New service to fight cybersecurity threats to African banks

April 2019 Cyber Security

Foregenix is launching a service to combat the new and growing breed of cyber-attacks on African banks. The global cybersecurity firm, which specialises in the financial services and has a regional hub in Johannesburg, is introducing the Foregenix Threat Sweep.

Based on Foregenix’s established Serengeti technology, the service cuts the dwell-time of attackers within an organisation to hours from an industry average of around 100 days.

The new service cuts through the noise and identifies latent threats in a matter of minutes. Threat Sweep is backed-up by a threat intelligence team and senior digital forensics and incident response analysts performing threat hunts on specific issues experienced within the sector. The combination of technical innovation and human elements mean threats are detected quickly and mitigated efficiently.

Among the rapidly emerging attacks Threat Sweep is aiming to combat is the surge in ATM cashout type attacks (FASTCash). These attacks on issuing banks or payment card processors exploit weak ­internal system architecture and security controls of processing switches (servers) and then use a small subset of cloned payment cards at ATMs to fraudulently withdraw large amounts of money in untraceable hard currency.

The CEO of Foregenix, Andrew Henwood explains: “ATM cashouts allow hackers to extract vast sums of money in less than 30 minutes by compromising the backend and eliminating the removal limits on these accounts. This is all done in an almost risk free manner. So it is essential to be extra vigilant and perform additional checks within the payment environment, even if there is no obvious breach as attackers typically lie dormant for months.”

Henwood adds: “As a PCI Forensic Investigator, we are seeing regular requests for assistance from organisations experiencing ATM cashout attacks. Previously, these were on the periphery but are now becoming a weekly phenomenon on some parts of the continent.”

The Threat Sweep service offers immediate response to this type of critical situation. It is offered for a fixed-time and cost for 30-days and most clients opt to extend into the Foregenix MDR service.

Henwood comments: ‘Unfortunately, in most of our forensic ­investigations, banks and organisations are failing to detect when their systems were initially compromised. From analysis of our casework we see 135 days elapsing before an alert is raised and by that point the hacker typically knows and understands the environment better than the IT administrators, they are well-established and have already harvested large amounts of valuable personal and financial data.

“Many organisations rely on the traditional security systems – firewalls, antivirus, patch management – but they are still being breached. With new threats emerging, our rapid response service meets an increasing need for the sector to accurately establish their threat and risk level and take appropriate action.”

For more information go to

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

The enemy within – insider ­security threats
May 2019, Wolfpack Information Risk , Editor's Choice, Cyber Security, Financial (Industry)
Insider threats in today’s financial world are insidious and destructive and your defence against insiders should start long before the person assumes his/her position.

LoJax: Be very careful
May 2019 , Cyber Security
Even replacing drives won’t kill this malware, which is still active more than nine months after researchers from Arbor Networks detailed it.

Assessing impacts: The meteors of security and AI
May 2019 , Cyber Security
As security threats evolve and artificial intelligence pervades, what impact are they set to have on business over the next year?

Visibility is key, and lacking
May 2019 , Editor's Choice, Cyber Security
Cybercriminals are most likely to be caught on servers and networks, but detecting their time and point of entry remains a mystery.

The benefits of machine learning and UEBA
May 2019 , Cyber Security
Combining accurate and essential user behavioural data with machine learning allows you to more accurately monitor your users on an endpoint-by-endpoint basis.

Insiders: who are they?
May 2019 , Security Services & Risk Management, Cyber Security
The 2018 Insider Threat Report by Cybersecurity Insiders reports that more than 51% of companies are concerned about unintentional insider attacks.

Securing the Industrial Internet of Things
May 2019, Axiz , Cyber Security, IT infrastructure, Industrial (Industry)
The very benefits that makes the IIoT so compelling, makes it equally capable of damaging infrastructure operations and processes through bad actors.

Hybrid cloud and hyper-converged data protection
May 2019 , IT infrastructure, Cyber Security
Arcserve Unified Data Protection extends disaster recovery and backup technologies to prevent downtime and data loss for hyper-converged and SaaS-based workloads.

Vivotek strengthens cybersecurity
May 2019 , CCTV, Surveillance & Remote Monitoring, Cyber Security
Vivotek has announced the availability of comprehensive protection in its Cybersecurity Management Solution under the strategy of its 'Security within Security' campaign.

Scammers target job seekers
May 2019 , Cyber Security
Kaspersky Lab experts detected a blast of sophisticated spam emails in the first quarter of 2019, featuring fake job-offers that seemed to come from HR recruiters in large corporations.