Business Culture Security Society Software

Kaspersky uncovers new Grandoreiro light variant, the threat also expands to Asia and Africa

Despite the arrest of important operators in early 2024, Grandoreiro continues to be used by its partners in new campaigns. Kaspersky Global Research and Analysis team (GReAT) (www.Kaspersky.co.za) has discovered a new light version focused on Mexico targeting around 30 banks. These findings are to be highlighted at the Security Analyst Summit (SAS) 2024. Remaining one of the most active threats globally and targeting users of more than 1,700 banks, Grandoreiro variants account for around five percent of banking trojan attacks this year.  Mexico is one of the most targeted countries by various Grandoreiro strains, including the new light version, seeing 51,000 recorded incidents this year.

 

Kaspersky data indicates Grandoreiro has been active since 2016. In 2024, the threat targets more than 1,700 financial institutions and 276 cryptocurrency wallets across 45 countries and territories, lastly adding Asia and Africa to the list of its targets, making it a truly global financial threat. Among countries affected in Africa are Algeria, Angola, Ethiopia, Ghana, Ivory Coast, Kenya, Mozambique, Nigeria, South Africa, Tanzania, Uganda.

After assisting an INTERPOL-coordinated action, which has led to Brazilian authorities arresting (http://apo-opa.co/3BUqgrb) operators behind a Grandoreiro banking trojan operation, Kaspersky discovered that the group’s codebase has been split into lighter, fragmented versions of the trojan, to continue its attacks. Recent analysis has identified a specific light version focused primarily on Mexico, which has been used to target approximately 30 financial institutions. The creators likely have access to the source code and are launching new campaigns using the simplified legacy malware.

“All the recent developments underscore the evolving nature of the threat. Fragmented and lighter versions may represent a trend that could extend beyond Mexico and into other regions, including beyond Latin America. However, we believe that only some trusted affiliates have access to the malware source code to develop such lighter versions. Grandoreiro operates differently from the traditional ‘Malware-as-a-Service’ model we are accustomed to. You won’t find announcements on underground forums selling the Grandoreiro package; instead, access to it appears to be limited,” explains Fabio Assolini, head of the Latin American (GReAT) at Kaspersky.

Grandoreiro has a large and complex structure, which would make it easier for security tools or analysts to detect if its strings were not encrypted

Multiple variants of Grandoreiro, including the new light version and the primary malware, accounted for approximately five percent of global banking trojan attacks detected by Kaspersky in 2024, making it one of the most active threats worldwide. Kaspersky has also analysed the newer samples of the primary Grandoreiro from 2024, and observed new tactics. It records mouse activity to mimic real user patterns, aiming to evade detection by machine learning-based security systems that analyse behaviour. By replaying natural mouse movements, the malware aims to trick anti-fraud tools into seeing the activity as legitimate.

Additionally, Grandoreiro has adopted a cryptographic technique known as Ciphertext Stealing (CTS), which Kaspersky has never seen being used in malware. In this case, its aim is to encrypt the malicious code strings. “Grandoreiro has a large and complex structure, which would make it easier for security tools or analysts to detect if its strings were not encrypted. This is likely why they introduced this new technique – to complicate the detection and analysis of their attacks,” Fabio Assolini elaborated.

To protect from financial malware, Kaspersky security experts recommend organisations to:

  • Enable a Default Deny policy for critical user profiles, particularly those in financial departments; this ensures that only legitimate web resources can be accessed.
  • Provide cybersecurity awareness training (http://apo-opa.co/4e3nlKa) to staff, especially to employees responsible for accounting, that includes instructions on how to detect phishing pages.
  • Use protection solutions for mail servers with anti-phishing capabilities such as Kaspersky Security for Mail Server, to decrease the chance of infection through a phishing email.

 

While banks should educate its customers, individuals are advised to:

  • Never open links or documents included in unexpected or suspicious-looking messages. Be attentive to web pages – from the right web address to details of interface.
  • Use a reliable security solution, such as Kaspersky Premium (http://apo-opa.co/4dWrbEW), that protect digital assets from a wide range of financial cyberthreats.
  • Install only applications obtained from reliable sources.
  • Refrain from approving rights or permissions requested by applications without first ensuring they match the application’s feature set.
  • Install the latest updates and patches for all software used.

