Report library
East AfricaActor assessmentTLP:AMBER
APT Activity in the Horn of Africa: Financial and Government Targeting
21 Jun 2026 · Regional Analysis Team · 38 pages
An assessment of state-aligned and mercenary intrusion activity against government, supervisory and financial targets in the Horn of Africa, with tracked clusters and observed tradecraft.
Key findings
- 01
Collection priorities centre on policy, payment oversight and telecom interconnection.
- 02
Tradecraft remains modest in sophistication but effective due to limited detection coverage.
- 03
Dwell times measured in months are common where endpoint telemetry is not retained.
Affected entities
- — Ministries
- — Financial supervisors
- — Commercial banks
- — Telecom carriers
Threat categories
Indicators of compromise
| Type | Value | Note |
|---|---|---|
| domain | policy-forum-invite[.]org | Conference-themed lure infrastructure |
| sha256 | b310…7f55 | Lightweight downloader used in initial access |
Recommended mitigations
- Retain endpoint and authentication telemetry for at least 12 months
- Alert on external mail forwarding rule creation
- Restrict macro and script execution for policy staff