Connect with us
Anglostratits

Business

Kaspersky: Advanced Persistent Threat (APT41) targets Southern African organisation in espionage attack

Published

8 months ago

on

Kaspersky

Based on Kaspersky experts’ analysis, the attackers may have gained access to the organisation’s network through a web server exposed to the Internet

JOHANNESBURG, South Africa, July 21, 2025/APO Group/ –Kaspersky Managed Detection and Response experts (www.Kaspersky.co.za) have observed a cyber espionage attack on an organisation in Southern African and have linked it to the Chinese-speaking  APT41 group. Although the threat actor has shown limited activity in Southern Africa, this incident reveals that the cyber attackers have targeted government IT services in one of the countries in the region, attempting to steal sensitive corporate data — including credentials, internal documents, source code, and communications.

APT (Advanced Persistent Threat) is a category of threat actors known for carrying out concerted, stealthy, and ongoing attacks against specific organisations, as opposed to opportunistic, isolated incidents that account for most cybercriminal activity. The adversaries’ techniques observed during the attack in Southern Africa allowed Kaspersky to attribute it to the Chinese-speaking APT41 group with a high confidence. The primary goal of the attack was cyber espionage, which is typical for this threat actor. The attackers attempted to collect sensitive data from the machines they compromised within the organisation’s network.

It is noteworthy that APT41 typically has been showing quite limited activity in the Southern African region. APT41 specialises in cyber espionage and targets organisations across various industries, including telecommunications providers, educational and healthcare institutions, IT, energy, and other sectors, with known activity in at least 42 countries.

Based on Kaspersky experts’ analysis, the attackers may have gained access to the organisation’s network through a web server exposed to the Internet. Using a credential harvesting technique – known in professional terms as registry dumping – the attackers obtained two corporate domain accounts: one with local administrator rights on all workstations and another belonging to a backup solution, which had domain administrator privileges. These accounts allowed the attackers to compromise additional systems within the organisation.

One of the stealers used for data collection was a modified Pillager utility, designed for exporting and decrypting data. The attackers compiled its code from an executable file into a Dynamic Link Library (DLL). With it, they aimed to gather saved credentials from browsers, databases, administrative tools, as well as project source code, screenshots, active chat sessions and their data, email correspondence, lists of installed software, operating system credentials, Wi-Fi credentials, and other information.

Defending against such sophisticated attacks is impossible without comprehensive expertise and continuous monitoring of the entire infrastructure

The second stealer used during the attack was Checkout. In addition to saved credentials and browser history, it was also capable of collecting information on downloaded files and browser-stored credit card data. The attackers also used the RawCopy utility and a version of Mimikatz compiled as a Dynamic Link Library (DLL) to dump registry files and credentials, as well as Cobalt Strike for Command and Control (C2) communication on compromised hosts.

“Interestingly, as one of their C2 communication channels besides Cobalt Strike, the attackers chose the SharePoint server within the victim’s infrastructure. They communicated with it using custom C2 agents connected with a web-shell. They may have chosen SharePoint because it was an internal service already present in the infrastructure and unlikely to raise suspicion. Moreover, in that case, it probably offered the most convenient way to exfiltrate data and control compromised hosts through a legitimate communication channel,” explains Denis Kulik, Lead SOC Analyst at Kaspersky Managed Detection and Response service.

“In general, defending against such sophisticated attacks is impossible without comprehensive expertise and continuous monitoring of the entire infrastructure. It is essential to maintain full security coverage across all systems with solutions capable of automatically blocking malicious activity at an early stage — and to avoid granting user accounts excessive privileges,” comments Denis Kulik.

