Connect with us

E-Financial

Kaspersky Exposes How Hackers ‘Lazarus Group’ Terrorise Banks

Published

on

kasp.jpg
Kindly share this post

The results of its more-than-year-long investigation into the activity of ‘Lazarus’, a notorious hacking group allegedly responsible for the theft of 81 million dollars from the Central Bank of Bangladesh in 2016 has been disclosed by Kaspersky Lab.

During the forensic analysis of artefacts left by the group in South-East Asian and European banks, Kaspersky Lab has reached a deep understanding of what malicious tools the group uses and how it operates while attacking financial institutions, casinos, software developers for investment companies and crypto-currency businesses around the world.

This knowledge has helped to interrupt at least two other operations which had one goal – to steal a large amount of money from financial institutions.

In February 2016, a group of hackers (unidentified at that time) attempted to steal $851 million USD, and managed to transfer 81 million USD from the Central Bank of Bangladesh. This is considered to be one of the largest, most successful cyber heists ever.

Further investigation conducted by researchers from different IT security companies including Kaspersky Lab revealed a high chance that the attacks were conducted by Lazarus – a notorious cyber espionage and sabotage group responsible for a series of regular and devastating attacks, and known for attacking manufacturing companies, media and financial institutions in at least 18 countries around the world since 2009.

Although several months of silence followed the Bangladesh attack, the Lazarus group was still active. They had been preparing for a new operation to steal money from other banks and, by the time they were ready, they already had their foot in a financial institution in South East Asia. After being interrupted by Kaspersky Lab products and the following investigation, they were set back for another few months, and later decided to change their operation by moving to Europe. But here too, their attempts were interrupted by Kaspersky Lab’s security software detections, as well as the quick incident response, forensic analysis, and reverse engineering with support from company’s top researchers.

Lazarus Formula
Based on the results of the forensic analysis of these attacks, Kaspersky Lab researchers were able to reconstruct the modus operandi of the group.

Initial compromise: A single system inside a bank is breached either with remotely accessible vulnerable code (i.e. on a webserver) or through a watering hole attack through an exploit planted on a benign website. Once such a site is visited, the victim’s (bank employee) computer gets malware, which brings additional components.

Foothold established: Then the group migrates to other bank hosts and deploys persistent backdoors – the malware allows them to come and go whenever they want.

Internal reconnaissance: Subsequently the group spends days and weeks learning the network, and identifying valuable resources. One such resource may be a backup server, where authentication information is stored, a mail server or the whole domain controller with keys to every “door” in the company, as well as servers storing or processing records of financial transactions.

Deliver and steal: Finally, they deploy special malware capable of bypassing the internal security features of financial software and issuing rogue transactions on behalf of the bank.

Geography and Attribution
The attacks investigated by Kaspersky Lab researchers lasted for weeks. However, the attackers could operate under the radar for months.

For example, during the analysis of the incident in South-East Asia, experts discovered that hackers were able to compromise the bank network no less than seven months prior to the day when the bank’s security team requested incident response. In fact, the group had access to the network of that bank even before the day of the Bangladesh incident.

According to Kaspersky Lab records, from December 2015, malware samples relating to Lazarus group activity appeared in financial institutions, casinos software developers for investment companies and crypto-currency businesses in Korea, Bangladesh, India, Vietnam, Indonesia, Costa Rica, Malaysia, Poland, Iraq, Ethiopia, Kenya, Nigeria, Uruguay, Gabon, Thailand and several other countries.

The latest samples known to Kaspersky Lab were detected in March 2017, showing that attackers have no intention of stopping.

Even though attackers were careful enough to wipe their traces, at least one server they breached for another campaign contained a serious mistake with an important artefact being left behind. In preparation for operation, the server was configured as the command & control center for the malware.

The first connections made on the day of configuration were coming from a few VPN/proxy servers indicating a testing period for the C&C server. However, there was one short connection on that day which was coming from a very rare IP address range in North Korea.

According to researchers, that could mean several things:

The attackers connected from that IP address in North Korea.

It was someone else’s carefully planned false flag operation.

Someone in North Korea accidentally visited the command and control URL.

The Lazarus group heavily invests in new variants of their malware. For months they were trying to create a malicious toolset which would be invisible to security solutions, but every time they did this, Kaspersky Lab’s specialists managed to identify unique features in how they create their code, allowing Kaspersky Lab to keep tracking the new samples. Now, the attackers have gone relatively quiet, which probably means that they have paused to rework their arsenal.

