Ransomware campaign targeting regional banking sector

Threat actor deploying LockBit-derivative against mid-tier financial institutions. Initial access via exposed VPN appliances. Advisory issued to portfolio clients.

The incident falls within INGO ADVISORY's cyber monitoring stream and has been logged against Kenya. Analysts assess this event at a high severity level based on reported impact, actor intent and proximity to client operations in the sector.

Reporting has been correlated across open-source channels and INGO ADVISORY's in-country liaison networks. Where applicable, information has been cross-checked against INGO ADVISORY cyber threat intel. Analysts continue to monitor secondary indicators including movement of security forces, communications traffic and follow-on incidents in the immediate area.

A cyber advisory has been issued to relevant subscribers. Portfolio clients with personnel, assets or supply-chain exposure in Kenya should review current standing instructions, verify accountability of team members, and confirm that hold, move and evacuate triggers remain valid against the evolving threat picture.