Threat taxonomy
high activityAPT GroupsFirst seen 2021
SABLE IBIS
Aliases: TA-4471 · Cluster HORN-A
A long-dwell espionage cluster focused on Horn of Africa government bodies, financial supervisors and telecom carriers. Operations favour credential theft and mailbox collection over destructive action.
Attribution
State-aligned, regional interest
Primary targets
- — Central banking and supervision
- — Commercial banks
- — Telecom carriers
- — Ministries
Observed tactics
- Spear-phishing with policy and conference lures
- Signed binary proxy execution for loader delivery
- Mailbox rule manipulation and long-term collection
- Use of compromised regional hosting for staging
Regional relevance
Directly relevant to Ethiopian financial supervisory and large commercial bank environments; observed interest in payment oversight documentation.
Detection guidance
- Alert on new inbox forwarding rules to external domains
- Monitor for rundll32/regsvr32 execution from user profile paths
- Baseline outbound connections to newly registered domains
Related feed reporting
- high07 Sept 2026
Espionage cluster targets regional financial regulators with diplomatic lures
- high17 Aug 2026
Business email compromise targets trade finance desks in the Horn of Africa