To mitigate or prevent similar attacks, organisations are advised to follow these best practices:

  • Ensure that security agents are deployed on all workstations within the organisation without exception, to enable timely incident detection and minimise potential damage.
  • Review and control service and user account privileges, avoiding excessive rights assignments – especially for accounts used across multiple hosts within the infrastructure.
  • To protect the company against a wide range of threats, use solutions from the Kaspersky Next (https://apo-opa.co/44EI2e3) product line that provide real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR for organisations of any size and industry. Depending on your current needs and available resources, you can choose the most relevant product tier and easily migrate to another one if your cybersecurity requirements are changing.
  • Adopt managed security services by Kaspersky such as Compromise Assessment (https://apo-opa.co/4m8aElL), Managed Detection and Response (MDR) (https://apo-opa.co/4m6do37) and / or Incident Response (https://apo-opa.co/44VsAsP), covering the entire incident management cycle – from threat identification to continuous protection and remediation.  They help to protect against evasive cyberattacks, investigate incidents and get additional expertise even if a company lacks cybersecurity workers.
  • Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organisation. The latest Kaspersky Threat Intelligence (https://apo-opa.co/3TQbRlK) will provide them with rich and meaningful context across the entire incident management cycle and helps them identify cyber risks in a timely manner.

A detailed analysis of the incident is available on Securelist (https://apo-opa.co/46mfGGS).

Kaspersky Managed Detection and Response service monitors suspicious activity and helps organisations respond swiftly to minimise impact. This is a part of Kaspersky Security Services, a team delivering hundreds of information security projects every year for Fortune Global 500 organisations: incident response, managed detection, SOC consulting, red teaming, penetration testing, application security, digital risks protection.

Distributed by APO Group on behalf of Kaspersky.

Home  Facebook

Related Topics:
Continue Reading
Advertisement

Energy

High-Level Minister Roundup to Headline African Energy Week 2026

Published

14 hours ago

on

March 20, 2026

By

African Energy Chamber

African Energy Week 2026 will convene ministers from Algeria, Ghana, Senegal, Zambia and Niger to spotlight oil, gas expansion, reforms and investment opportunities continentwide

CAPE TOWN, South Africa, March 13, 2026/APO Group/ –A high-level ministerial roundup will take center stage at this year’s African Energy Week (AEW) 2026 – taking place in Cape Town from 12–16 October –, convening some of the continent’s most influential energy leaders at a defining moment for Africa’s oil, gas and power sectors. As hydrocarbon expansion converges with accelerating energy transition strategies, the gathering is set to spotlight real-time project execution, regulatory reform and cross-border infrastructure that are actively reshaping Africa’s energy future.

 

Confirmed ministers to date include Algeria’s Minister of Energy and Renewable Energies Mourad Adjal, Ghana’s Minister for Energy and Green Transition Dr. John Abdulai Jinapor, Senegal’s Minister of Energy, Petroleum and Mines Birame Soulèye Diop, Zambia’s Minister of Energy Makozo Chikote and Niger’s Minster of Petroleum Hamadou Tinni.

 

Fresh from a March OPEC+ decision to lift output to 977,000 barrels of oil per day (bpd), Algeria enters AEW 2026 amid a $60 billion sector transformation. The country is also advancing a 500-well exploration drive and accelerating its 1.48 GW “Project of the Century” solar rollout. Gas exports to Europe remains central to the country, supported by hydrogen corridor planning and refinery expansion aimed at boosting capacity to 50 million tons by 2029.

 

Following license extension for Jubilee and TEN to 2040 and the late-2025 restart of the Tema Oil Refinery, Ghana is pushing a $3.5 billion upstream reinvestment plan while settling $500 million in gas arrears. A 1,200 MW state thermal plant and expanded gas processing at Atuabo anchor its gas-to-power shift, alongside a renewed upstream push in the Voltaian Basin.

The participation of these distinguished ministers underscores the scale of opportunity unfolding across Africa’s energy landscape and the urgency of aligning policy with capital

 

Senegal’s delegation comes on the back of strong production momentum, with the Sangomar oil field delivering 36.1 million barrels in 2025, outperforming forecasts, while the Greater Tortue Ahmeyim LNG development ramped up to 2.9 million tons per annum following first gas. Dakar is now prioritizing domestic gas through refinery upgrades at the SAR refinery and preparations for Sangomar Phase 2 to push output beyond 100,000 bpd.

