Banks and other financial institutions in a number of West African countries have been targeted by cyber criminals employing a range of commodity malware and living off the land tools.

The attacks have been underway since at least mid-2017. To date, organizations in Cameroon, Congo (DR), Ghana, Equatorial Guinea, and Ivory Coast have been affected.

Who is behind these attacks remains unknown. They could be the work of a single group or, more likely, several different groups employing similar tactics.

Four types of attacks

Symantec has observed four distinct attack campaigns directed against financial targets in Africa. The first has been underway since at least mid-2017 and has targeted organizations in Ivory Coast and Equatorial Guinea. The attackers infected victims with commodity malware known as NanoCore (Trojan.Nancrat) and were also observed using PsExec, a Microsoft Sysinternals tool used for executing processes on other systems, on infected computers. Lure documents used by the attackers referred to a West African bank which has operations in several countries in the region. Some tools used in these attacks are similar to tools mentioned in a 2017 SWIFT alert, indicating the attackers may have been attempting to perform financial fraud.

The second type of attack began in late 2017 and targeted organizations in Ivory Coast, Ghana, Congo (DR), and Cameroon. The attackers used malicious PowerShell scripts to infect their targets and also used the credential-stealing tool Mimikatz (Hacktool.Mimikatz). They also made use of UltraVNC, an open-source remote administration tool for Microsoft Windows. The attackers then infected computers with the commodity malware known as Cobalt Strike (Trojan.Agentemis) which is capable of opening a backdoor on the computer, communicating with a command and control (C&C) server, and downloading additional payloads. Communication with the C&C server was handled by dynamic DNS infrastructure, which helped shield the location of the attackers.

The third type of attack was directed against an organization in Ivory Coast. This organization had also been targeted by the second campaign. This second attack also involved the use of commodity malware, in this case the Remote Manipulator System RAT (Backdoor.Gussdoor), alongside Mimikatz and two custom Remote Desktop Protocol (RDP) tools. Since Mimikatz can be used to harvest credentials and RDP allows for remote connections to computers, it’s likely the attackers wanted additional remote access capability and were interested in moving laterally across the victim’s network.

The fourth type of attack began in December 2018 and was directed against organizations in Ivory Coast. The attackers used off-the-shelf malware known as Imminent Monitor RAT (Infostealer.Hawket).

How the attacks were uncovered

All four attack types were first discovered through alerts generated by Symantec’s Targeted Attack Analytics (TAA). TAA leverages advanced artificial intelligence to analyze Symantec’s data lake of telemetry in order to spot patterns associated with targeted attacks.

A growing number of attackers in recent years are adopting “living off the land” tactics—namely the use of operating system features or network administration tools to compromise victims' networks. By exploiting these tools, attackers hope to hide in plain sight, since most activity involving these tools is legitimate. However, in each case, a TAA alert was triggered by the attackers maliciously using a legitimate tool. In short, the attackers' use of living off the land tactics led to the discovery of their attacks.

Common threads

Whether the attacks were the work of one or more groups remains unknown. However, they share some commonalities in terms of the tools and tactics employed. Any malware used was off-the-shelf, commodity malware: Cobalt Strike, Imminent Monitor RAT, NanoCore RAT, Remote Manipulator System RAT, and Mimikatz.

Additionally, most of the attacks leveraged living off the land tactics, making use of tools such as PowerShell, PsExec, UltraVNC, and RDP.

Commodity malware is readily available on the cyber underground. While it may not be as powerful or stealthy as custom-developed tools, it does add a certain level of anonymity to attacks, making it harder to link attacks together and attribute them to any one group of attackers.

Globalization of cyber crime

Until now, Symantec has seen relatively little evidence of these kinds of attacks against the financial sector in West Africa. However, it now appears that there is at least one (and quite possibly more) groups actively targeting banks in the region.

Protection/Mitigation

Symantec has the following protection in place to protect customers against these attacks:

File-based protection

• Trojan.Nancrat
• Trojan.Agentemis
• Infostealer.Hawket
• Backdoor.Gussdoor
• Hacktool.Mimikatz

Indicators of Compromise

The following list of indicators of compromise is related to African banking attacks. It is likely that these indicators are used by multiple different actors.

The first attack type

Files 

Infrastructure

The second attack type

Files

 Infrastructure

The third attack type

Files

The fourth attack type

Files

Infrastructure