 

Read more on Securelist (http://apo-opa.co/3C4N5bD). The comprehensive Grandoreiro analysis and overview is to be presented by GReAT at Kaspersky’s sixteenth Security Analyst Summit (SAS) (http://apo-opa.co/3BPHtly), which takes place from October 22-25, 2024, in Bali.

Leave a Comment

Your email address will not be published.

You may also like

Business Energy

NNPC Ltd Secures 10-Year Gas Supply Agreement with Dangote Refinery

post-image

 

In a significant development for Nigeria’s industrial sector, the Nigerian National Petroleum Company (NNPC) Limited, through its subsidiary, NNPC Gas Marketing Limited (NGML), has successfully executed a Gas Sale and Purchase Agreement (GSPA) with Dangote Petroleum Refinery and Petrochemicals FZE. The agreement, signed by Barr. Justin Ezeala, Managing Director of NGML, and Aliko Dangote, President/CEO of the Dangote Group, took place at Dangote’s Corporate Head Office in Falomo, Lagos State.

The 10-year deal will see NGML supply Dangote Refinery with 100 million standard cubic feet per day (MMSCF/D) of natural gas, which will serve both as power generation fuel and as feedstock for the refinery’s operations in Ibeju-Lekki, Lagos State. The agreement outlines that 50 MMSCF/D will be a firm supply, with the remaining 50 MMSCF/D allocated as interruptible natural gas supply.

This strategic partnership aligns with President Bola Ahmed Tinubu’s policy to harness Nigeria’s vast gas resources to boost industrial…

Read More
Business Economy Gadgets Government Society Software

NITDA Director General Emphasizes Cybersecurity Governance at Jaiz Bank Board Meeting

post-image

 

In response to growing global cyber threats, Kashifu Inuwa Abdullahi, Director General of the National Information Technology Development Agency (NITDA), delivered an essential presentation on cybersecurity to the Board of Directors at Jaiz Bank’s headquarters in Abuja. Addressing the board’s role in strengthening cybersecurity governance, Abdullahi focused on critical areas such as risk management, resource allocation, and readiness to counter cyber attacks within the financial sector.

During his presentation, Abdullahi highlighted the Nigerian government’s ongoing efforts to secure digital assets through the National Cybersecurity Architecture, overseen by the Office of the National Security Adviser. This initiative underscores a national commitment to fortifying the country’s cyber defenses in the face of increasing threats.

Quoting renowned investor Warren Buffett, Abdullahi emphasized the value of a bank’s reputation, warning, “It takes 20 years to build a reputation and only a few minutes of cyber-incident to ruin it.” He urged the board to prioritize cybersecurity…

Read More
Announcements Business Investments Society Software Sponsored Technology Trends

Feature: CodeFest International Launches Ebonyi Hackathon to Drive Tech Innovation in Ebonyi State

post-image

 

As technology continues to reshape industries and societies across Nigeria, CodeFest International is stepping up to bring this transformation to Ebonyi State with the launch of the Ebonyi Hackathon. This groundbreaking event is designed to spark innovation, cultivate talent, and address local challenges by fostering a tech-forward ecosystem in the region. We spoke with the organizers to gain insight into what inspired this initiative, their goals, and the future of the Ebonyi Hackathon.

Inspiring Innovation and Economic Growth

According to the organizers, the Ebonyi Hackathon is driven by a clear vision: to nurture a culture of innovation and entrepreneurship in Ebonyi State. “The hackathon was inspired by the need to foster technological advancement, enhance skill development, and support economic growth within the region,” they explained. By bringing together developers, designers, and entrepreneurs, the event aims to tackle real-world problems while creating opportunities for tech-savvy youths to contribute solutions that impact their…

Read More
Business Culture Economy

Charles Uche Emembolu, Founder of Dexude, Reflects on Nigeria’s Innovation Growth at 5th ISN Annual Gathering 2024

post-image

 

The 5th ISN Annual Gathering held in Uyo, Akwa Ibom, this month marked a significant milestone in the development of Nigeria’s innovation ecosystem. The event, with the theme “Scaling Together: Building a Collaborative Culture for Nigerian Innovation,” was an opportunity to reflect on the progress made and look ahead at the ambitious goals for the future.

Charles Uche Emembolu, Founder of Dexude and Chairman of the Innovation Support Network (ISN) Board, expressed pride in the accomplishments of the network since its inception in 2019. Emembolu highlighted the impressive growth of ISN, which now supports 207 innovation hubs across 30 states, up from 75 in its early years. The network has also been instrumental in supporting over 5,000 new businesses annually and impacting the lives of more than 42,000 beneficiaries, including youth, women, and people with disabilities.

