Ransomware in Nigeria: How Groups Like Killsec and Phobos Are Targeting Critical Infrastructure

Ransomware has moved from a background risk to an active, named threat in Nigeria's cybersecurity advisories. In September 2025, the ransomware group Killsec claimed responsibility for breaching Princeps Credit Systems Limited, a subsidiary of Princeps Holdings and a lending institution regulated by the Central Bank of Nigeria. Around the same period, Nigeria's Computer Emergency Response Team (ngCERT) and the NCC's CSIRT flagged an escalation in ransomware activity, specifically calling out the Phobos ransomware group for targeting critical cloud service providers within Nigeria's national cyberspace. What makes these advisories notable is who they're aimed at. When a national CERT issues a specific warning about a ransomware group targeting cloud infrastructure providers, it's a signal that the threat has moved beyond opportunistic attacks on individual businesses toward the shared infrastructure that many organisations depend on simultaneously. A successful ransomware attack on a cloud provider or a regulated financial institution doesn't just affect one victim — it can cascade to every client, partner, and customer downstream. Between January and September 2025, Nigeria saw a broader surge in cybercrime activity across banking, telecom, government, and healthcare sectors, with dark-web forums observed actively selling stolen Nigerian banking credentials and unauthorised system access. Security tooling reportedly blocked over 1.46 million attack attempts nationally between January and June 2025 alone — a volume that reflects both the scale of the threat and the fact that most attempts, fortunately, don't succeed. The ones that do tend to share common root causes: unpatched systems, weak remote-access controls, and insufficient network segmentation that lets an attacker move laterally once inside. For any organisation running infrastructure that a ransomware group might consider high-value — financial services, healthcare, government-adjacent systems, or cloud-hosted platforms — the defensive priorities are well established even if they're not always well implemented: offline and immutable backups that ransomware can't reach, network segmentation to contain lateral movement, multi-factor authentication on all remote access, and an incident response plan that's been tested, not just written. QuantomShield Tech Partners Ltd works with government and enterprise clients on exactly this layer of defence — risk assessment, network security architecture, and incident response planning designed around the ransomware tactics currently active in Nigeria's threat landscape. Advisories from ngCERT and the NCC-CSIRT are a signal worth acting on before your organisation becomes the next case study.