Advanced Persistent Threat (APT) groups operating across Africa continue to focus their attacks primarily on financial services, defence, and government entities, according to new findings from Kaspersky.
The cybersecurity firm reveals that Africa is a key region of focus for a substantial number of the 25 APT groups it has tracked since the start of 2024. While these groups are also observed targeting critical infrastructure, their reach is increasingly extending into commercial and emerging industries across the continent.
Kaspersky’s research shows a diverse threat landscape. For instance, the Griffith group consistently targets the financial services industry across multiple African countries, while SideWinder demonstrates a wide geographic scope and industry reach, mainly focusing on espionage within the region.
Initial access by the majority of APTs targeting African organizations is often gained through socially engineered spear-phishing campaigns. Once inside, these attackers prioritize stealth, frequently masquerading as legitimate services or routine scheduled tasks. This method allows them to remain undetected within networks for extended periods—sometimes months or even years—while gathering intelligence or preparing for further attacks.
“When we analyse APT activities in the region, what stands out is how quickly their methods adapt. We’re seeing attackers experiment with new exploits and expand into uncommon sectors. It’s a clear reminder that no industry or organisation in Africa is off the radar for advanced attackers,” said Maher Yamout, Lead Security Researcher at Kaspersky.
Recommendations for Defense
To help organizations protect their IT infrastructure against sophisticated targeted attacks, Kaspersky security experts recommend the following measures:
- Implement Multilayered Security: Use comprehensive solutions, such as those in the Kaspersky Next product line, and strengthen defenses with enterprise-grade security like the Kaspersky Anti Targeted Attack Platform.
- Monitor Supply Chains: Closely monitor third-party IT service providers and mandate continuous inspection of access within the supply chain.
- Secure Critical Infrastructure: For organizations in the defence and critical infrastructure sectors, specialized solutions like Kaspersky Industrial Cyber Security are essential.
- Utilize Threat Intelligence: Equip cybersecurity teams with up-to-date Threat Intelligence to allow them to stay ahead of APTs.
- Employee Education: Educate employees based on their IT knowledge using cybersecurity courses, such as those available within the Kaspersky Security Awareness Platform.