A Security Advisory for Every Nigerian Organisation Still Making Itself a Soft Target

I woke up in the wee hours of this morning, and as a ritual, I went through my Twitter timeline to see conversations on yesterday’s Champions League game—I had gone to bed early the previous day—only to see that ByteToBreach, the threat actor responsible for the Sterling Bank, Remita, and CAC breaches, had struck again.

The fourth act.

This time, it was Ikeja Electric, arguably Nigeria’s largest electricity distribution company, serving Lagos.

I had been contemplating, for a while now, what to do if the threat actor struck again.

You see, as much as my publications have helped contribute to national consciousness and discourse on cybersecurity, and have aided professionals in protecting their own institutions and provided context for regulators, I worry that maybe the media coverage around these breaches is now inspiring more attacks from threat actors and copycats who are looking for an opportunity to gain social media traction.

That is why we have been inundated with claims of cyber breaches against Nigerian institutions — a lot of them unverified — almost on a daily basis.

Hence, my hesitation to write this piece.

I wanted the story and the threat actor to go back into obscurity. But on second thought, I figured that this is now tantamount to cyber-terrorism, and it is important that the conversation be about putting an end to it.

And there is no other way than simply hardening our systems, demanding accountability from the people who run them, and making soft targets harder. Silence is not a deterrent. Only competence is.

Between these breaches, I had made a couple of posts on LinkedIn calling out the self-reporting model that regulators have provided for organisations in Nigeria.

Instead of periodic independent checks and audits, they mostly rely on an institution’s word of mouth that they are security-compliant.

You fill a self-assessment form, or you submit a compliance audit report where you mention things like multi-factor authentication and antivirus software, and the regulator acknowledges your submission and deems you compliant.

The rigour of those reports, or whether any actual checks are done to confirm their veracity, is for you to figure out. I will not tell you how Nigeria works. But the breaches we have seen so far, especially how many of them stem from bad engineering discipline and the absence of basic controls, and the general anyhowness of how we approach IT in Nigeria, should tell you something.

We have long been protected by obscurity. If we continue in this anyhowness, the question is no longer if the next breach will happen. It is who is next and whether they will find out from the attacker or from the press.

That is why I have decided to write this advisory on how we should stop being soft targets.

On ByteToBreach

What has transpired in the last month is an interesting case study.

We have a global threat actor who has now tried—without success—to ransom every Nigerian organisation he has gone after.

It is very ambitious to think a Nigerian organisation would pay ransom for data, like they actually care about their reputation and their customers. He has done this to international targets before. But it is starting to look like the notoriety has gotten to him.

In fact, he labelled one of the artefacts from the Ikeja Electric breach “#CTFNIGERIA2026”, a reference to Capture The Flag, a hacking competition format. He is gamifying the breach of Nigeria’s critical infrastructure.

This follows the trend of people within the Nigerian cybersecurity community commenting that hackers are playing CTF with Nigerian institutions.

About a week ago, I received an email from ByteToBreach, impersonating the Central Bank of Nigeria.

I had been in correspondence with him during the CAC breach, where I asked him a couple of accountability questions to understand what his motives were. So imagine my surprise when I got an email from, well, the Central Bank of Nigeria.

I donned my investigative hat and looked at the email headers to confirm this was not a spoofed email. It was not. It had come from a source that was allowed to cryptographically sign emails on behalf of the Central Bank of Nigeria — more on email security later — a source that ByteToBreach had hinted he had compromised.

Through the night, I tried to reach people at the CBN through my network. But the next day, the CBN issued this press release.

And look who was at the scene:

When I emailed him to confirm the email I had received, he said it was a prank—a prank played with the Central Bank of Nigeria’s infrastructure.

Just like this Twitter user informed him that he is in the wrong market, I think he has figured out by now that there is no financial incentive to hacking a Nigerian organisation. The notoriety is the point now.

And the notoriety continues as long as the targets remain soft.

