‘DangerousSavanna’ Hackers Targeted Financial Institutions in Africa For Two Years

A persistent cyber–assault marketing campaign has emerged concentrating on main monetary establishments in French–talking African nations and has been lively over the past two years.

The marketing campaign was found by Test Level Analysis (CPR) and dubbed ‘DangerousSavanna.’ It relied on spear phishing strategies to provoke an infection chains.

The menace actors reportedly despatched malicious attachment emails in French to staff in Ivory Coast, Morocco, Cameroon, Senegal and Togo using various file sorts, together with PDF, Phrase, ZIP and ISO recordsdata, to lure victims. 

Additional, DangerousSavanna hackers used lookalike domains, impersonating different monetary establishments in Africa, such because the Tunisian Overseas Financial institution and Nedbank.

“Our suspicion is that this can be a financially motivated cyber–prison, however we do not have conclusive proof but,” defined Sergey Shykevich, menace intelligence group supervisor at CPR.

“Whoever it’s, this menace actor, or group of actors, is very focused and protracted in infecting particular victims, and proper now, we’re conscious of at the least three main monetary companies that function in these nations which were affected.”

Additional, the cybersecurity knowledgeable stated Test Level’s evaluation reveals that this actor will proceed making an attempt to interrupt into its focused corporations till weaknesses are discovered, or staff make a mistake.

“Normally, when a hacker targets monetary establishments straight, their foremost purpose is to safe entry to core banking methods akin to cost card issuing methods, SWIFT transfers and ATM management methods,” Shykevich added.

Extra typically, the Test Level government stated cyber–criminals consider that fragile economies in some African nations could also be linked to a scarcity of funding in cybersecurity.

“However the finance and banking sector is definitely one of the impacted industries worldwide, experiencing 1144 weekly cyber–assaults on common,” Shykevich defined.

Within the advisory detailing a few of DangerousSavanna’s latest assaults, CPR offered corporations with recommendation on stopping spear phishing assaults. These strategies embrace retaining methods updated, implementing multi-factor authentication (MFA), confirming suspicious e mail exercise earlier than interacting, educating staff and frequently testing their cybersecurity data.

The DangerousSavanna advisory comes weeks after cybersecurity firm Vade revealed banks worldwide obtained the vast majority of phishing assaults in the course of the first half of 2022.