Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector

Summary: Unit 42 has tracked a cluster it calls CL-CRI-1014 targeting financial organizations across Africa since at least July 2023, using open-source and publicly available tools including PoshC2, Chisel and Classroom Spy to establish tunnels, perform remote administration and move laterally. Researchers assess the actor is acting as an initial access broker, creating footholds in financial institutions to sell access on darknet markets, and disguises its tools by copying file signatures and renaming binaries to mimic legitimate products such as Microsoft, Cortex and VMware.

Bottom line: The actor's business model is selling the foothold, not exploiting it, so a single undetected intrusion at an African financial institution becomes someone else's entry point. The tooling is free and the disguise is a copied signature and a renamed binary, which means the detection gap sits in your endpoint and network controls, not in the attackers' budget.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related