Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A series of attacks targeting financial organizations across Africa has been observed since July 2023. The threat actor, tracked as CL-CRI-1014, uses open-source and publicly available tools like PoshC2, Chisel, and Classroom Spy to establish attack frameworks, create tunnels for network communication, and perform remote administration. They forge file signatures to disguise their toolset and mask malicious activities. The attackers are suspected to be acting as initial access brokers, creating footholds in financial institutions to sell access on darknet markets. Their playbook includes lateral movement techniques such as creating remote services, executing through DCOM, and using PsExec. The threat actor also employs evasion methods like using packers and signing tools with stolen signatures.

Since July 2023, a cybercriminal group identified as CL-CRI-1014 has been conducting targeted attacks against financial institutions across Africa. This threat actor leverages open-source and publicly available tools such as PoshC2, Chisel, and Classroom Spy to build flexible attack frameworks. PoshC2 is a well-known post-exploitation framework used for command and control (C2), Chisel is used to create encrypted tunnels for network communication, and Classroom Spy is a remote administration tool. By combining these tools, the attackers establish persistent footholds within victim networks, enabling remote control and data exfiltration. To evade detection, the attackers forge file signatures, making their malicious tools appear legitimate, and use packers and stolen digital signatures to mask their malware binaries. Their operational playbook includes lateral movement techniques such as creating remote services, executing commands via Distributed Component Object Model (DCOM), and leveraging PsExec for remote code execution. These techniques allow the threat actor to move laterally within compromised networks, escalating privileges and expanding access. The group is suspected to act as initial access brokers, compromising financial organizations and then selling access on darknet markets to other malicious actors. The attack chain involves sophisticated evasion and persistence mechanisms, including the use of scheduled tasks (T1053.005), masquerading (T1036.005), and code injection (T1055). Although no known exploits are currently reported in the wild for specific vulnerabilities, the use of legitimate tools and stolen signatures complicates detection and mitigation efforts. The threat is categorized as medium severity, reflecting the moderate but significant risk posed by these targeted intrusions.

Detailed information about Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector. Get real-time updates, technical details, and mitigation 

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector

Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector

Source: https://unit42.paloaltonetworks.com/cybercriminals-attack-financial-sector-across-africa/

This threat campaign involves cybercriminals leveraging open-source tools to conduct attacks targeting the financial sector across Africa. The campaign was reported by Unit 42, a reputable cybersecurity research group, and shared on the InfoSecNews subreddit. Although specific affected software versions or vulnerabilities are not detailed, the mention of 'rce' (remote code execution) in the newsworthiness assessment indicates that attackers may be exploiting remote code execution vulnerabilities or techniques to compromise systems. The use of open-source tools suggests that attackers are utilizing publicly available software frameworks or utilities, potentially to automate attacks, evade detection, or exploit known weaknesses in financial institutions' infrastructure. The campaign is recent (published June 2025) and has a medium severity rating, indicating a moderate level of threat. No known exploits in the wild have been reported yet, and discussion levels on Reddit are minimal, suggesting that the campaign is either emerging or not widely publicized. The lack of specific technical details such as exploited CVEs or attack vectors limits the granularity of the analysis, but the focus on Africa's financial sector implies targeted attacks on banking systems, payment platforms, or financial service providers, likely aiming at financial gain through fraud, data theft, or disruption.

Detailed information about Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector. Get real-time updates, technical details, and mitigation 

Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector

Reddit Discussion: Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector

DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa

The DangerousSavanna campaign is a prolonged cyber espionage and financial crime operation targeting financial institutions primarily in French-speaking African countries, including Cameroon, Ivory Coast, Morocco, Senegal, and Togo. This campaign has been active for at least two years as of the publication date in September 2022. The attackers employ spearphishing techniques, specifically spearphishing with malicious attachments (MITRE ATT&CK T1193 and T1566.001), to gain initial access into targeted organizations. Spearphishing attachments typically involve sending carefully crafted emails containing malicious documents or files that, when opened, execute malware or exploit vulnerabilities to compromise the victim's system. The threat actor behind this campaign, identified as DangerousSavanna, appears to focus on financial institutions, likely aiming to steal sensitive financial data, credentials, or to conduct fraudulent transactions. Although no known exploits are reported in the wild for this campaign, the persistent nature and targeted approach indicate a sophisticated adversary with a medium threat level. The campaign's geographic focus on French-speaking African countries suggests a regional targeting strategy, possibly motivated by financial gain or geopolitical interests. The lack of specific affected software versions or disclosed vulnerabilities implies that the attack vector relies heavily on social engineering and user interaction rather than exploiting software flaws. The campaign's medium severity rating reflects the moderate but significant risk posed by successful spearphishing attacks, which can lead to data breaches, financial loss, and reputational damage.

Detailed information about DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa. Get real-time updates, technical d

DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Affecting Morocco

Filter Threats

Threats Affecting Morocco

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility