Cyber Threat Intelligence

Curriculum

1. 1

   Introduction to cyber threat intelligence: concepts and levels (strategic, operational, tactical)

   Lecture

   3h
2. 2

   Overview of malicious actors targeting the African financial sector

   Intelligence briefing

   3h
3. 3

   Open sources (OSINT): methods and tools for financial CTI

   Cyber Range lab

   4h
4. 4

   Introduction to MISP: installation, taxonomies, events, sharing

   Cyber Range lab

   4h
5. 5

   The intelligence cycle applied to banking cybersecurity

   Hands-on workshop

   3h
6. 6

   Indicators of compromise (IoC): identification and use

   Hands-on lab

   4h

Skills acquired

• Collect and qualify threat information from open sources
• Use MISP to manage and share IoCs in a financial context
• Produce a cyber threat watch report for the security team
• Distinguish CTI levels and tailor the deliverable to its audience

Curriculum

1. 1

   MITRE ATT&CK for Financial Services: mapping African TTPs

   Cyber Range lab

   5h
2. 2

   Threat Intelligence Platform (TIP): deployment and SIEM/SOAR integration

   Cyber Range lab

   6h
3. 3

   Financial malware analysis: anatomy of a banking trojan, Emotet, Qakbot

   Cyber Range lab (sandbox)

   5h
4. 4

   Dark web monitoring: lawful methods and the African ethical framework

   Supervised demonstration

   4h
5. 5

   Fraud intelligence: SIM swap, vishing, SWIFT fraud (BEC)

   Anonymised real case studies

   4h
6. 6

   Inter-bank intelligence sharing: ISAC, TLP protocol, legal framework

   Collaborative workshop

   4h
7. 7

   Producing operational and strategic CTI reports

   Writing workshop

   4h
8. 8

   CTI file review and coaching

   Coaching

   3h

Skills acquired

• Deploy and operate a CTI platform (MISP + TIP) integrated into a bank's SOC
• Analyse common financial malware in a sandbox
• Produce operational and strategic CTI reports for the CISO and the CEO
• Take part in an inter-institution intelligence sharing mechanism (ISAC)

Curriculum

1. 1

   Advanced attribution and profiling of APT actors targeting African banks

   Cyber Range lab + anonymised real data

   6h
2. 2

   Cyber geopolitics in Africa: state actors, mercenaries, hacktivists

   Expert seminar

   4h
3. 3

   Advanced reverse engineering of financial malware (RE, deobfuscation)

   Cyber Range lab

   6h
4. 4

   Designing and running a CTI programme for a pan-African banking group

   Strategy workshop

   5h
5. 5

   Strategic foresight: emerging threats (AI-powered attacks, deepfake fraud)

   Foresight

   4h
6. 6

   CTI and incident response: operational integration (ROOM#42)

   ROOM#42 exercise

   6h
7. 7

   Research report defence

   Oral examination

   4h

Skills acquired

• Attribute and profile APT groups targeting the African financial sector
• Design and run a CTI programme across a pan-African financial group
• Integrate CTI into real-time incident response (ROOM#42)
• Anticipate emerging threats (offensive AI, deepfake fraud, quantum)

Curriculum

1. 1

   Teaching intelligence: data sensitivity, anonymisation, ethics

   Seminar

   4h
2. 2

   Maintaining CTI labs (MISP, TIP, sandbox) and updating scenarios

   Technical workshop

   6h
3. 3

   Delivering and assessing AFP-CTI from Foundation to Expert

   Demonstration

   11h

Skills acquired

• Deliver the full AFP-CTI track with operational rigour
• Maintain the Cyber Range CTI environments (MISP, TIP, malware sandbox)
• Train the future CTI analysts of the African financial sector