E-Business
Kaspersky Reports Over a Third of Banking Malware Attacks in 2019 Targeted Corporate Users
In 2019, 773,943 users of Kaspersky solutions globally were attacked by banking Trojans. Of those users, a third (35.1%) were in the corporate sector. African countries were affected too: almost every hundredth user (varying from 0,9 to 1%) in South Africa, Ethiopia, Nigeria and Kenya was attacked by banking Trojans at least once during the past year, yet the share of affected corporate users varied greatly in these countries. This is among the findings from Kaspersky’s analysis of the financial threat landscape.
Banking Trojans or ‘bankers’ are one of the most widespread tools for cybercriminals as they focus on stealing money. Bankers usually search for users’ credentials for e-payment and online banking systems, hijacking one-time passwords, and then passing that data to the attackers.
A third of these attacks in 2019 targeted corporate users, an increase from the figure (24%-25%) that has remained fairly consistent for the previous three years. According to experts, the rationale of this is clear: attacks on the B2B sector could not only provide access to banking or payment system accounts, but, through employee exposure, could also compromise a company’s financial resources.
The collected data also shows that Ethiopia has the largest share of corporate users among those who are targeted by banking malware in African regions – it reached 71% in 2019, which means that almost two thirds of banking malware attacks in the country were aimed at the corporate sector.
It is followed by South Africa, where this figure is significantly smaller and can be compared to the global number, reaching 30%. Kenya and Nigeria, however, saw this parameter being lower than average, with approximately a fifth (22,5%) of banking malware attacks in Kenya targeting corporate devices, compared to 13% in Nigeria.
“While the overall number of attacks with bankers decreased in 2019, the growing interest for corporate users’ credentials indicates we are not yet seeing respite from financial threats. We therefore ask everyone to stay cautious when conducting financial operations online from PCs.
“While we are in the current peak of remote working during the Coronavirus pandemic, it is especially important to not underestimate criminals’ desire for stealing money,” said Oleg Kupreev, security expert at Kaspersky.
The key findings of the report are:
Phishing: – In 2019, the share of financial phishing increased from 44.7% of all phishing detections to 51.4%.
– Almost every third attempt to visit a phishing page blocked by Kaspersky products was related to banking phishing (27%).
– The share of phishing-related attacks on payment systems and online stores accounted for almost 17% and over 7.5% respectively in 2019. This is more or less the same as 2018 levels.
– The share of financial phishing encountered by Mac users fell slightly, accounting for 54%.
Banking malware (Windows): – In 2019, the number of users attacked with banking Trojans was 773,943 – a decrease compared to the 889,452 attacked in 2018.
– 35.1% of users attacked with banking malware were corporate users – an increase from 24.1% in 2018.
– Users in Russia, Germany, and China were attacked most frequently by banking malware.
Android banking malware:
– In 2019, the number of users that encountered Android banking malware dropped to just over 675,000 from around 1.8 million.
– Russia, South Africa, and Australia were the countries with the highest percentage of users attacked by Android banking malware.
Threats targeting businesses, such as banking Trojans and financial phishing, can and should be detected and blocked on a network level – even before they reach employee’s endpoints. In particular, the use of a secure Internet gateway solution like Kaspersky Security for Internet Gateway, ensures secure Internet traffic and transactions and prevents many types of malware and threats.
Kaspersky solution has received positive honest customer feedback and been named a 2020 ‘Customers’ Choice for Secure Web Gateways’, according to Gartner Peer Insights Customers’ Choice.
In addition to this, Kaspersky experts advise businesses take the following measures against financial threats:
– Invest in regular cybersecurity awareness training for employees to educate them not to click on links or open attachments received from untrusted sources. Conduct a simulated phishing attack to ensure that they know how to distinguish phishing emails.
– Leverage advanced detection and response technologies, such as Kaspersky Endpoint Detection and Response – part of the Threat Management and Defense solution. It makes it possible to catch even unknown banking malware and gives security operation teams full visibility over the network and response automation.
– Use mobile protection solutions or corporate Internet traffic protection to ensure employees’ devices are not exposed to financial and other threats. The last one helps protect even those devices for which an anti-virus is not available
– Provide your security operation center team with access to Threat Intelligence so it remains up to date with the latest tactics and tools used by cybercriminals.
Chinese “threat actors” have hacked Microsoft’s SharePoint document software servers and targeted the data of the businesses using it, the firm has said.
China state-backed Linen Typhoon and Violet Typhoon as well as China-based Storm-2603 were said to have “exploited vulnerabilities” in on-premises SharePoint servers, the kind used by firms, but not in its cloud-based service.
The US tech giant has released security updates in response and has advised all on-premises SharePoint server customers to install them.
“Investigations into other actors also using these exploits are still ongoing,” Microsoft said in a statement.
The firm said it had “high confidence” the hackers would continue to target systems which have not installed its security updates.
It added that it would update its website blog with more information as its investigation continues.
