Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector

A series of attacks targeting financial organizations across Africa has been observed since July 2023. The threat actor, tracked as CL-CRI-1014, uses open-source and publicly available tools like PoshC2, Chisel, and Classroom Spy to establish attack frameworks, create tunnels for network communication, and perform remote administration. They forge file signatures to disguise their toolset and mask malicious activities. The attackers are suspected to be acting as initial access brokers, creating footholds in financial institutions to sell access on darknet markets. Their playbook includes lateral movement techniques such as creating remote services, executing through DCOM, and using PsExec. The threat actor also employs evasion methods like using packers and signing tools with stolen signatures.

• The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2Malware2026-08-05
• Spirals: New Stealthy Ransomware Deployed Against Asian IT CompanyMalware2026-07-16
• Potemkin Loader & RMMProject The Anatomy of a ClickFix AttackMalware2026-06-16
• Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin AmericaMalware2026-05-12
• INC and The Gentlemen Ransomware: Exposed AI InfrastructureMalware2026-10-21