy Endpoint Detection and Response (EDR) solutions to monitor suspicious shell activity
Restrict and monitor script execution on macOS systems
Enable and maintain built-in protections such as Gatekeeper and XProtect
Regularly update macOS and security tools to detect emerging threats
Monitor for unusual outbound network traffic and unauthorized persistence mechanisms
Implement least-privilege access controls to limit the impact of compromised accounts

HYPERLINK

Advisory ID: NCC-CSIRT-2026-014

Summary:

The Nigerian Communications Commission Computer Security Incident Response Team (NCC-CSIRT) alerts stakeholders to an ongoing ransomware campaign attributed to the XP95 Ransomware Group, which has recently targeted government institutions and critical sectors globally.

The attackers employ data exfiltration and extortion techniques, compromising sensitive information and threatening public disclosure unless ransom demands are met. Recent incidents indicate a rapid escalation in the group’s activities, with multiple high-impact breaches recorded within a short timeframe.

Given similarities in system vulnerabilities and cybersecurity posture across institutions, Nigerian organizations, particularly within government and critical infrastructure sectors, are at elevated risk of similar attacks.

Damage: Critical

Probability: High

Product(s)

Enterprise IT Systems
Government Databases
Healthcare Information Systems
Web Applications and Network Infrastructure

Version(s):

All unpatched or improperly configured systems
Systems with weak authentication mechanisms

Platform(s):

Windows
Linux
Cloud-based environments
On-premise enterprise networks

Description:

The XP95 ransomware group is an emerging and highly active threat actor known for targeting data-rich organizations, including government agencies and healthcare providers.

Recent reported incidents include:

A South African government agency breach involving over 453,000 files ( approximately 154GB) of sensitive data.
A Spanish healthcare software provider was compromised, resulting in the exfiltration of approximately 165GB of patient data.
Additional attacks on provincial government institutions targeting job seekers and student databases.

The group’s attack techniques involve:

Exploiting unpatched software vulnerabilities
Leveraging weak authentication and poor password practices
Gaining unauthorized access to enterprise networks
Exfiltrating large volumes of sensitive data
Issuing ransom demands with threats of public data release

The increasing frequency and scale of these attacks highlight a growing threat to public sector institutions and critical infrastructure, particularly in environments with insufficient cybersecurity controls.

Impacts:

Large-scale data breaches involving sensitive information
Financial loss due to ransom payments and remediation costs
Disruption of critical services and operations
Reputational damage and loss of public trust
Regulatory and legal implications

Threat Types:

Ransomware (Double Extortion)
Data Exfiltration
Unauthorized Network Access
Exploitation of System Vulnerabilities

Solutions/Mitigations:

NCC-CSIRT recommends the following mitigation steps:

Apply timely security patches and updates across all systems
Conduct regular vulnerability assessments and penetration testing
Enforce Multi-Factor Authentication (MFA)
Implement strong password policies
Adopt least-privilege access principles
Segment critical networks
Deploy Intrusion Detection and Prevention Systems (IDS/IPS)
Monitor for unusual network activity
Maintain regular, secure, and offline backups
Test backup restoration procedures periodically
Implement Security Information and Event Management (SIEM) solutions
Establish and regularly update incident response plans
Conduct regular cybersecurity awareness training
Educate users on phishing and social engineering risks

References:

Page 5 of 42

ngCERT: Security Advisory on Escalating Distributed Denial-Of-Service (DDOS) Threats Within Critical Information Infrastructure

ngCERT: Security Advisory on Critical Remote Code Execution Vulnerabilities in Windows Routing and Remote Access Service (RRAS)

ngCERT: Security Advisory on Multiple Critical Vulnerabilities in Zoom Products

ngCERT: Security Advisory on Clickfix (PASTEJACKING) Campaign Distributing Atomic macOS Stealer (AMOS)

XP95 Ransomware Campaign Targeting Government and Critical Sectors: Immediate Preventive Measures Required

NCC Computer Security Incident Response Team