Microsoft said it had observed attacks in which hackers had sent a request to a SharePoint server “enabling the theft of the key material by threat actors”.
Charles Carmakal, chief technology officer at Mandiant Consulting firm, a division of Google Cloud, told reporter, it was “aware of several victims in several different sectors across a number of global geographies”.
Carmakal said it appeared that governments and businesses that use SharePoint on their sites were the primary target.
A number of adversaries who stole material encoded by cryptography were then able to regain ongoing access to the victims’ SharePoint data, he said.
“This was exploited in a very broad way, very opportunistically before a patch was made available. That’s why this is significant,” Carmakal said.
Carmakal said the “China-nexus actor” was deploying techniques similar to previous campaigns associated with Beijing.
Microsoft said Linen Typhoon had “focused on stealing intellectual property, primarily targeting organizations related to government, defence, strategic planning, and human rights” for 13 years.
It added that Violet Typhoon had been “dedicated to espionage”, primarily targeting former government and military staff, non-governmental organizations, think tanks, higher education, the media, the financial sector and the health sector in the US, Europe, and East Asia.
Meanwhile, Storm-2603 was “assessed with medium confidence to be a China-based threat actor”.
National Identity Management Commission (NIMC) has issued a public warning that it is not associated with NINcard.com.
According to the commission, the website has been circulating online to offer services for Nigerians seeking National Identification Number (NIN) services.
NIMC, in a post on its official X account on Wednesday, said, “NINcard.com is not in anyway affiliated to NIMC. Stay vigilant!”
The warning was accompanied by screenshots of fake payment receipts and OTP request pages from the website, both of which were boldly stamped “FAKE” by NIMC to alert the public.
National Information Technology Development Agency (NITDA), in partnership with the Advocacy for Policy and Innovation (API), has convened a one-day workshop in Abuja to advance dialogue on the draft Online Harm Protection (OHP) Bill to confront harmful online content.
The bill, a rights-based, locally rooted, and multi-stakeholder initiative, is aimed at addressing the challenges of the digital age.
The event, which held yesterday, brought together government officials, civil society, academics, digital platforms, and legal experts to shape a policy framework designed to combat online ills such as cyberbullying, disinformation, hate speech, digital exploitation, and gender-based violence, while safeguarding democratic freedoms and digital inclusion.
In his keynote remarks, Kashifu Inuwa, director general, NITDA urged a paradigm shift in the way society engages with digital technologies.
“For almost two decades, we have viewed digital technology through a consumer lens. But these technologies are not just products and services. They are transforming how we live, work, and interact. They shape our politics, our society, and our democracy,” he said.
Warning against unaccountable digital power in the hands of private corporations, the DG likened the digital journey to the tale of Alice in Wonderland, where initial fascination with innovation has given way to deeper concerns about privacy, autonomy, and manipulation by big tech platforms.
“We thought we were using Google, but now we realise Google is using us. Social media, once a tool of expression, has become a tool of surveillance and influence,” Inuwa noted.
He, therefore, emphasised the urgency of developing a democratic and accountable framework. He explained that following the 2021 Twitter ban, NITDA facilitated dialogue between the government and platform operators, leading to a Code of Practice that stressed Nigeria’s sovereignty and legal standards.
According to him, the same process birthed the multi-stakeholder steering committee and the OHP White Paper in December 2024, laying the foundation for the current legislative push.
Earlier in her opening remarks, Victoria Manya, co-founder, API, observed the moral and civic necessity of the bill.
Her words: “The internet did not break society, it merely revealed its unfiltered version. Every day, Nigerians are exposed to harassment, disinformation, exploitation, and even algorithmic violence. The OHP Bill is not a war on the Internet. It is a peace offering to its users, a social contract for a digital future that is safe, inclusive, and democratic.
“We cannot answer the question of algorithmic power with unchecked state control. We must answer it with shared, rights-based governance. This bill must not be written for the people, but with them.”
Guinness Nigeria Sustains Growth Momentum in Q4 Amid Market Headwinds
Moody’s Upgrades Ecobank’s Outlook to Stable
Airtel Africa Grew Customer Base to 169m as Q1 Revenue Hits $1.4 Billion
SEC Grants “No objection” to N323Bn First Holdco Shares Deal
FintechNGR Rejigs Nigeria Fintech Week with Multi-location Model
E-Financial2 days agoKuda Unveils New Wallet for Multiple Currencies
Telecom2 days agoTelcos Resume SIM Card Sales after 2-Week Halt
Telecom2 days agoNigeria, Others Achieve 84% Adult Mobile Phones Penetration
E-Business2 days agoHow AI Alert by Airtel is Transforming Mobile Security in Africa
E-Business2 days agoNITDA, API Partner Against Harmful Online Content
News2 days agoHorn of Africa Leaders Seek Enhanced Digital Integration for Increased Regional Growth
Telecom1 day agoTelcos: How and Why Network Services have Been Poor
Telecom2 days agoSophos Secures Leadership Spot in 2025 Gartner Magic Quadrant for Endpoint Protection