That is the definition of cyber-terrorism in practical effect, regardless of what statute applies: the deliberate, sequential targeting of critical national infrastructure to produce fear, demonstrate systemic vulnerability, and broadcast that demonstration to a public audience.

I will not dignify it by calling it anything more glamorous. But I will not pretend it is anything less than what it is.

An actor who is motivated by attention will keep going as long as the targets stay soft and the audience stays engaged.

Nigerian organisations need to stop being soft targets.

The Ikeja Electric Breach

The entry was a portal called SWIMS, Ikeja Electric’s Smart Warehousing Inventory Management System, accessible at swims.ikejaelectric.com.

It had a file upload feature that let users set a profile avatar. The system was configured to only accept image files: jpg, png, gif, tiff. Standard enough.

The problem was where that check happened.

The list of allowed file types was passed as a parameter on the client side, meaning it existed in the browser, not on the server. ByteToBreach, using Burp Suite, intercepted the upload request and modified it. He appended .php to the filename.

The server, which was doing no validation of its own, accepted the file and saved it.

What got uploaded was not an image. It was a webshell, a small script that lets an attacker run commands on the server remotely, through a browser, as if they were sitting at the keyboard.

He tested it immediately. The server responded with the user it was running as. He was in.

From that single foothold, the next moves followed a well-documented playbook.

He deployed a Sliver implant, a command-and-control framework, to maintain persistent access. Inside the application’s configuration files, sitting in plaintext, were the SMTP credentials for the SWIMS service account.

Those credentials authenticated against Ikeja Electric’s Active Directory domain, giving him his first foothold inside the broader corporate network.

From there, he enumerated the domain. The network topology he published shows that Exchange and mail servers, SQL and Redis databases, a WSO2 Enterprise Integrator middleware platform, web application servers, infrastructure servers, a Security and Monitoring cluster, and VMware hypervisors, all on the same domain, all reachable from the same initial compromise. He also found the Domain Controller.

Inside the source code of a notification service he accessed, he found another credential in plaintext, the username and password of a Backup Admin account.

In a Windows corporate environment, accounts in the Backup Operators group carry a specific privilege built into the operating system itself: they are permitted to read files that are ordinarily inaccessible even to most administrators, because backup software must be able to copy everything. This includes the files that store every password on the server—the Security Account Manager database and its companion hive files.

ByteToBreach used this privilege to extract those password files remotely. Inside them was the password hash for the domain administrator, the master key to the entire network. Passwords aren’t stored as readable text in Windows; they’re stored as a scrambled fingerprint called an NTLM hash. But a hash can be cracked.

He ran the hash through Hashcat, a software that tries millions of password guesses per second against a captured hash until one matches. The password was very simple. Simple enough that a computer finds it in minutes. Strong enough that someone thought it was adequate.

With that hash, he had full control of the domain.

He found the company’s VMware vCenter server—the control panel for every virtual machine in the organisation—running software from 2018 that had never been updated.

A known vulnerability in that version allowed him to take control of it without credentials.

He noted, drily, that taking down vCenter would take hundreds of machines with it.

He pulled passwords from the company’s backup software, Veeam, which stores them in a database it doesn’t adequately protect. He ran a tool called BloodHound, which maps the relationships and permission chains inside a corporate network, the way Google Maps traces roads, to understand every possible path to further access.

He found source code for multiple internal systems, including what appears to be an integration with Nigeria’s National Identity Number database.

Then he published what he had done with all of it.

In his own words, unconfirmed at the time of writing and pending any response from Ikeja Electric:

“First of all, the full deployment of my ransomware on more than 50 hosts (clustered from ESXI and vCenter compromise), which caused a shutdown of many subdomains belonging to Ikeja. Second, the exfiltration of customers, employees and business databases, the internal applications source codes, and a full Active Directory mapping with the employees passwords that were cracked offline after leaving the network. Everything is included in the dump except for the databases, which are sold separately. A lot of the metering softwares were taken down: Wasion, Holley, Aries, Longimeter, Siemens, just to name a few. When you receive your next energy bill, just know that it is utter bullshit — a guess from Ikeja.”