“We’ve come a long way, and this year’s gathering is a testament to the power…

Read More
Business Culture Economy Environment

CIF Announces Historic Climate Finance Milestone with CCMM Listing on London Stock Exchange at COP29

post-image

 

 

Tariye Gbadegesin, Chief Executive Officer of the Climate Investment Funds (CIF), today joined UK Prime Minister Keir Starmer and World Bank President Ajay Banga at COP29 to unveil a groundbreaking achievement for climate finance. The CIF Capital Market Mechanism (CCMM) has been officially listed on the London Stock Exchange, marking a global first in climate finance.

This new initiative represents CIF’s most ambitious step yet to mobilize private capital for high-impact clean energy and technology investments, particularly in developing countries and emerging economies. CCMM will empower CIF to unlock the potential of capital markets and drive substantial climate investments worldwide.

“We are proud to take this major leap forward in mobilizing climate finance at scale,” said Gbadegesin. “Bold and creative solutions are essential to tap into private finance, and this listing is a testament to the potential of capital markets in addressing the climate crisis. Our goal is to ensure that…

Read More
Business Economy Finance Fintech

Singapore-based TransferTo and Pan-African Ecobank Group Forge Strategic Partnership to Expand Financial Access and Cross-Border Payments Across Africa

post-image

ransferTo (www.TransferTo.com), a  Singapore-based global technology group, and Ecobank Group (https://Ecobank.com), the leading pan-African financial institution, announce a landmark Memorandum of Understanding (MOU), laying the groundwork to transform financial access and cross-border payment solutions across Africa.

 

This strategic partnership brings together TransferTo’s companies —  Thunes (www.Thunes.com), Ezra (https://Ezra.world), DT One (www.DTOne.com) and Tookitaki (www.Tookitaki.com) – with Ecobank (https://Ecobank.com) to expand access to credit, digital products and cross-border payment solutions. The collaboration will create a safe, inclusive financial ecosystem that bridges markets, enabling swift reliable payments across borders and offers financial empowerment tools to millions of Africans and businesses.

By uniting their expertise, TransferTo and Ecobank will drive financial inclusion, empower underserved communities, and establish secure, seamless digital pathways that connect Africa’s economies with the rest of the world.

Peter De Caluwe,…

Read More
Business Economy

Gwandu Urges African Countries to Unite for 600MHz Mobile Spectrum Allocations

post-image

Dr. Bashir Gwandu, former Acting Executive Vice Chairman and CEO, Nigerian Communications Commission (NCC) and former EVC/CEO, National Agency for Science and Engineering Infrastructure (NASENI), has urged African countries to unite and work  together to secure 600 megahertz (MHz) band mobile spectrum allocations.

 The independent telecom expert stated this at the just concluded 9th Sub-Sahara Spectrum Management Conference 2024, held in Nairobi, Kenya on 6-7 November, organised by Forum Global on the third theme: “From WRC-23 to WRC-27- Emerging Landscapes  & Technologies and the Path Ahead.”

Dr. Gwandu who held various chairmanship positions at the both the ITU and Commonwealth including the ITU Radiocommunications Advisory Group (the RAG), The Joint Task Group, and Commonwealth ITU Group (CIG), made the call during his opening remarks on the 600MHz spectrum discussions.

While making a presentation on the session: “The shape of Post-WRC spectrum ecosystems”, he called for…

Read More
Announcements Business Featured International Opinion Society

Moppets Baby Food Achieves HACCP Certification, Setting New Standards in Food Safety

post-image

 

In a significant milestone for Moppets Baby Food, Engr. Roberta Edu, CEO of the popular children’s food brand, recently announced their achievement of HACCP certification—a globally recognized food safety standard. Moppets, a subsidiary of Frills by Roberta, achieved this certification after rigorous assessments and audits, underscoring their commitment to quality and safety.

Edu shared the journey behind this accomplishment: “If you follow our Moppet Foods story closely, one thing you’re going to take away is how daring we’ve been over the years and how committed we are to excellence.” She recalled that upon learning the brand needed HACCP certification to supply to a specific NGO, the challenge initially appeared daunting. However, her determination turned that challenge into a goal, setting the company on a path toward stringent safety compliance.

 

Moppet Foods undertook comprehensive audits…

Read More