‘DangerousSavanna’ Hackers Targeted Financial Institutions in Africa For Two Years

A persistent cyber–attack marketing campaign has emerged focusing on key monetary establishments in French–speaking African nations around the world and has been lively about the last two a long time.

The campaign was found out by Check Level Analysis (CPR) and dubbed ‘DangerousSavanna.’ It relied on spear phishing strategies to initiate an infection chains.

The danger actors reportedly sent destructive attachment emails in French to workers in Ivory Coastline, Morocco, Cameroon, Senegal and Togo using varied file types, including PDF, Phrase, ZIP and ISO information, to entice victims. 

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

More, DangerousSavanna hackers made use of lookalike domains, impersonating other money establishments in Africa, this sort of as the Tunisian Overseas Lender and Nedbank.

“Our suspicion is that this is a economically enthusiastic cyber–criminal, but we never have conclusive evidence still,” explained Sergey Shykevich, threat intelligence group supervisor at CPR.

“Whoever it is, this threat actor, or group of actors, is highly specific and persistent in infecting specific victims, and right now, we are conscious of at minimum 3 important money businesses that function in these countries that have been impacted.”

Even further, the cybersecurity expert claimed Look at Point’s assessment exhibits that this actor will continue on attempting to crack into its focused businesses until eventually weaknesses are discovered, or employees make a slip-up.

“Commonly, when a hacker targets financial establishments specifically, their main target is to protected entry to core banking techniques such as payment card issuing devices, SWIFT transfers and ATM regulate techniques,” Shykevich additional.

More typically, the Examine Position executive claimed cyber–criminals believe that fragile economies in some African international locations might be joined to a deficiency of financial investment in cybersecurity.

“But the finance and banking sector is truly just one of the most impacted industries around the globe, enduring 1144 weekly cyber–attacks on common,” Shykevich spelled out.

In the advisory detailing some of DangerousSavanna’s latest attacks, CPR supplied providers with advice on avoiding spear phishing attacks. These techniques contain maintaining units up to date, implementing multi-factor authentication (MFA), confirming suspicious email activity in advance of interacting, educating employees and regularly tests their cybersecurity understanding.

The DangerousSavanna advisory arrives weeks just after cybersecurity corporation Vade uncovered financial institutions worldwide received the greater part of phishing attacks in the course of the first half of 2022.