Threat intelligence for the region’s financial infrastructure
Attack reporting, trend analytics and actor tracking for banks, microfinance institutions, fintechs and telecom-linked wallet providers across Ethiopia and the wider Horn of Africa.
Active campaigns
27
Tracked across the region
Incidents this month
91
+7% against August
Top targeted sector
Banking
34% of reported incidents
Mobile money fraud index
78
High — agent channel pressure
Attack trend, last 12 months
Reported incidents affecting regional financial services, split by extortion and fraud activity.
Initial access vectors
Share of investigated intrusions.
Latest intelligence
View all- criticalCTI-2609-14114 Sept 2026
Credential-harvesting kit impersonates Ethiopian national payment switch
A phishing kit cloning a national retail payment switch operator portal is being distributed to staff at three commercial banks in Addis Ababa. Lures reference an urgent settlement reconciliation and capture operator credentials plus one-time codes in near real time.
- criticalCTI-2609-13813 Sept 2026
SIM swap surge against high-value mobile wallet accounts in Ethiopia and Kenya
Fraud teams at two carriers report a coordinated wave of SIM replacements executed through compromised agent accounts, followed within minutes by wallet drains and merchant cash-out. Agent credentials appear to have been sourced from an earlier infostealer log dump.
- highCTI-2609-13211 Sept 2026
Ransomware affiliate leaks data claimed from a regional microfinance group
An extortion leak site published a 40GB sample attributed to a microfinance group operating in Ethiopia and Djibouti. Sample files include loan books and identity documents, consistent with exfiltration prior to encryption of a virtualised core.
- highCTI-2609-12709 Sept 2026
Core banking vendor discloses compromise of a remote support tool
A core banking software provider serving several African institutions disclosed unauthorised access to its remote support infrastructure. Investigation indicates a stolen maintenance certificate was used to reach customer jump hosts.
- highCTI-2609-11907 Sept 2026
Espionage cluster targets regional financial regulators with diplomatic lures
An intrusion set tracked against Horn of Africa government and financial supervisory bodies is delivering a lightweight downloader via themed conference invitations, followed by long-dwell collection of policy and payment oversight documents.