- The Kaspersky Global Research and Analysis Team (GReAT) has detected that the SideWinder APT group, known for its cyber espionage activities, is expanding its attack operations into Africa, using a previously unknown espionage toolkit called ‘StealerBot'.
- According to the study, the SideWinder APT group's recent campaigns targeted high-profile entities and strategic infrastructures in many African countries, including Morocco and Djibouti. The campaign in general remains active and may target other victims.
- Kaspersky also discovered that StealerBot is engaging in several malicious activities, including installing additional malware, capturing screenshots, logging keystrokes, stealing browser passwords, intercepting RDP (Remote Desktop Protocol) credentials, and exfiltrating files, among others.
Giampaolo Dedola, lead security researcher at Kaspersky's GReAT, stated that StealerBot is a stealthy spying tool that allows attackers to spy on systems without being noticed. It uses a modular structure, with each component designed to perform a specific function.
“These modules never appear as files on the system’s hard drive, making them difficult to trace. Instead, they are loaded directly into the memory. At the core of StealerBot is the ‘Orchestrator’, which oversees the entire operation, communicating with the threat actor’s command-and-control server, and coordinating the execution of its various modules,” he added.
SideWinder, also known as T-APT-04 or RattleSnake, is reportedly one of the most active APT groups, having begun operations in 2012. Before Kaspersky discovered these recent waves of attacks, which have spread to high-profile entities and strategic infrastructure in Africa, the group primarily targeted military and government entities in Pakistan, Sri Lanka, China, and Nepal, as well as other sectors in South and Southeast Asia.
Kaspersky experts recommend that organisations provide their security teams with up-to-date insights and technical details to combat APT-related threats. Meanwhile, cyber attackers are reportedly targeting critical infrastructure in Africa and experimenting with artificial intelligence as a toolkit.
According to recent data, Africa experienced the highest average weekly cyberattacks per organisation in Q2 2024, with an average of 2,960 attacks, marking a 37% increase compared to the same period in 2023. The global average was 1,636 attacks per organisation per week, up 30% compared to the year before.
In recent times, Ghana, South Africa, Lesotho, Kenya, and Morocco, among others, have all experienced cyber threats. Morocco reportedly ranked 15th among countries most vulnerable to cyber threats in 2023. The country faced 52 million cyberattacks in the same year.