 

Zambia is redefining its power mix after drought-induced hydro shortfalls. New solar capacity – including the 200 MW Chisamba expansion and 136 MW Itimpi Phase 2 – is part of a broader 2,500 MW diversification drive. Cabinet has approved major regional fuel pipelines, while the Energy Single Licensing System fast-tracks approvals. Lusaka targets 10 GW generation by 2030, with solar and wind rising to one-third of supply.

Niger’s presence reflects its emergence as a serious oil exporter, with the fully operational 1,950-km Niger-Benin pipeline now moving up to 90,000 bpd to international markets. Alongside uranium expansion and renewed cooperation with Algeria on upstream assets, Niamey is advancing digital oversight reforms and reinforcing energy sovereignty amid evolving geopolitical dynamics.

 

“The participation of these distinguished ministers underscores the scale of opportunity unfolding across Africa’s energy landscape and the urgency of aligning policy with capital,” says NJ Ayuk, Executive Chairman, African Energy Chamber. “Their leadership reflects a continent moving decisively from strategy to execution, creating a platform where investors can engage directly with the policymakers shaping Africa’s next wave of oil, gas and energy growth.”

 

At AEW 2026, this ministerial cohort will be well-positioned to offer investors direct insight into Africa’s most dynamic energy markets – where new barrels, new pipelines and new megawatts are reshaping regional growth trajectories in real time.

Distributed by APO Group on behalf of African Energy Chamber.

Continue Reading

Business

Enlit Africa 2026 Programme: 280+ speakers, African nuclear 2.0, Bruce Whitfield Business Breakfast

Published

14 hours ago

on

March 20, 2026

By

Enlit Africa

The event, taking place 19-21 May 2026 at the Cape Town International Convention Centre, expects 7,200+ attendees and 250+ exhibitors, making it Africa’s largest gathering of energy and water professionals

CAPE TOWN, South Africa, March 12, 2026/APO Group/ –Enlit Africa (https://apo-opa.co/4cEX08g) has released its full 2026 conference programme, featuring 280+ speakers across 8 specialised tracks including a new African Nuclear 2.0 session covering Koeberg’s 20-year life extension and Ghana’s nuclear vendor selection process.

 

The event, taking place 19-21 May 2026 at the Cape Town International Convention Centre, expects 7,200+ attendees and 250+ exhibitors, making it Africa’s largest gathering of energy and water professionals.

Award-winning business journalist and best-selling author Bruce Whitfield will deliver the opening address at the Project & Investment Network Business Breakfast on 19 May, kicking off three days of strategic sessions, deal-making platforms, and technical masterclasses.

New programme content includes:

African Nuclear 2.0 – A dedicated session examining the transition from planning to execution, featuring:

Koeberg Nuclear Power Station’s successful 20-year life extension (Units 1 and 2 now licensed until 2044/2045)

Ghana’s progression to Phase 3 of its nuclear programme, evaluating US, Chinese, and Russian technology bids

West African Power Pool‘s 10 GW regional nuclear capacity target

Small Modular Reactor (SMR) deployment readiness across African grids

Independent Transmission Projects (ITP) – A new session exploring how private investment is unlocking Africa’s transmission bottleneck, featuring global case studies from India’s PowerGrid and lessons for scaling grid capacity across the continent.

Generation Masterclasses – Five interactive roundtables on gas-to-power, nuclear, hydro power, clean coal, and hydrogen.

AI in Africa’s Power Grid – Examining practical deployment realities, real-time analytics, and predictive maintenance applications already in operation across African utilities.

Conference sessions and technical hub sessions on the expo floor are CPD-accredited by the South African Institute of Electrical Engineers (SAIEE) and the South African Institution of Civil Engineering (SAICE).

Co-located platforms:

Water Security Africa features country playbooks from Namibia (55-year potable reuse programme), Uganda (NRW reduction from 42% to 32%), Cape Town (Day Zero recovery strategies), and sector-specific stewardship sessions with Harmony Gold, Heineken, Mediclinic, and Growthpoint Properties.

Project & Investment Network (P&IN), part of the new Level 2 Executive Experience, connects project developers, investors, African utility CEOs, and DFIs through structured matchmaking, ministerial dialogues, and project briefings. Over the past two years, P&IN has facilitated $3 billion in project pitches.

