Experts explain hackers’ focus on banks in Nigeria, sub-Saharan Africa

Following report by Kaspersky that security researchers have spotted thousands of notifications of attacks on major banks located in the sub-Saharan Africa (SSA) region, some Nigerian experts have explained the attractiveness of the region to hackers.

Kaspersky had informed that the malware used in the attacks indicated that the threat actors are most likely to be an infamous Silence hacking group, previously known to be responsible for the theft of millions of dollars from banks across the world.
    
Speaking with The Guardian, the Director-General, Delta State Innovation Hub (DSHuB), Chris Uwaje, noted that the attacks are not only on banks but also governments in the region.

“For instance, it is very much the case that our banks are viewed as less than Tier-1 banks at the global level and therefore access and protection using global protection systems don’t cover SSA IP networks. So SSA banks are left to their own devises to sort out their IP infrastructure and connection to the WWW in a manner that is not structured by ad-hoc and evolving at best.

“The banks need to engage specialist cybersecurity personnel and adopt a garden-walled approach to other local vulnerable systems including interfaces to the mobile telephony networks to reduce exposure.”

“So banks should not rest on their oars. Some banks I know also pay some companies to hack their website in order to know how good their security measures are. On a daily basis, since it is a financial institution, what they need to do is to keep improving their security measures, and may be that is what we are proposing that if their database can be secured bio-metrically, security breaches will be minimal if not eradicated.”
        
Furthermore, the Russian firm disclosed that the Silence group is one of the most active Advanced Persistent Threat (APT) actors, which has carried out a number of successful campaigns targeting banks and financial organisations around the globe.
   
According to it, the typical scenario of the attack begins with a social engineering scheme, as attackers send a phishing e-mail that contains malware to a bank employee. From there the malware gets inside the banks’ security perimeter and lays low for a while, gathering information on the victim organisation by capturing screenshots and making video recordings of the day to day activity on the infected device, learning how things work in the targeted banks.

Once attackers are ready to take action, they activate all capabilities of the malware and cash out using, for example, ATMs. The score sometimes reaches millions of dollars.
   
The attacks detected began in the first week of January 2020 and indicated that the threat actors are about to begin the final stage of their operation and cash out the funds. To date, the attacks are ongoing and persist in targeting large banks in several SSA countries.