Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector

Unit 42 describes CL-CRI-1014, a cluster of activity targeting financial organizations in Africa that appears to act as an initial access broker: actors use publicly available tools (PoshC2, Chisel, Classroom Spy), packers, stolen signatures and evasion techniques to gain footholds, move laterally, establish persistence, and create tunnels/proxies for C2; the report includes technical analysis, examples of tactics and artifacts, and multiple IOCs (file hashes and domains) to aid detection and mitigation.