Ethiopia Financial Sector Threat Landscape, H2 2026
10 Sept 2026 · Regional Analysis Team · 42 pages
An assessment of intrusion, fraud and availability threats facing Ethiopian banks, microfinance institutions and telecom-linked wallet providers, with a forward view over the next two quarters.
Key findings
- 01
Mobile money fraud remains the highest-volume threat, driven by agent channel credential theft rather than technical compromise of wallet platforms.
- 02
Ransomware impact is concentrated in mid-tier and microfinance institutions where virtualisation is consolidated and offline backups are untested.
- 03
Espionage activity against supervisory bodies has continued at a steady tempo, focused on payment oversight and policy documentation.
- 04
Third-party integrators represent the fastest-growing access path, with shared maintenance credentials a recurring root cause.
Affected entities
- — Commercial banks
- — Microfinance institutions
- — Mobile money providers
- — Financial supervisory bodies
Threat categories
Indicators of compromise
| Type | Value | Note |
|---|---|---|
| domain | switch-reconcile[.]support | Phishing infrastructure impersonating a payment switch portal |
| domain | agent-portal-verify[.]net | Agent credential harvesting |
| sha256 | 9f2b…c471 | Overlay trojan build with regional wallet templates |
| ip | 185.***.***.42 | Staging host reused across phishing waves |
Recommended mitigations
- Phishing-resistant MFA for all payment switch and core banking operators
- Cooling-off period on wallet transfers following SIM replacement
- Quarterly restore testing from offline backups for core lending platforms
- Per-institution vendor credentials with time-boxed access windows