Attacks hitting financial organizations in West Africa since at least mid-2017 rely on off-the-shelf malware, free hacking tools, and utilities already available on the target systems to steal credentials, install backdoors, and run commands.
Actively four campaigns are observed which are used to lure victims into the trap.
NanoCore trojan and PsExec
In one of the attacks, the threat actor used NanoCore trojan along with PsExec, a legitimate network administration tool, and delivered the malware via phishing emails. To lure the victim into installing the malware, the attacker used documents referring to a West African bank. The targets were in Ivory Coast and Equatorial Guinea.
Cobalt Strike, PowerShell scripts, and free tools
It combined malicious PowerShell scripts with Mimikatz, a hacking tool designed to steal credentials, and UltraVNC opensource software for remote administration. The attackers also used a dynamic DNS service to hide their location by assigning a custom domain name to the IP address of the C2 server.
Mimikatz and custom RDP
Mimikatz can be used to harvest credentials and RDP allows for remote connections to computers, it’s likely the attackers wanted additional remote access capability and were interested in moving laterally across the victim’s network.
INDICATORS OF COMPROMISE
Malware Hash (MD5/SHA1/SH256)
Consider blocking the IoCs at their respective controls.