Anatomy of a Targeted Cyberattack against a Nigerien Public Institution: Email Impersonation, Extension Masquerading and Infostealer Deployment
Mahamadou Dalla Azimi *
Department of Mathematics and Computer Science, Cheikh Anta Diop University, BP 5005, Dakar, Senegal.
Boudal Niang
e-INOV laboratory, Multinational High School of Telecommunications, BP 10000, Dakar, Senegal.
Ismaila Diakhate
e-INOV laboratory, Multinational High School of Telecommunications, BP 10000, Dakar, Senegal.
Mahamane Djamilou Salissou Dango
Department of Mathematics and Computer Science, Abdou Moumouni University, BP 237, Niamey, Niger.
Ibrahim Laminou Kombi
Soil and Geological Sciences Department, College of Agriculture, Sokoine University of Agriculture, PB 3008, SUA, Morogoro, Tanzania.
*Author to whom correspondence should be addressed.
Abstract
Background: In Africa, online scams, particularly phishing, are the most frequently reported form of cybercrime. Spear-phishing incidents may combine identity deception with misleading file extensions, while incomplete forensic records constrain incident attribution.
Aims: This study examines a targeted cyberattack against a Nigerien public institution between December 2022 and January 2023.
This case study analyses a spear-phishing attack against a Nigerien public institution.
Study Design: Single case study.
Place and Duration of Study: A Nigerien public institution, December 2022 – January 2023.
Methodology: Each claim is linked to the artefact on which it rests and graded on four levels: established, established but not inspectable, exploratory and inferred.
Results: The attack combined impersonation of a business partner, messages appearing to be sent from the institution’s domain, an executable concealed behind a spreadsheet extension and a payload detected as belonging to the FormBook family. The artefacts establish initial access through an attachment and masquerading by double file extension (T1036.007), not by right-to-left override (T1036.002); user execution rests on the authors’ findings; credential collection and exfiltration are inferred from the family’s documented profile. In the absence of routing headers, a compromise of internal accounts cannot be distinguished from spoofing of the ‘From’ field. The article proposes a decision table for discriminating between masquerading sub-techniques and lists the cues available to the recipient.
Conclusion: In this case, the non-retention of email headers and logs prevented the incident from being fully characterised.
Keywords: Spear phishing, email impersonation, sender spoofing, double file-extension masquerading, FormBook, XLoader, MITRE ATT&CK, email forensics