Anatomy of a Targeted Cyberattack against a Nigerien Public Institution: Email Impersonation, Extension Masquerading and Infostealer Deployment

Background: In Africa, online scams, particularly phishing, are the most frequently reported form of cybercrime. Spear-phishing incidents may combine identity deception with misleading file extensions, while incomplete forensic records constrain incident attribution. Aims: This study examines a targeted cyberattack against a Nigerien public institution between December 2022 and January 2023. This case study analyses a spear-phishing attack against a Nigerien public institution. Study Design: Single case study. Place and Duration of Study: A Nigerien public institution, December 2022 – January 2023. Methodology: Each claim is linked to the artefact on which it rests and graded on four levels: established, established but not inspectable, exploratory and inferred. Results: The attack combined impersonation of a business partner, messages appearing to be sent from the institution’s domain, an executable concealed behind a spreadsheet extension and a payload detected as belonging to the FormBook family. The artefacts establish initial access through an attachment and masquerading by double file extension (T1036.007), not by right-to-left override (T1036.002); user execution rests on the authors’ findings; credential collection and exfiltration are inferred from the family’s documented profile. In the absence of routing headers, a compromise of internal accounts cannot be distinguished from spoofing of the ‘From’ field. The article proposes a decision table for discriminating between masquerading sub-techniques and lists the cues available to the recipient. Conclusion: In this case, the non-retention of email headers and logs prevented the incident from being fully characterised.