Having got back from the office after a lengthy & busy couple of days, I settled down to watch Barcelona destroy Bayern Leverkusen in the Champions League. Midway through the one-sided match, I got a call from a friend who asked me to check whether I could access GTB's website from my PC. He complained that he had been trying for the past 12 hours without any joy! My initial suspicion was: either his PC was having issues, or his ISP's DNS servers were screwed but it turned out that I was wrong!

I was least expecting that, even if their website had been hijacked, GTB would not have the requisite recovery capabilities to ensure that the site comes back to life within minutes. Anyway, I decided to see things for myself by jumping on my little malware analysis toy laptop. Well, I did indeed find that the site was redirecting my traffic all over the place. The redirection path is thus: mylife.tk=>domain.dot.tk=>search discovered.com=>searchmagnified.com=> (..etc, etc....) =>cdn.optmd.com.

Even Afrikeo had a pop at them!

How good is this for business? Well, let's imagine that 1000 online transactions of an average value of 10,000 Naira occur on GTB's website every hour. It means that the company loses N10,000,000/hour in transactional value. However, assuming that the site went down just before my friend accessed it at 0900GMT (and still hasn't recovered up till now, which it hasn't) they would have lost N150,000,000 in transactional value. I am not a banker, but assuming the profit margin on this volume is 5%, this represents a loss of N7,500,000. Ok, that's just about enough to pay the annual salary of a middle management staff, but this is an unwanted loss that could have easily been prevented. Besides, GTB's reputation and the confidence of their customers would have taken a bit of a hit, which we cannot put a Naira amount to!

Let's hope our financial organisations learn fast.

Back to the attack; going by my quick analysis, the attacker is focusing on his primary target which is GTBank. User's (secondary targets) are not currently being re-directed to websites hosting malicious codes, but that can change anytime. Before you visit the website, make sure you check the state of your browser and it's plugins here - and do the needful if need be - just in case you're redirected to a website hosting malicious exploit kits

Currently, it looks like a denial of service attack where the attacker is demanding a ransom before handing control of the website back to the legitimate administrator - this is the kind of deep mess you can find yourself in if you fail to guide your critical assets jealously.

One can also make so many educated guesses as to the cause of this incident. The domain does not expire until March 2016, so this isn't the cause of the re-directs. There is a fair chance that the site is running a vulnerable version of Apache which has been exploited as Netcraft shows that the last change (to the site's Apache web server app) occurred yesterday.

Anyhow, let's watch how this event unfolds and hope that our dear GTBankDOTcom recovers on time.