Despite the arrest of important operators in early 2024, Grandoreiro continues to be used by its partners in new campaigns. Kaspersky Global Research and Analysis team (GReAT) has discovered a new light version focused on Mexico targeting around 30 banks. These findings are to be highlighted at the Security Analyst Summit (SAS) 2024.

Remaining one of the most active threats globally and targeting users of more than 1,700 banks, Grandoreiro variants account for around five percent of banking trojan attacks this year.  Mexico is one of the most targeted countries by various Grandoreiro strains, including the new light version, seeing 51,000 recorded incidents this year.

Kaspersky data indicates Grandoreiro has been active since 2016. In 2024, the threat targets more than 1,700 financial institutions and 276 cryptocurrency wallets across 45 countries and territories, lastly adding Asia and Africa to the list of its targets, making it a truly global financial threat.

Among countries affected in Africa are Algeria, Angola, Ethiopia, Ghana, Ivory Coast, Kenya, Mozambique, Nigeria, South Africa, Tanzania, Uganda.

After assisting an INTERPOL-coordinated action, which has led to Brazilian authorities arresting operators behind a Grandoreiro banking trojan operation, Kaspersky discovered that the group’s codebase has been split into lighter, fragmented versions of the trojan, to continue its attacks.

Recent analysis has identified a specific light version focused primarily on Mexico, which has been used to target approximately 30 financial institutions. The creators likely have access to the source code and are launching new campaigns using the simplified legacy malware.

“All the recent developments underscore the evolving nature of the threat. Fragmented and lighter versions may represent a trend that could extend beyond Mexico and into other regions, including beyond Latin America.

However, we believe that only some trusted affiliates have access to the malware source code to develop such lighter versions. Grandoreiro operates differently from the traditional ‘Malware-as-a-Service’ model we are accustomed to.

You won’t find announcements on underground forums selling the Grandoreiro package; instead, access to it appears to be limited,” explains Fabio Assolini, head of the Latin American (GReAT) at Kaspersky.

Multiple variants of Grandoreiro, including the new light version and the primary malware, accounted for approximately five percent of global banking trojan attacks detected by Kaspersky in 2024, making it one of the most active threats worldwide.

Kaspersky has also analysed the newer samples of the primary Grandoreiro from 2024, and observed new tactics.

It records mouse activity to mimic real user patterns, aiming to evade detection by machine learning-based security systems that analyse behaviour. By replaying natural mouse movements, the malware aims to trick anti-fraud tools into seeing the activity as legitimate.

Additionally, Grandoreiro has adopted a cryptographic technique known as Ciphertext Stealing (CTS), which Kaspersky has never seen being used in malware. In this case, its aim is to encrypt the malicious code strings.

“Grandoreiro has a large and complex structure, which would make it easier for security tools or analysts to detect if its strings were not encrypted. This is likely why they introduced this new technique – to complicate the detection and analysis of their attacks,” Fabio Assolini elaborated.

d.light, the global provider of transformational household products and affordable finance for low-income households, has been chosen to take part in the latest Kenyan Government initiative to expand the uptake of off-grid solar home systems and clean cookstoves in underserved rural counties in the country.

d.light has been selected to take part in the latest round of the Kenya Off-Grid Solar Access Project (KOSAP), a program set up by the Government of Kenya and funded by the World Bank with the aim of closing the energy access gap in Kenya by providing electricity and clean cooking solutions to remote and traditionally underserved areas of the country not covered by the national energy grid.

d.light will provide solar power and clean cooking solutions to over 150,000 people who currently lack access to electricity and clean cooking. To address affordability, d.light’s solar products will be sold on an instalment plan via d.light’s “PayGo” service.

The program covers 14 counties in total – 13 counties in the north, east and south-east of the country, including West Pokot, Turkana, Marsabit, Samburu, Isiolo, Mandera, Wajir, Garissa, Tana River, Lamu, Kilifi, Kwale, Taita Taveta: plus the southwestern county of Narok.

According to 2022 data from the World Bank, 24 percent of Kenya’s population of 54 million people still lack access to electricity, with more than 34 percent of Kenya’s rural population without access.

In addition, only 30 percent of the entire population currently have access to clean fuels and technologies for cooking. The majority still use harmful and polluting fuels like unprocessed biomass, charcoal, coal, and kerosene.

Commenting on the news, d.light’s Managing Director for Kenya, Karanja Njoroge, said, “Kenya has achieved sustained economic growth and social development in the last decade or so, and its economy is the largest and most developed in eastern and central Africa.

“However, many of its citizens still live without access to electricity, especially in rural areas outside the major towns and cities. These areas are also vulnerable to the effects of climate change, including droughts and desertification.”

Njoroge continued, “Kenya was one of the first African countries in which d.light launched operations back in 2008, and our headquarters for Africa is in Nairobi.

With our combination of tried-and-tested, market-leading products, established distribution channels, and our secure “PayGo” payment system, d.light is ideally placed to participate in this latest drive to extend clean, safe, renewable energy to the people and communities in rural Kenya who need it.