“We’re sure they’ll come back soon. In all, attacks like the ones conducted by Lazarus group show that a minor misconfiguration may result in a major security breach, which can potentially cost a targeted business hundreds of millions of dollars in loss. We hope that chief executives from banks, casinos and investment companies around the world will become wary of the name Lazarus,” said Vitaly Kamluk, Head of Global Research and Analysis Team APAC at Kaspersky Lab.

The company is also releasing crucial Indicators of Compromise (IOC) and other data to help organisations search for traces of these attack groups in their corporate networks.

“We urge all organisations to carefully scan their networks for the presence of Lazarus malware samples and, if detected, to disinfect their systems and report the intrusion to law enforcement and incident response teams”, added Vitaly Kamluk.

 

 


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Financial

Court Affirms CBN’s Exclusive Ownership of eNaira Trademark

Published

on

Kindly share this post

A Federal High Court in Abuja has affirmed the Central Bank of Nigeria’s (CBN) exclusive ownership of the “eNaira” digital currency platform and trademark.

Court Affirms CBN’s Exclusive Ownership of eNaira Trademark

eNaira

Justice James Omotosho, in a judgment delivered on Friday, restrained eNaira Payment Solutions Limited from presenting itself as the owner of the “eNaira” trademark.

The court also ordered the company to immediately adopt a new name that does not contain the word “Naira”.

The suit, marked FHC/ABJ/CS/113/2021, was dismissed, while the court awarded N10 million costs in favour of the CBN following its successful counterclaim.

Justice Omotosho held that although the company had been registered with the Corporate Affairs Commission (CAC) since 2004, its name was misleading because of its close association with Nigeria’s sovereign currency.

“The name chosen by the plaintiff on its incorporation is in the circumstances unregistrable due to the misleading nature of the name, which suggests government patronage,” the judge ruled.

The court further noted that the Trademark Registry had, through a letter dated Nov. 15, 2021, withdrawn approvals earlier granted to the company for applications related to the “eNaira” trademark under classes 36 and 42.

According to the judgment, the company was informed that “eNaira is a national intellectual property and constitutes a symbol and national asset of Nigeria.”

Justice Omotosho ruled that the plaintiff had no superior legal claim to the trademark and therefore could not seek injunctive relief against the CBN.

“A party that has no legal right cannot be entitled to an injunction. The purport of this is that, prima facie, the plaintiff has no valid trademark to the exclusive use of the eNaira trademark,” he held.

The judge also emphasised that under Section 852(2) of the Companies and Allied Matters Act, the CAC has powers to reject or direct changes to company names that suggest government affiliation.

“The ‘eNaira’ name is so closely linked to the legal tender of Nigeria, which is exclusively controlled by the CBN.

“An average person on the street is most likely to think that the plaintiff is an agent of the Federal Government or the CBN,” the court stated.

Justice Omotosho added that the company’s proposed activities involving digital currency operations created the impression that it had official authority to issue or manage a digital version of the naira.

“The proposed business of the plaintiff… no doubt creates the impression that the plaintiff has the authority of the Federal Government of Nigeria to issue and control a digital form of the Naira,” he said.

The judge warned that allowing a private entity to control the “eNaira” name could undermine public confidence and create confusion within the country’s financial system.

“Any digital currency with the name ‘eNaira’ will no doubt create the impression that it is an official digital form of the Naira.

“This would be disastrous for the Nigerian economy and will create skepticism among users, as it is not guaranteed by the Central Bank of Nigeria,” he added.

The court also observed that the CAC had lawfully directed the company to change its name within six weeks of its Dec. 9, 2021 directive, but the company failed to comply.

During proceedings, counsel to the plaintiff, Mr David Ityonyman, argued that the word “Naira” was not exclusive to Nigeria and should not be monopolised.

“Nothing stops India from having a Naira. Also, countries like the U.S. and Canada make use of dollars. None of them has laid claim to the name,” he submitted.

He further argued that the company had used the “Naira” branding internationally for more than two decades before the CBN launched the eNaira platform in 2021.


Kindly share this post
Continue Reading

E-Financial

CBN to Simplify Bank Alerts over Rising Customer Complaints

Published

on

Kindly share this post

Central Bank of Nigeria (CBN) and commercial banks are reviewing the large number of transaction alerts sent to customers and the complaints about bank charges.

