DangerousSavanna

Executive Summary

DangerousSavanna is a cyber threat actor targeting financial institutions in French-speaking Africa through sophisticated phishing campaigns. Their primary method involves spear-phishing emails with malicious attachments, including various file types like ISO and LNK. They use open-source tools and self-written malware to compromise systems, aiming to disrupt or gain unauthorized access to sensitive financial data.

Goals & Targeting

DangerousSavanna's strategic objective appears to be gaining unauthorized access to financial institutions' systems in French-speaking African countries. Their targeting of sectors critical to national economies suggests a focus on economic gain or disruption. The choice of victims aligns with their operational capabilities and geographic reach, focusing on entities where successful compromise could yield significant financial or intelligence benefits.

DangerousSavanna is an active cyber threat actor focusing on financial institutions in French-speaking African countries such as Ivory Coast, Morocco, Cameroon, Senegal, and Togo. The group has been operational for at least two years, employing phishing emails with malicious attachments as their primary infection vector. Their campaigns are notable for the diversity of file types used, including self-written executable loaders, malicious documents, ISO, LNK, JAR, and VBE files. DangerousSavanna demonstrates adaptability by frequently updating their infection chains, reflecting the evolving threat landscape. The group's tools are a mix of open-source projects such as Metasploit, PoshC2, DWservice, and AsyncRAT, alongside self-developed software. Despite their relatively unsophisticated toolkit compared to other advanced persistent threats, their persistence and creativity in compromising targets make them a notable threat.

Key Capabilities

• Spear-phishing campaigns
• Diverse malicious file types
• Use of open-source tools (Metasploit, PoshC2)
• Self-written malware
• Adaptive infection chains

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

DangerousSavanna operates with a clear focus on financial services, leveraging phishing campaigns to penetrate targets. Their campaigns are characterized by continuous evolution of infection vectors, indicating adaptability to defensive measures. Past operations include multiple successful compromises in French-speaking Africa, targeting both public and private sector entities. Notably, their use of open-source tools suggests an effort to minimize detection while maintaining functional effectiveness.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Diverse file types (ISO, LNK, JAR, VBE)
• Malicious scripts in document files
• Signs of persistence via scheduled tasks

Recommended Actions

• Implement advanced email filtering solutions to block spear-phishing attempts.
• Educate employees on phishing tactics and suspicious emails.
• Monitor network traffic for signs of unauthorized access or tool deployment.
• Conduct regular endpoint scans for known malicious file types and scripts.
• Adopt a Zero Trust model to limit lateral movement within networks.

Suggested Tags