Utility CEO Forum brings together 35+ confirmed utility CEOs under Chatham House Rule for candid, off-the-record strategic discussions on unbundling, prosumer management, and financial sustainability.

Municipal Forum addresses South African municipalities’ distribution, metering, and revenue challenges, including sessions on NRW management, tariff reform, Cost of Supply studies, and electrifying informal settlements.

Technical Hub sessions on the exhibition floor offer free, CPD-accredited training across Power, Renewable Energy & Storage, and Water tracks, with confirmed speakers from Eskom, ENGIE SA, ACTOM, National Transmission Company South Africa (NTCSA), RenEnergy, and Matla Energy.

Site visits on 22 May include Koeberg Nuclear Power Station and the V&A Waterfront desalination plant.

Pass options:
Free expo pass registration: https://apo-opa.co/4bl2bYu

Free expo passes provide access to 250+ exhibitors and CPD-accredited Technical Hub sessions.

Delegate Pass:
Early bird registration closes 3 April 2026. Delegate passes start at R15,100 (Silver), with P&IN Executive passes at R32,000 including access to the Bruce Whitfield breakfast, Level 2 executive lounge, and investor matchmaking.

Download the full programme: https://apo-opa.co/3NwCble

Register: https://apo-opa.co/4cEX08g

Distributed by APO Group on behalf of VUKA Group.

Continue Reading

Business

Binance Secures Second Major Legal Victory in U.S. Court Under Anti-Terrorism Act in Two Weeks

Published

14 hours ago

on

March 20, 2026

By

Binance

US Federal Court in Alabama Dismisses All Claims Against Binance in Latest Lawsuit Victory

JOHANNESBURG, South Africa, March 12, 2026/APO Group/ –Binance (www.Binance.com), the world’s largest cryptocurrency exchange, announced today that a U.S. federal court in Alabama has dismissed all claims against the company in a lawsuit alleging violations of the Anti-Terrorism Act (ATA). This marks Binance’s second major legal victory in an  ATA matter within one week, following their victory in the Southern District of New York.

A Full and Complete Legal Victory

In a detailed 19-page ruling, the Court found the plaintiffs’ complaint to be legally and factually deficient. The court’s decision to dismiss every claim across the board represents a decisive legal victory for Binance.

Sanctions compliance and terrorism financing are serious matters of law – they require evidence, legal rigour, and due process

The judge described the filing as a “shotgun pleading.” The complaint failed to clearly specify the claims and improperly grouped all defendants together without distinguishing individual conduct or liability. The ruling also emphasized that the plaintiffs did not meet the basic pleading standard to provide a “short and plain statement” of their claims.

Following the ruling, the court granted the plaintiffs until April 10, 2026, to file an amended complaint addressing the deficiencies identified. However, the judge warned that failure to adequately address these issues would result in dismissal of the entire case.

Building on Momentum and Upholding Legal Integrity

“This decision reinforces our unwavering commitment to protecting Binance and our community from unsubstantiated and bad-faith lawsuits,” shared Eleanor Hughes, General Counsel at Binance. “Sanctions compliance and terrorism financing are serious matters of law – they require evidence, legal rigour, and due process. Courts have now examined these claims on two separate occasions and found them to be without merit. These outcomes speak for themselves. We will not tolerate attempts to misuse the legal system to target our industry, and we remain as committed as ever to transparency, security, and lawful conduct in everything we do”.

This latest decision follows closely on the heels of Binance’s comprehensive victory in New York (https://apo-opa.co/46Xg0ev), where the Court similarly rejected allegations that the company assisted, participated in, or conspired with terrorists. Together, these rulings reflect Binance’s strong resolve to protect its platform and community.

Binance has consistently invested in industry-leading compliance infrastructure, regulatory engagement, and legal governance. The company will continue to vigorously defend itself against any attempts to bring unfounded claims or misrepresent its operations.

Distributed by APO Group on behalf of Binance.

Continue Reading

Trending