Operational reporting
Threat Feed
Attack reporting curated for regional financial infrastructure, with severity, source confidence and a recommended defensive action on every item.
12 items
- criticalCTI-2609-141Financial MalwareConfidence: high14 Sept 2026
Credential-harvesting kit impersonates Ethiopian national payment switch
A phishing kit cloning a national retail payment switch operator portal is being distributed to staff at three commercial banks in Addis Ababa. Lures reference an urgent settlement reconciliation and capture operator credentials plus one-time codes in near real time.
Geography
Ethiopia
Sectors
Banking, Fintech
Source
Sensor telemetry + partner sharing
Recommended actionBlock the reported domains at the resolver, enforce phishing-resistant MFA for switch operators, and hunt for logins from hosting-provider ranges.
- criticalCTI-2609-138Mobile Money FraudConfidence: high13 Sept 2026
SIM swap surge against high-value mobile wallet accounts in Ethiopia and Kenya
Fraud teams at two carriers report a coordinated wave of SIM replacements executed through compromised agent accounts, followed within minutes by wallet drains and merchant cash-out. Agent credentials appear to have been sourced from an earlier infostealer log dump.
Geography
Ethiopia, Kenya
Sectors
Telecom, Fintech
Source
Carrier fraud desk reporting
Recommended actionImpose a cooling-off window on transfers after SIM replacement and force credential rotation across the agent channel.
- highCTI-2609-132RansomwareConfidence: moderate11 Sept 2026
Ransomware affiliate leaks data claimed from a regional microfinance group
An extortion leak site published a 40GB sample attributed to a microfinance group operating in Ethiopia and Djibouti. Sample files include loan books and identity documents, consistent with exfiltration prior to encryption of a virtualised core.
Geography
Ethiopia, Djibouti
Sectors
Microfinance, Banking
Source
Leak site monitoring
Recommended actionValidate offline backup restore times for the core lending platform and review hypervisor management plane exposure.
- highCTI-2609-127Supply ChainConfidence: high09 Sept 2026
Core banking vendor discloses compromise of a remote support tool
A core banking software provider serving several African institutions disclosed unauthorised access to its remote support infrastructure. Investigation indicates a stolen maintenance certificate was used to reach customer jump hosts.
Geography
Global
Sectors
Banking, Fintech
Source
Vendor advisory
Recommended actionRevoke and reissue vendor certificates, restrict support access to scheduled break-glass windows, and audit jump host logs for 90 days.
- highCTI-2609-119APT GroupsConfidence: moderate07 Sept 2026
Espionage cluster targets regional financial regulators with diplomatic lures
An intrusion set tracked against Horn of Africa government and financial supervisory bodies is delivering a lightweight downloader via themed conference invitations, followed by long-dwell collection of policy and payment oversight documents.
Geography
Ethiopia, Somalia, Kenya
Sectors
Government, Banking
Source
Incident response engagements
Recommended actionHunt for scheduled tasks launching signed binaries from user profile directories and review outbound traffic to newly registered domains.
- highCTI-2609-112Mobile Money FraudConfidence: high05 Sept 2026
Android overlay malware rebuilt for East African wallet applications
A new build of a commodity overlay trojan includes templates matching wallet and banking apps used in Ethiopia, Kenya, Uganda and Tanzania. Distribution is through sideloaded 'airtime bonus' APKs promoted in messaging groups.
Geography
Ethiopia, Kenya, Uganda, Tanzania
Sectors
Fintech, Banking, Telecom
Source
Mobile threat telemetry
Recommended actionEnable app attestation and root/overlay detection in customer apps and run a customer awareness push on sideloading.
- mediumCTI-2609-104Financial MalwareConfidence: moderate03 Sept 2026
ATM switch manipulation attempt blocked at an East African bank
An attempted cash-out operation used stolen administrative access to a payment switch to raise withdrawal limits ahead of a weekend. Controls flagged the configuration change before mule withdrawals began.
Geography
Kenya
Sectors
Banking
Source
Member institution report
Recommended actionRequire dual authorisation for limit changes and alert on switch configuration edits outside change windows.
- mediumCTI-2608-098Critical Infra ICS/SCADAConfidence: moderate30 Aug 2026
Exposed industrial controllers found on power feeds serving data centres
Internet scanning identified unauthenticated controllers associated with substation and generator monitoring in several East African cities, including sites adjacent to financial data centre campuses.
Geography
Ethiopia, Kenya, Tanzania
Sectors
Energy, Banking
Source
Attack surface scanning
Recommended actionConfirm with facilities providers that OT management interfaces are off the public internet and test failover power procedures.
- highCTI-2608-091Financial MalwareConfidence: high27 Aug 2026
Infostealer logs containing banking VPN credentials sold in bulk
Marketplace listings advertise corporate credentials from African financial institutions, including VPN and webmail access. Sample data indicates infections on unmanaged personal devices used for remote work.
Geography
Ethiopia, Kenya, Nigeria, Uganda
Sectors
Banking, Fintech, Insurance
Source
Underground marketplace monitoring
Recommended actionForce password resets for exposed accounts, block legacy authentication, and restrict VPN access to managed devices.
- mediumCTI-2608-084RansomwareConfidence: moderate24 Aug 2026
Ransomware crew adds double-extortion pressure via regulator notification threats
An extortion group is threatening to notify financial supervisors and customers directly when victims refuse payment, a tactic now observed against institutions in emerging markets including Africa.
Geography
Global
Sectors
Banking, Insurance
Source
Negotiation transcripts
Recommended actionPre-agree regulator and customer communication playbooks so disclosure timing is not dictated by the attacker.
- highCTI-2608-076Supply ChainConfidence: high20 Aug 2026
Open-source payment library typosquat targets fintech build pipelines
Malicious packages mimicking a widely used payment integration library were published to a public registry, exfiltrating environment variables from CI runners during installation.
Geography
Global
Sectors
Fintech
Source
Registry monitoring
Recommended actionPin dependencies, enable registry allow-lists, and rotate any CI secrets exposed to unpinned install steps.
- highCTI-2608-069APT GroupsConfidence: high17 Aug 2026
Business email compromise targets trade finance desks in the Horn of Africa
Fraudulent payment instructions inserted into long-running import financing threads have caused attempted diversions to accounts in the Gulf. Attackers maintained mailbox rules to hide replies from finance staff.
Geography
Ethiopia, Djibouti, Somalia
Sectors
Banking
Source
Member institution report
Recommended actionAlert on mailbox rule creation, enforce out-of-band callback on beneficiary changes, and review trade finance dual controls.