In the last week alone, there were around 300 cases of ransomware attempts in South Africa detected by Kaspersky.
- Internet service provider RSAWEB was targeted by “a highly sophisticated cyberattack,” it confirmed late Sunday.
- At this stage, RSAWEB does not believe that any customer or employee data was accessed or misused due to the attack.
- In the last week alone, there were around 300 cases of ransomware attempts in South Africa detected by global cybersecurity company Kaspersky.
- For more financial news, Go to the News24 Business Cover.
Internet service provider RSAWEB was hit by “a highly sophisticated cyberattack” last week, chief executive Rudy van Staden told customers in an email update Sunday night.
It explains that, in the early hours of Wednesday, February 1, 2023, RSAWEB discovered the cyberattack and took immediate action to contain the threat and secure its systems.
“Unfortunately, we were targeted by an extremely capable and devious threat actor. This attack is part of a campaign that has victimized many other companies in South Africa and around the world,” Van Staden says.
“Our teams have been working tirelessly to restore services to all of our customers and to determine the cause of this malicious attack,” says Van Staden.
At this stage, RSAWEB does not believe that any customer or employee data was accessed or misused due to the malicious attack.
“The relevant authorities have been informed and we have also hired independent professional cybersecurity advisers,” Van Staden says. “We will continue to take all reasonable steps to protect our customers and employees from future cyber threats.”
The company restored Fiber to the Home (FTTH) and Fiber to the Business (FTTB) services within 24 hours for the vast majority of customers.
“To date, services have been restored to all of our Fiber to the Home, Fiber to the Business, VoIP, ADSL and Mobile APN customers affected by this malicious attack,” according to Van Staden’s letter.
ransomware attempts
In the past week alone, there have been around 300 cases of ransomware attempts in South Africa detected by global cybersecurity company Kaspersky, Brandon Muller, its technology expert and consultant for the Middle East and Africa, told News24.
“Ransomware remains one of the leading information security threats in Africa and around the world. One of the most notable ransomware cases over the past year is the attack on Shoprite, Africa’s largest retail chain. Other examples include attacks by the LockBit group in sub-Saharan Africa,” says Muller.
Kaspersky sees a distinct trend in ransomware development to become more sophisticated and targeted, exposing victims to more threats.
“In recent years, ransomware groups have come a long way from being loose gangs to becoming companies with distinctive features of a full-fledged industry. We are seeing more and more cases where ransomware attacks are carried out manually, in an efficient but time-consuming way. That wasn’t typical of small-scale attackers before,” Muller says.
In 2022, Kaspersky contributed to Interpol’s Africa Cyber Operation (Acso) by sharing information about ransomware command and control servers.
“This evidence laid the foundation for a number of investigative and operational activities against the threat actors behind cybercrime and their malicious infrastructure,” says Muller.
“The reality is that any business with an online presence, regardless of size or industry, is at risk and therefore needs to prioritize and formalize its approach to risk management,” says Sizwe Cakwebe, manager at risk specialist SHA Cyber, a division of Santam.
The SHA Risk Review 2022 indicates that one in three SMEs surveyed experienced a cyberattack, with the most common cause being malware (30%). This despite the fact that more than 60% of SMBs believe that they are not viable targets for cybercriminals.
