Is the New Rwandan Cybercrime Law a Step Forward for Cybersecurity in Africa

Is the New Rwandan Cybercrime Law a Step Forward for Cybersecurity in Africa

Time Stamp: June 12, 2018 11:10 AM

cybercriminals Reading Time: 5 minutes

Like many countries around the world, cybercrime is a problem in Rwanda. Malware is a frequent means of conducting cybercrime. According to Comodo intelligence, between January 1st and June 4th of this year, Rwandan networks got hit by 4,006 different strains of malware. Here’s a summary of the most common types of malware that Comodo has detected in Rwanda during that time period:

• LoadMoney: This threat is classified as a Potentially Unwanted Program. It modifies system files, creates Windows tasks and might shows advertisements on your computer and browser.
LoadMoney is adware which is bundled using custom installers and dropped on your computer during the installation process. It is capable of installing extensions to inject the advertisements, change the default browser home page & search and proxy settings.

Adwares can often socially engineer people into downloading more malware, and browser hijackers can often intercept private user web activity.

• Macoute: A worm which often behaves as scareware by telling the user that their machine has been infected. It also targets Windows, and it may attempt to privilege escalate and modify the Windows Registry. Macoute is also known to disable firewalls and antivirus software, download Trojan Windows updates, and prompt users into downloading trojans which are supposedly necessary to watch videos or view webpages. The user’s Windows client may display a scareware message such as, “Warning: Your computer is infected. Detected spyware infection! Click this message to install the last update of security software.”

• GlobalUpdate: Another Windows targeting bundler. GlobalUpdate malware is known to modify the “HKEY_LOCAL_MACHINESOFTWARECLASSESglobalUpdate
C:Program Files (x86)globalUpdate” registry key, hence its name.
Globalupdate is an adware program that displays advertisements in the user’s browser.
The program may arrive on the compromised computer as a browser plugin after being installed without user consent because it is bundled with third party applications.
It is an ad-supported extension which is capable of changing browser start page, search settings, changing security settings for Internet Explorer, Firefox and Chrome, and distributed through various monetization platforms during installation.
This malware is known to distribute Multiplug adware and CrossRider browser hijackers.

• Coinminer: This trojan uses the infected computer’s resources to mine digital currency at the backend and passes the mined currency and other required data to the server controlled by a malicious hacker. Initially these malwares targeted Bitcoin generation and the latest trend is to mine Monero and other cryptocurrencies. These are distributed as binaries and also work in multi OS platforms such as Windows, Mac, Android and IOS. Recently, these malwares are spreading through Javascripts to mine Monero cyptocurrency.
This activity can use a lot of processing power without their permission and make your PC run slower than usual.

• YTDDownloader: This unwanted application will allow you to download YouTube videos to your hard drive, so you can watch those videos offline. This unwanted application can affect the quality of your computing experience.

Following are the potentially unwanted behaviors:

Adds files that run at start-up
Modifies boot configuration data
Injects into other processes on your system
Changes browser settings
Changes browser shortcuts
Installs browser extensions
Disables User Access Control (UAC)
If you want to watch a video on YouTube, watch it on YouTube!

• Copali: This malware is categorized in to Worm type. It automatically spread to other systems by using general worm propagation techniques such as copying themselves to removable drives, network folders, or via email. This malware family, in general, creates a new folder on the root drive of an infected PC and copy themselves as csrss.exe. They also create desktop.ini in the same folder. It can download additional threat Zbot and kill the antivirus process.
It will attempt to hide the “Show hidden files and folders” in Windows Explorer in order to evade detection.

• Mindspark: Mindspark is a marketing company that focuses on interactive advertising. It targets mostly known browsers like Internet Explorer, Google Chrome, Mozilla Firefox, and Safari. This threat performs changes on browser settings that may result to home page hijacking and browser redirect problems. This adware is bundled using custom installers and dropped on your computer during the installation process.
It modifies system files, creates new folders, creates Windows tasks and shows advertisements on your computer and browser.

• Necurs: The Necurs botnet is a distributor of many pieces of malware, most notably Locky,Dridex,RockLoader and Globeimposter.
Necurs is a group of compromised computers which send spam emails with malicious attachments to a large number of recipients – usually the messages are created to look like a request to check invoice details or to confirm a purchase. The attachments contain packed scripts which install Locky Ransomware when ran.
Necurs nests itself inside a Windows installer folder and shows a lot of rootkit like behavior.
While Necurs is running, it is not possible to kill the Necurs process (hidden as syshost), to start monitoring tools that make use of drivers (such as memory dumping tools or sysinternals process monitor) or to view the access rights to the executable.

Necurs sends a heartbeat via HTTP to its C&C server every six minutes on average, communication with peers is done via UDP.

Watch out for this one!

Rwanda has been cracking down on cybercrime for a while now. At least eight million cyber attackers have tried to target Rwandan banks in 2017. Rwandan Central Bank Governor, John Rwangombwa discussed one particular financial cyber-attack that they were able to thwart which involved Rwf 900million.

“The money was transferred to one of the banks, but we were able to recover the funds in time, with the help of police… Criminals are constantly developing new techniques for cybercrime; we need to keep a constant review on activities carried out in banks.”

Rwanda’s first national cybersecurity policy took effect in 2015. By 2017, Rwanda became the second African country to establish a $3 million cybersecurity system designed to protect public and private institutions from online crime.

Now Rwanda has a new cybercrime law. On May 31st, Rwanda’s Chamber of Deputies passed the bill, which is designed to help both the government and the private sector. The law includes new penalties for cyber-attacks according the country’s Penal Code and integrates with the laws established under the Rwandan Ministry of Information Communication Technology.

Agnes Mukazibera, president of the Rwandan parliament standing committee on education, technology, culture and youth said, “We’re currently witnessing an unprecedented global cyber-attack. Attacks that are threatening our economy and our national security.”

Because the new law focuses on criminal penalties for conducting cybercrime, whatever benefit it has to Rwanda’s cybersecurity is dependent on how effective the country’s new $3 million cybersecurity system is. Laws are only as good as their enforcement, and law enforcement can’t catch a cybercrime that they’re unable to detect.

But Rwanda’s cybersecurity infrastructure and professionals have demonstrated a great deal of effectiveness. In 2016, the National Bank of Rwanda says that they were able to stop a rough average of 1,000 cyber-attacks per day which targeted companies, institutions, and private individuals.

I’m rather optimistic about the cybersecurity advances which are being made in this African nation of about 11.2 million people.

Related Resources:

How To Improve Your Company’s Cyber Security Readiness

Why you’re putting your network at risk with a defensive approach to malware

The Seven Advantages of Hiring a Cyber Security Provider

Cyber Security

Cyber Security Solutions

Website Backup

Website Security Check

Website Status

START FREE TRIAL GET YOUR INSTANT SECURITY SCORECARD FOR FREE

Time Stamp:

More from CyberSecurity Comodo