Comercio Limited

Nigerian banks become targets of Russian hackers.

Researchers from Kaspersky Lab have reported thousands of notifications of attacks on major banks in Sub-Saharan Africa.

The malware used in the attacks indicates the threat actor is most likely to be the notorious Silence hacking group, infamous for the theft of millions of dollars from banks around the world.

The attacks have been attributed to this group because the malware used in this latest incident was previously used solely in its operations. Moreover, the malware is in Russian, although the threat actor attempted to slightly cover this fact by typing Russian words using the English keyboard layout.

The Silence group is one of the most active advanced persistent threat actors. Its modus operandi consists of a social engineering scheme, through a phishing e-mail that contains malware sent to a bank

Following this, the malware gets inside the bank’s security perimeter and lays low for a while, performing reconnaissance on the target organisation by capturing screenshots and making video recordings of the daily activity on the infected device, learning how things work within the organisation.

Once the bad actors are ready to take action, they activate all capabilities of the malware and cash out using, for example, ATMs. The score sometimes reaches millions of dollars.

The first attacks were detected in the first week of January and indicated the threat actor is about to begin the final stage of operation and cash out the funds. The attacks are ongoing and persist in targeting large banks in several Sub-Saharan Africa countries.

Sergey Golovanov, security researcher at Kaspersky, says the Silence group has been active over the past few years, and lives up to its name.

“Their operations require an extensive period of silent monitoring, with rapid and coordinated thefts. We noticed a growing interest of this actor group in banking organisations in 2017, and since that time, the group would constantly develop, expanding to new regions and updating their social engineering scheme.”

Kaspersky detects the malware used in the operation as HEUR:Trojan.Win32.Generic, PDM:Exploit.Win32.Generic, and urges all banks to stay vigilant. Apart from large sums of money, Silence group also steals sensitive information as video record screen activity.

Comercio Cyber-Academy.

10 Benefits of Cyber-security Training for your Organization.

According to various reports, Nigeria loses around 127 billion Naira to cyber-criminals every year, this is partly due to companies having employees not properly trained in identifying and defending against cyber attacks. 

Cybersecurity refers to the body of technologies, processes, and practices designed to protect networks, devices, programs, and data from attack, damage, or unauthorized access.


Cyber-security Training is an essential element in the development of individuals and teams against cyber-attack.


10 Benefits of cyber-security training.


 1. Develop a Security-Focused Culture.

When you offer training to your employees on a topic, this is communicated to them that it’s important. At this level of importance is a natural transition to have safety be one of your culture’s foundations. Regular training instills better habits. When something becomes a habit, people will continue to follow it like it’s second nature. Reinforcing the training with other communications like posters or emails is another way to ensure your culture stays security-focused.


2. Empower Employees.

When employees feel confident about their interactions with data that must follow security protocols, the less likely they are to cause an incident. Human error is after all the leading cause of breaches and attacks. Research that examined breaches from all of 2015 found human error as the number one culprit at 37%.

To reduce the chance of human error and empower your staff, security awareness training is the solution. This training will teach them how to protect the company when using technology so there’s no guessing about what security steps should be taken.


3. Protect Assets.

A security breach is not only devastating to a company’s reputation, but it’s also a big hit to finances. According to the IBM Ponemon 2017 Cost of Data Breach Report, the average cost is $3.62M. That’s $3.62M that you could have put into other projects. It’s best to invest in training from the beginning to keep those dollars and protect your assets.


 4. Prevent Downtime.

Should a breach or incident occur, it takes considerable time to investigate and repair. That’s precious time that your staff has to devote to getting back up and running. This is likely to wreck your workflows and deadlines. Downtime, even for only a few hours, can cause severe disruption.


5. Increase Adoption.

Don’t expect your employees to adopt security practices on their own by reading your policy. Training leads your employees toward adoption. They are informed and understand risks once they’ve been through training. With more training comes greater adoption and a workforce-wide awareness, thus enhancing security throughout your organization.


6. Institute Proactive Practices.

Your security program should be proactive and preventive in nature rather than reactive. If you are reacting something’s already occurred. By looking at security as something to prevent rather than recover from, there is a shift in perspective. Security awareness training supports this perspective. Employees will learn about specific risks and how to avoid them.

7. Collect Risk Data by Driving Awareness.


With more awareness of security risks, employees be a source of great insight for collecting risk data. Risk is a moving target in technology. Gain better knowledge of what types of risk employees are encountering, letting this inform your security strategy. Training facilitates this knowledge. For example, once an employee is aware of what a phishing email looks like, they are more likely to forward it to the security team rather than just deleting it. Employee-reported phishing attempts and other hacking schemes are valuable data.

8. Get Everyone on the Same Page.


Without official training on security, different departments or locations of a business may be employing different principles. Security should be cohesive across all employees. You don’t want a bunch of rogue groups using practices they believe to be best. In training sessions, there’s no more guesswork about what the security strategy is and how it needs to be implemented. Getting all parties on the same page is critical for reducing risk.


 9. Expand Awareness to Reduce Threats.

Security awareness training should be designed to train on real-life threats, like the OWASP Top 10. Your users then learn how to recognize and avoid attacks, keeping the network secure and workflow moving. Without this kind of training, your users won’t be as up-to-date on cyber-security dangers and could, without malice, expose the company’s system to viruses and hacks. Put the onus back on the employee by giving him/her the knowledge to respond better. You need your employees to have these skills, so it’s a true investment in your staff. When they are prepared, you should expect less threat activity.


10. Stay Compliant.

There are lots of regulations that businesses must adhere to. These aren’t optional. Not only does the training guide employees on how to stay compliant in relation to legislation like Sarbanes Oxley (SOX) or the Health Insurance Portability and Accountability Act (HIPAA). Training on these very topics may also be part of your organization’s compliance. To keep all those that handle sensitive information within compliance and the rules, they’ll need the training to understand what their efforts must look like. Risking non-compliance could cost you significantly. Security awareness training is integral to a successful compliance program.

There is no doubt that security awareness training is a good move for your organization. Its benefits are plentiful, and they help you reach your cyber-security goals. 


 Comercio Cyber-Academy has developed unique and easy to understand training courses that will educate and prepare employees to detect and fight Cyber-attacks.



website –

email –

phone number -08123746132

Address – 1438 Sanusi Fafunwa Street Victoria Island, Lagos 


Leave a Reply

Your email address will not be published. Required fields are marked *