CBN to Simplify Bank Alerts over Rising Customer Complaints

So called bank alert refers to real-time SMS or email notifications from your financial institution about transactions, balances, or security updates.

Olayemi Cardoso, governor, CBN, said this in Abuja after the 305th Monetary Policy Committee meeting.

He explained that many bank customers are confused because they receive too many debit alerts for a single transaction.

To address this, the CBN has created a quarterly meeting system involving its consumer protection team, commercial banks, and the top 10 microfinance banks. The goal is to resolve customer complaints faster and improve banking services.

Cardoso said one major issue being studied is how banks send multiple notifications for one transaction.African Politics Analysis

He said this often confuses customers and suggested that alerts should be simplified and combined so people can clearly understand what each debit is for.

He added that the issue is still being worked on and solutions will be proposed soon.

On the N50 stamp duty charge, the CBN governor explained that it is not a bank charge.

He said the charge comes from tax authorities, while banks only collect it and send it to the government.

He advised customers who notice wrong charges to first complain to their bank. If the issue is not resolved, they can escalate it to the CBN’s consumer protection department.

Cardoso also said the CBN has strengthened its monitoring system to ensure banks handle complaints properly, compensate customers when needed, and improve customer service.

The CBN is also reviewing how banks apply rules on charges and customer complaints, with the aim of improving transparency and reducing repeated issues in the banking system.

 


Kindly share this post
Continue Reading

E-Financial

Griffin Capital Group Launches Integrated Financial Services Group Positioned to Strengthen Capital Formation in Nigeria, Africa

Published

on

Kindly share this post

Griffin Capital Group Limited has announced its official market entry as a fully integrated financial services group, bringing together investment banking, asset management, trusteeship, lending, and insurance capabilities under a unified institutional platform.

The launch reflects a deliberate response to the evolving demands of Nigeria’s financial ecosystem, where the need for disciplined capital deployment, stronger Corporate Governance frameworks, and deeper market liquidity continues to shape the next phase of growth.

Structured as a multi-business financial services group, Griffin Capital is designed to operate across the full spectrum of capital formation, from origination through innovatively structuring complex financial transactions in a simplified manner; to execution, distribution, and investment management. This enables us to both advise on and actively participate in transactions.

The Group enters the market with a leadership team whose experience spans investment banking, Insurance brokerage, capital markets, corporate finance, development finance, and investment management across Africa and global financial centers.

Griffin Capital’s operating model reflects a clear emphasis on institutional discipline, combining advisory expertise with balance sheet strength to support more efficient capital allocation and improved transaction quality.

As Nigeria’s economic reforms continue to unlock new opportunities across infrastructure and project finance, financial advisory, and private capital markets; the Group is positioned to support both issuers and investors through a structure designed for scale, transparency, and execution.

Commenting on the launch, the Group Chief Executive Officer, Babatunde Obaniyi said: “The opportunity in Nigeria’s financial markets is significant, but unlocking it requires more than capital. It requires structure, governance, and the ability to deploy capital with discipline. Griffin Capital Group has been built to address these fundamentals. Our model allows us to operate across the full lifecycle of transactions from advisory to execution, while maintaining a strong focus on risk management and long-term value creation.

“We are entering the market with a clear sense of responsibility, particularly in how capital is structured, deployed, and preserved. Our ambition is to build an institution that contributes meaningfully to market development while maintaining the highest standards of governance and execution.”

The Chairman of the Group, Musa Bello added: “Financial institutions play a critical role in shaping economic outcomes, particularly in emerging markets where capital must be deployed with both precision and purpose. Griffin Capital Group represents a long-term commitment to building an institution that combines local market understanding with global standards of governance and execution.

“As Nigeria continues to deepen its capital markets and expand private sector participation, institutions with the capacity to structure, mobilize, and manage capital effectively will be essential. Our focus is not only on participating in this evolution, but on contributing to it in a meaningful and sustainable way.”

With a medium-to-long-term strategy focused on growth in assets under management and expanded participation across key sectors, Griffin Capital Group intends to play an active role in facilitating capital flows within Nigeria and across the African continent.

The Group’s integrated platform is expected to support a broad range of clients, including retail, corporates, institutional investors, development finance institutions, government institutions, and high-net-worth individuals, through tailored financial solutions and disciplined execution.


Kindly share this post
Continue Reading

Trending