A recent report by Check Point Software Technologies has spotlighted Ethiopia, Nigeria, and South Africa as countries significantly impacted by cyber threats in May 2025. The company’s Global Threat Index for May 2025 reveals a dynamic landscape of cybercrime, with new and persistent threats targeting organizations worldwide.
According to the report, Ethiopia continues to hold the top spot as the most targeted country among the 110 surveyed. Nigeria ranks 5th globally with a Normalised Risk Index of 77.2%, while South Africa, though still impacted, showed improvement, moving down to 47th from 53rd in April. Other African nations heavily targeted include Zimbabwe (7th), Angola (10th), Mozambique (11th), Uganda (13th), and Ghana (20th).
The report highlights the emergence of SafePay, a relatively new and rapidly growing ransomware group, which has overtaken other threats to become the most prevalent actor on the top ransomware group list. SafePay employs a double extortion strategy, encrypting victims’ files and exfiltrating sensitive data to pressure for payment. Despite its non-Ransomware-as-a-Service (RaaS) model, SafePay has listed an unusually high number of victims, indicating a centralized and focused targeting approach.
Meanwhile, FakeUpdates (AKA SocGholish) continues to dominate as the most widespread malware impacting organizations globally. This downloader malware, associated with the Russian hacking group Evil Corp, is spread through drive-by downloads on compromised websites, prompting users to install fake browser updates.
Africa’s telecommunications, government, and financial services sectors are among the most targeted, aligning with the global trend where the education sector remains the most targeted industry. These sectors are vulnerable due to their critical infrastructure and extensive user bases.
Lotem Finkelstein, Director of Threat Intelligence at Check Point Software, emphasized the evolving nature of cyber threats. “May’s Global Threat Index data underscores the growing sophistication of cybercriminal tactics,” stated Finkelstein. “With the rise of groups like SafePay and the persistent threat of FakeUpdates, organizations must adopt proactive, multi-layered security measures. As cyber threats become more advanced, it’s crucial to stay ahead of evolving attacks with real-time threat intelligence and robust defenses.”
The report also touched on a significant operation launched in May by Europol, the FBI, Microsoft, and other partners, targeting Lumma, a prominent malware-as-a-service platform. While thousands of domains were seized, significantly disrupting the operation, Lumma’s core Russia-based servers reportedly remained operational, and developers swiftly restored its infrastructure. Despite this, the operation did cause reputational harm through psychological tactics, though Lumma-related data continues to circulate.
Key Malware Families in May 2025:
FakeUpdates: A downloader malware spread via fake browser updates on compromised websites, often delivering secondary payloads.
Remcos : A Remote Access Trojan (RAT) distributed through malicious documents in phishing campaigns, designed to bypass Windows security.
Androxgh0st: A Python-based malware targeting Laravel PHP framework applications by scanning for exposed .env files containing sensitive credentials.
Top Ransomware Groups:
SafePay: A new and prevalent ransomware group, first observed in November 2024, employing a double extortion model with possible Russian affiliations.
Qilin (Agenda): A Ransomware-as-a-Service operation in Golang, targeting large enterprises and high-value organizations, particularly in healthcare and education.
Play (PlayCrypt): A ransomware group active since June 2022, targeting businesses and critical infrastructure globally by exploiting vulnerabilities and using “living-off-the-land binaries” (LOLBins).
Top Mobile Malware:
Anubis: A versatile Android banking trojan with advanced capabilities including MFA bypass, keylogging, and ransomware functions.
AhMyth: A Remote Access Trojan (RAT) for Android, disguised as legitimate apps, gaining extensive permissions for data exfiltration and surveillance.
Necro: A malicious Android downloader capable of retrieving and executing harmful components, often found in popular and modified apps, potentially leading to ad fraud and proxy botnets.
Top-Attacked Industries Globally:
- Education
- Government
- Telecommunications
May’s data underscores the persistent and evolving nature of cyber threats, emphasizing the critical need for organizations, especially in highly targeted regions like Africa, to implement robust and proactive cybersecurity measures.