Threat taxonomy
medium activityAPT GroupsFirst seen 2023
RIFT VULTURE
Aliases: Affiliate group VLT
A profit-driven intrusion set applying espionage-grade tradecraft to payment infrastructure, culminating in switch manipulation and coordinated cash-out.
Attribution
Financially motivated, mercenary tradecraft
Primary targets
- — Commercial banks
- — Payment processors
- — ATM networks
Observed tactics
- Exploitation of exposed remote access appliances
- Living-off-the-land lateral movement
- Payment switch configuration abuse
- Mule network coordination around holidays
Regional relevance
Cash-heavy retail banking markets with weekend settlement gaps are an attractive target profile across East Africa.
Detection guidance
- Alert on withdrawal limit or BIN configuration changes
- Correlate switch admin logins with VPN geography
- Monitor for bulk card-not-present anomalies pre-weekend
Related feed reporting
- high07 Sept 2026
Espionage cluster targets regional financial regulators with diplomatic lures
- high17 Aug 2026
Business email compromise targets trade finance desks in the Horn of Africa