We are waiting to see whether Ikeja Electric will acknowledge any of this. They have not spoken publicly about the breach, the ransomware deployment, or any disruption to their billing systems. ByteToBreach has.

If his account is accurate, this is no longer a story about stolen data. It is a story about operational disruption to the infrastructure that millions of Lagos residents depend on, and about those residents having no way of knowing it happened.

The vCenter access we described above was not only a reconnaissance milestone. It was the deployment vehicle. When vCenter falls, every virtual machine it manages can fall with it. He said as much when he found it.

Then, if we are to believe him, he demonstrated it across more than fifty hosts. The metering software that calculates what Lagos residents owe for their electricity — Wasion, Holley, Aries, Longimeter, Siemens — was taken down.

Customer data is in a dump somewhere. The databases are being sold separately to whoever will pay.

I will update this piece if and when Ikeja Electric responds.

From one upload form to full domain control, ransomware deployment, and metering infrastructure disruption.

The Active Directory export, the company’s full list of system accounts, contains 7,200+ records. Nearly 3,900 of those accounts were active at the time of the breach.

Another 3,382 belonged to former staff who had left, contractors who had finished, test accounts that were never cleaned up, all still sitting in the system, years after they should have been removed.

The email list runs to 3,952 addresses. The CEO’s information is among them. And in a connected Google Drive folder, photographs, signatures, etc., probably staff or customers, are sitting accessible.

This attack required no exceptional capability. Every technique he used is documented, taught in security courses, and detectable with standard tooling. The breach happened because, just like the others, the door was open. Not cracked. Open.

The Advisory

Here is what needs to happen. I am writing this for three audiences: individuals, organisations, and the people responsible for regulation, because the problem exists at all three levels.

If You Are an Individual

Your data may be in this breach or the ones before it. If you are a Sterling Bank, Remita, CAC, or Ikeja Electric customer, your name, your email address, and potentially your identity documents could be in the hands of a threat actor who has already demonstrated he is willing to publish and sell what he takes.

A few practical steps.

Be suspicious of any message that references your electricity account, your meter number, or your bill, especially if it asks you to click a link or make a payment. With your account details in hand, a convincing phishing message is trivial to construct.

This applies equally to customers of Sterling Bank, Remita, and CAC: be alert to any unsolicited communications referencing your account, your tax records, or your business registration details.

If you have an account on any of these platforms and you use that same password anywhere else—your email, your banking app, anywhere—change it now. Use a different password for every account. A password manager makes this manageable.

And understand that this kind of exposure does not expire quickly. Attackers who buy stolen data do not always use it immediately. Stay cautious for months, not days.

