Reference
Threat Taxonomy
Six tracked categories covering the intrusion, extortion, fraud and infrastructure threats most relevant to regional financial services, with individual entries for each tracked threat.
APT Groups
State-aligned and mercenary intrusion sets conducting espionage and pre-positioning against banks, regulators and telecom carriers.
SABLE IBIS
TA-4471 · Cluster HORN-A
A long-dwell espionage cluster focused on Horn of Africa government bodies, financial supervisors and telecom carriers. Operations favour credential theft and mailbox collection over destructive action.
RIFT VULTURE
Affiliate group VLT
A profit-driven intrusion set applying espionage-grade tradecraft to payment infrastructure, culminating in switch manipulation and coordinated cash-out.
Ransomware
Extortion crews and affiliates encrypting core banking, microfinance and insurance environments, increasingly with data-leak pressure.
Kesari Locker
KSR · Kesari RaaS
A RaaS operation whose affiliates favour virtualised environments, encrypting hypervisor datastores after staging exfiltration through cloud storage providers.
HararCrypt
HC-Locker
A locker build observed in East African incidents, distinguished by localised ransom notes and targeting of file servers holding loan and KYC documentation.
Financial Malware
Banking trojans, ATM/switch malware and web injects designed to divert funds or harvest customer credentials.
Zemen Inject
ZMN web-inject kit
A browser web-inject kit sold with templates for African retail banking portals, capable of real-time session interception and one-time-code relay.
SwitchCrawler
SWC
A modular toolset for enumerating and manipulating card payment switches, including transaction response tampering used to approve withdrawals against blocked accounts.
Mobile Money Fraud
SIM swap, agent collusion, USSD abuse and overlay malware targeting telecom-linked wallets across the region.
AgentDrain
Agent channel abuse cluster
A fraud pattern combining compromised or complicit mobile money agents with SIM replacement to drain high-value wallets and launder proceeds through merchant float.
USSD Phantom
Session hijack kit
Social engineering and overlay tooling that induces customers to approve USSD-initiated transfers while believing they are reversing an erroneous credit.
Supply Chain
Compromise of core banking vendors, managed service providers, payment integrators and open-source dependencies.
VendorWedge
MSP access broker cluster
Brokers who specialise in compromising managed service providers and core banking integrators, then reselling persistent access into downstream financial institutions.
BuildPipe Squat
Registry typosquat campaign
Ongoing publication of malicious lookalike packages for payment, KYC and messaging libraries, aimed at harvesting CI credentials from fintech build systems.
Critical Infra ICS/SCADA
Operational technology exposure across power, water and telecom transmission that underpins financial service availability.
GridHaze
OT reconnaissance cluster
Reconnaissance and pre-positioning activity against power transmission and distribution operators, with no observed destructive payload but persistent access attempts.
PumpControl Probe
Water utility scanning cluster
Broad internet scanning and login attempts against water and facility control systems, occasionally reaching building management platforms at commercial sites.