“Thanks to the KOSAP initiative, a better quality of life is within reach for many Kenyans.”

The Government of Kenya launched the KOSAP program in November 2018. The program consists of four components with a total budget of USD$150M provided as a grant from the World Bank:

 Component 1: Mini-grids for community facilities, businesses, and households

 Component 2: Standalone Solar Home Systems and clean cooking solutions for households

Component 3: Standalone systems and solar water pumps for community facilities

Component 4: Capacity building for development, planning and regulation of power and renewable energy at a county government level

d.light is participating in Component 2, which has been allocated USD$15.7M of the total budget. Of this amount, USD$9.3M is earmarked for off-grid solar solutions and USD$6.4M for clean cookstoves.

The KOSAP program is part of Kenya Vision 2030, the long-term development blueprint for the country first launched in 2008 by then President Mwai Kibaki. Vision 2030’s aim is to transform Kenya by 2030 into an industrialized, prosperous, competitive middle-income country that provides a high quality of life to all its citizens in a clean and secure environment.

This news follows d.light’s nomination in September as a finalist for this year’s Earthshot Prize, the prestigious annual international environmental award founded by the UK’s Prince William that showcases groundbreaking sustainable solutions for repairing and regenerating the planet.d.light is one of 15 finalists. The winners will be announced at the Earthshot Prize Awards ceremony in Cape Town, South Africa, on Wednesday 6 November.

Digital Encode Limited, a leading Cybersecurity and Governance, Risk and Compliance company in Africa, is proud to announce its sponsorship of Africa Tech Alliance Forum [AfriTECH 4.0].

The event, which is set to take place in Lagos, Nigeria, is one of the most anticipated gatherings of technology enthusiasts, innovators, and industry leaders in Africa. The sponsorship highlights Digital Encode’s unwavering commitment to promoting digital innovation and transformation across the continent.

Meanwhile, Digital Encode, in order to strengthen its global presence and enhance cybersecurity capabilities, recently commissioned a state-of-the-art facility at the Lekki area of Lagos.

This expansion is part of the company’s efforts to fulfil its mission of safeguarding organisations worldwide against cyber threats.

Alongside the new office, Digital Encode has launched the Centre for Information Security Intelligence (CISI), a specialised centre aimed at heightening cyber situational awareness, providing tailored threat intelligence, and enabling collaboration with international cybersecurity organisations.

Dr. Obadare Peter Adewale, the Founder and Chief Visionary Officer of Digital Encode, said, that by proactively addressing emerging threats, the company will enhance the cyber resilience of its clients.

“CISI, Digital Encode’s proprietary solution, enables us to identify potential vulnerabilities in our clients’ environments and deploy targeted countermeasures before adversaries can exploit them.

“This approach minimizes the likelihood and impact of cyber incidents, thereby strengthening the overall cyber resilience of Digital Encode’s clients,” Adewale said.

AfriTECH 4.0, scheduled for November 2024, will bring together stakeholders from various sectors to explore the theme: “Leapfrogging Digital Transformation for Future of Africa’s Economy”. The event will feature panel discussions, exhibitions, and networking opportunities designed to foster collaboration and knowledge sharing among businesses, governments, and tech startups. The conference will focus on emerging technologies such as artificial intelligence (AI), cybersecurity, blockchain, and financial technology (fintech), which are shaping the future of Africa’s digital landscape.

As a sponsor, Digital Encode will showcase its cutting-edge solutions in cybersecurity and digital risk management, underscoring its role as a pioneer in helping African businesses navigate the complexities of the digital age.

The firm will also play a key role in panel discussions on data privacy, cybersecurity, and the importance of compliance in fostering trust in digital systems.

Speaking on the sponsorship, Dr. Obadare said, “We are excited to be a part of AfriTECH 4.0, which represents the forefront of innovation in Africa. Digital transformation is critical to the development of our continent, and we believe that fostering collaborations and sharing knowledge at events like this will accelerate the growth of Africa’s digital economy.”

AfriTECH 4.0 promises to attract a diverse audience of entrepreneurs, policymakers, tech experts, and investors, all committed to driving Africa’s digital future. With Digital Encode’s expertise and leadership in cybersecurity, the conference is set to address some of the most pressing challenges and opportunities in the African tech ecosystem. Participation is Free, but you are required to register via the link here: https://bit.ly/3ZPdi88.

Similarly, Dr. Obadare disclosed Digital Encode’s unicorn status intent during a recent interview with CNBC. The interview aired on Thursday, 10 Oct 2024 13:57:37 GMT.

You can watch it here.

As the driving force behind CISI, Adewale emphasized that the firm solidifies its position as a thought leader in the cybersecurity domain by developing innovative solutions that address the evolving threat landscape.

“Digital Encode demonstrates its commitment to staying ahead of the curve and providing its clients with the most effective cybersecurity strategies,” the statement said.

The CVO underscored the company’s commitment to driving innovation and influencing the direction of the cybersecurity industry.

He added that through the publication of research reports, thought-provoking insights, and active participation in industry conferences and events, Digital Encode aims to inspire innovation and shape the global cybersecurity discourse.