If You Run or Work in an Organisation

1. The first thing to understand is that the vulnerabilities exploited in these four breaches are not rare or obscure. They are the most commonly found issues in every penetration test conducted on Nigerian organisations. File upload vulnerabilities. Hardcoded credentials. Unpatched systems. Weak access controls. If your organisation has not had a security assessment in the last year, you do not know whether these issues exist in your own systems. The honest probability is that some of them do.
2. Get your web applications tested. Any system your organisation runs that is accessible from the internet, a customer portal, a staff application, a vendor interface etc., should be assessed for the basics. You do not need to start with the exotic. Start with the common. The common issues are what are getting organisations breached.
3. Find your plaintext credentials. In every breach in this series, the actor found passwords stored in places they should never be. Application configuration files, source code, internal documents. This is an instruction to your IT team: search your systems and repositories for stored credentials. Rotate any you find. Use proper secret management going forward.
4. Look at who has access to what. The Ikeja Electric Active Directory contained over three thousand disabled accounts, including former employees, contractors, test users that had never been cleaned up. Orphaned access is a risk even when it looks inactive. Someone knowing an old credential is all it takes. Review your user accounts. Remove what does not belong.
5. Know what you would do if it happened to you. The organisations in this breach series shared one characteristic beyond weak defences. None of them appeared to have a functioning incident response process ready to activate. A threat actor exfiltrating terabytes of data undetected and hanging around for days is an indictment of your incident detection and response posture. A plan that lives in a document and has never been tested is not a plan. Run a tabletop exercise. Identify who makes decisions, who communicates externally, and what legal obligations are triggered from the moment a breach is detected. In Nigeria, the NDPC’s data breach notification requirements are not optional. Aside from the CAC, which released a press release, none of the organisations affected has informed their customers that their data is in the hands of a threat actor.
6. Segment your networks. When ByteToBreach got into one portal at Ikeja Electric, he could reach everything. Databases, email servers, backup systems, virtual machines. That should not be possible. Sensitive systems should be isolated from each other so that a compromise in one area does not automatically become a compromise everywhere. If your organisation has never thought about network segmentation, this is the moment to start.
7. Share intelligence. The Nigerian cybersecurity community is not large, but it is not small either. The threat actor currently working through Nigerian infrastructure is not tailoring his techniques to each individual target; he is using the same playbook repeatedly because it keeps working. That means the indicators from one breach are directly relevant to every organisation that has not yet been hit. Sharing threat intelligence — indicators of compromise, techniques observed, vulnerabilities confirmed — between organisations and their sector peers is not a competitive risk. It is a collective defence. Organisations that have been targeted should be coordinating with their sector CERTs and with peers, not managing breaches in isolation.

For The Regulators

Let me make two separate arguments, because they are often collapsed into one, and they deserve to stand alone.

The first is about what is happening right now, in this breach series, which is already illegal.

The Nigeria Data Protection Act mandates a 72-hour notification window. When an organisation discovers a breach, the clock starts. They have 72 hours to inform the relevant regulator. That is the law. It is not a guideline. It is not a best practice recommendation. It is a statutory obligation with enforcement consequences.

The NDPC did not learn about the first breach from Sterling Bank. It learned from the media. ByteToBreach had spent days negotiating a €250,000 ransom with Sterling Bank, threatening to publish data, before the negotiations collapsed, and he leaked it, and throughout all of that, the regulator responsible for protecting Nigerian citizens’ personal data was not in the room. They were reading the same news the rest of us were.

That is not a compliance gap. That is an organisation making a choice: to manage a breach internally, keep it quiet, protect its reputation, and deal with the regulator only when silence became impossible. That choice has a name. It is called non-compliance. And it should be treated as such.

Beyond the regulator, Section 40 of the Nigeria Data Protection Act is equally explicit about the obligation to inform affected individuals.

The people whose data is in these breaches—whose names, account details, and identity documents are now in the possession of a threat actor—are entitled to know. Not eventually. Not when the organisation has completed its internal review and decided what the narrative will be.

The second point is the one I keep making, and made at the beginning of this piece.

The self-assessment model is not a serious compliance framework. It tells regulators what organisations say about themselves. The breach series you have just read about tells you what is actually true. The gap between those two things is the problem. Periodic independent checks, real audits with real consequences, a regulator with the technical capacity and the staffing to verify what it is certifying, that is what closes the gap.

Conclusion

I am going to conclude this with email security, as the sun is coming and I have to leave my desk.

Email security is one of the lowest-hanging fruits in good security practice, as with the right configurations, you can make it almost impossible for an attacker to successfully spoof your domain.

DMARC is an email security standard that tells the internet’s email systems what to do when someone tries to send an email pretending to be you. p=none means: do nothing. Watch, but do nothing.

p=quarantine would send suspicious emails to spam. p=reject would block them entirely.

It takes an afternoon to implement this correctly.

Every organisation reading this should check its own DMARC record today. If you do not have one, or if yours is set to p=none, fixing it is the single highest-return, lowest-cost security action you can take right now.

It will not stop a determined attacker. But it will stop the most common form of impersonation that puts your customers and partners at risk.