CYBERCRIMINALS ABUSE OPEN-SOURCE TOOLS TO TARGET AFRICA'S FINANCIAL SECTOR

Summary from the TLDR InfoSec newsletter

Threat actor CL-CRI-1014 has been targeting African financial institutions since July 2023. The attackers use open-source tools (PoshC2, Chisel, and Classroom Spy) and forge file signatures to establish network access. The group operates as initial access brokers, selling compromised financial institution access on darknet markets.