Cyber Criminals Utilize Open-Source Tools to Target African Financial Institutions
June 26, 2025
Threat Intelligence / Ransomware
Recent investigations have revealed a troubling trend of cyber attacks aimed at financial institutions across Africa, with reports indicating that this wave of attacks began as early as July 2023. Cybersecurity experts at Palo Alto Networks’ Unit 42 have identified these incidents under the designation CL-CRI-1014. Within this designation, “CL” stands for “cluster,” while “CRI” refers to the “criminal motivation” behind these activities. The primary objective of these attacks appears to be the initial access of systems, which attackers then sell to other criminal entities on underground marketplaces, thus operating as initial access brokers (IABs).
The methods employed in these attacks highlight the sophistication of the threat actors. Researchers Tom Fakterman and Guy Levi observed that these perpetrators often forge signatures from legitimate applications to disguise their tools. This technique allows them to mask their operations, enhancing their ability to evade detection. The exploitation of authentic product signatures illustrates a common tactic employed by malicious actors to obscure their malicious intentions while leveraging publicly available resources.
The attack methodology has involved the deployment of various open-source tools, with one notable example being PoshC2, known for its capabilities in command-and-control operations. Such tools provide the attackers with a strategic advantage, allowing for persistent access to targeted networks and the ability to execute a range of malicious actions. The nature of these actions can include information theft, data manipulation, and further exploitation of the compromised systems.
Targets of these cyber attacks have primarily included financial institutions, which are particularly enticing to cybercriminals due to the sensitive data they process and their financial assets. The implications of these breaches not only affect the direct targets but also pose risks to customers and the broader financial ecosystem within the affected countries. By infiltrating these institutions, attackers aim to extract confidential information and, ultimately, financial gain.
In terms of tactical frameworks, the strategies seen in these attacks align with several tactics defined in the MITRE ATT&CK Matrix. Initial access techniques likely include spear phishing and exploitation of software vulnerabilities, while persistence is maintained through implanted backdoors and scheduled tasks. Additionally, privilege escalation techniques may enable attackers to assume greater control over compromised systems.
Organizations exposed to these threats are urged to adopt comprehensive cybersecurity measures and to remain vigilant in monitoring their systems for unusual activities that may indicate compromise. The increasing sophistication of cybercriminals leveraging open-source tools serves as a stark reminder of the evolving landscape of cybersecurity threats. As attacks continue to evolve, a proactive stance is essential in safeguarding sensitive information and maintaining operational integrity.
