Cybercriminals target African countries with ransomware

Check Point has revealed that five African nations were among the top 10 most-attacked countries in November as cybercriminals made increasing use of ransomware attacks using the Locky and Cryptowall viruses.

Botswana was the most-attacked country in Check Point's list of 117 at-risk nations, followed by Malawi in second place, Namibia in fourth, Uganda in ninth and the Democratic Republic of Congo in tenth place. South Africa moved up to 31 on the list from 58th position in October, while Kenya dropped to 24th (from 22nd in October) and Nigeria climbed slightly to 108th position, from 116th the previous month.

In its monthly Global Threat Index, a ranking of the most prevalent malware families attacking organisations' networks, Check Point noted a 10% increase in the number of attacks using Locky and Cryptowall and found both the number of active malware families and number of attacks remained close to an all-time high as the number of attacks on business networks continued to be relentless.

Locky spreads mainly via spam emails containing a downloader disguised as a Word or Zip file attachment, which then downloads and installs the malware that encrypts the user files. Locky was the no.1 malware family in the largest amount of countries (34 countries compared to Conficker, which was the top malware in 28 countries).

The pattern highlights the growing threat posed to corporate networks by ransomware and suggests that many organisations are simply paying ransoms to secure the return of their files, making it an attractive - and lucrative - attack vector for cybercriminals.

Once again Conficker retained its position as the world's most prevalent malware, responsible for 15% of recognised attacks. Second-placed Locky, which only started its distribution in February of this year, was responsible for 6% of all attacks, and third-placed Sality was responsible for 5% of known attacks. Overall, the top ten malware families were responsible for 45% of all known attacks.

In Kenya, the most common malware families are Sality, Virut and Mazben; In Nigeria, the most common malware families are Dorkbot, Virut, Sality and South Africa, they are Virut, Sality, and Conficker.

Rick Rogers, Area Manager for East and West Africa at Check Point Software Technologies, explained, "Ransomware attacks are still growing in volume for a simple reason - they work and generate significant revenues for the attackers. Organisations are struggling to effectively counteract the threat posed by this insidious attack form; many simply don't have the right defences in place, and may not have educated staff on how to recognise the signs of a potential ransomware attack in incoming emails. This, of course, only makes it even more attractive to criminals.

Check Point's threat index is based on threat intelligence drawn from its ThreatCloud World Cyber Threat Map, which tracks how and where cyberattacks are taking place worldwide in real time.