South Africa accounts for 22% of cyberattacks on the continent and 25% of all dark web messages target organisations in the country, with a particular focus on government entities.
This is according to a recent report by Positive Technologies, a cybersecurity firm, which analysed the current cyberthreats on the African continent for 2023–2024.
According to the open-source data captured from across the continent and interrogated by researchers of the report, which covered the period between the first quarter of last year and the third quarter of 2024, a significant share of cyberattacks happened in South Africa (22%) and Egypt (13%). Meanwhile, analysis of posts on the dark web forums revealed that these messages primarily targeted South Africa (25%), Nigeria (18%), and Algeria (13%).
The results show that attacks against government entities was twice as much as was found in the previous research when looking at all organisations in Africa. 12% of cyberattacks targeting government institutions across Africa occurred in South Africa.
Apart from a rise in attacks on the government sector, there is an increase in the number of attacks on financial companies. These attacks are often carried out by organised hacking groups aiming for financial gain and espionage, as well as by hacktivists. According to Positive Technologies, more than half of the databases related to African countries are distributed for free on the dark web, while access to corporate networks can be bought for an average of $2,970 (R53,784).
In Africa, government and financial institutions make up 29% and 22% of all successful attacks on organisations, respectively. The analysis of messages on the dark web forums confirmed that these sectors attract cybercriminals the most: they account for 19% and 13% of all the darknet listings.
Anastasia Bezborodko, an analyst from the International Analytics Group at Positive Technologies, said “Most often, government institutions are targeted by groups using advanced persistent threats (APTs), accounting for 46% of all threats, which aim to collect data and perform cyberespionage, as well as by hacktivists (18%). Cybercriminals primarily target government institutions in Nigeria (27%), Algeria (17%), Ethiopia (12%), and South Africa (12%), according to dark web data. Attacks on the financial sector also increased, rising from 18% to 22% of all successful attacks. On the dark web, posts related to Africa’s government sector typically mention free distribution of information (66%), while those related to financial institutions focus on selling data and access (64%).”
One in 10 successful cyberattacks on organisations in the region were aimed at the industrial sector. The main goal of these attacks was to disrupt production processes and steal confidential information. Another 10% of attacks targeted telecommunications: cybercriminals are drawn to the vast amounts of personal data and customer payment information.
In attacks on organisations, criminals most often target computers, servers, and network equipment (65%). This points to weak infrastructure protection, such as vulnerabilities in network perimeters and poorly configured services that are externally accessible. Attacks targeting web resources surged from 15% to 27%, with DDoS (Distributed Denial-of-Service) attacks accounting for half.
Malware was the most common method used in cyberattacks, accounting for 43% of attacks on organisations and 53% of attacks on individuals. In almost one-third of successful attacks on companies, cybercriminals used ransomware, and in one out of every four attacks, they deployed spyware. In 18% of attacks on organisations, hackers exploited vulnerabilities.
The most common result of cyberattacks on organisations (61%) and individuals (53%) was hackers accessing confidential information. Another common issue was disruption of core business operations, which occurred in 18% of successful attacks.
Most often, dark web listings feature databases (61%), and more than half of these databases (64%) are given away for free. Criminals also sell data for so major African companies’ networks can be accessed (38% of all analysed dark web messages). Most of these posts (74%) are about selling access, with an average price of $2,970.
In recent years, digital technologies have been implemented across various sectors in Africa, opening up new opportunities for cybercriminals. To increase the region’s cybersecurity and thwart future cybercrimes, experts at Positive Technologies recommend adopting protective measures, such as developing and timely updating cybersecurity strategies and identifying information critical infrastructure, the disruption of which could cause non-tolerable events at industry and national levels.
To ensure cyber resilience, experts recommend that organistions conduct risk analysis, put together a list of events that could cause irreparable damage, regularly update systems and applications, and continuously check the effectiveness and relevance of security mechanisms and tools in place. Organisations should also host educational events to teach employees basic security rules and allocate budgets for training cybersecurity specialists.
To improve cybersecurity, Positive Technologies experts recommend forging strong partnerships between the government and private sectors. Strengthening international collaboration, sharing knowledge, and exchanging experiences on current cyberthreats and protective measures are also crucial.
Follow us on Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
