A recent analysis of cybersecurity trends in the Middle East, Turkiye, and Africa (META) region reveals that Kenya, Nigeria, and South Africa are experiencing the highest number of users affected by web incidents, highlighting a critical need for enhanced cybersecurity measures across the continent.
This report, presented by Kaspersky’s Global Research and Analysis Team at their annual Cyber Security Weekend, sheds light on the evolving threat landscape in Africa, encompassing web incidents, ransomware, and the sophisticated tactics employed by advanced persistent threat (APT) groups.
Web Incidents: A Widespread Concern
The first quarter of 2025 saw Kenya with the second-highest number of users affected by web incidents (online threats) across the entire META region at 20.1%. Nigeria and South Africa followed closely, both registering a significant 17.5% of users affected by online threats. While Turkiye led the region with 26.1%, the figures for these African nations underscore a substantial vulnerability to online risks for their digital populations.
Ransomware: A Growing, Targeted Threat
While ransomware remains a destructive cyberthreat globally, its prevalence in Africa is currently lower compared to the Middle East. According to Kaspersky data, the share of users affected by ransomware attacks in Africa saw a modest 0.01 percentage point growth, reaching 0.41% from 2023 to 2024. This lower incidence is attributed to lower levels of digitization and economic constraints, which reduce the number of high-value targets for attackers.
However, as countries like South Africa and Nigeria continue to expand their digital economies, a concerning trend of increasing ransomware attacks is emerging. The manufacturing, financial, and government sectors in these nations are increasingly becoming targets. Limited cybersecurity awareness and resources within many organizations exacerbate their vulnerability. Despite the smaller attack surface in Africa compared to global hotspots, the rise in attacks in key economic players signals a shift in the ransomware landscape.
Sophisticated Threats and Evolving Tactics
Kaspersky experts are actively monitoring 25 APT groups operating in the META region, including well-known entities such as SideWinder, Origami Elephant, and MuddyWater. These groups are increasingly employing creative exploits for mobile devices and developing advanced techniques to evade detection.
The report also highlights significant ransomware trends that are likely to impact the African continent:
- AI-Powered Ransomware: The emergence of groups like FunkSec in late 2024 demonstrates the increasing use of AI tools in ransomware development. FunkSec, operating on a Ransomware-as-a-Service (RaaS) model, employs AI-generated code and flawless comments, likely from Large Language Models (LLMs), to enhance development and bypass detection. Their high-volume, low-cost approach, combined with unusually low ransom demands, showcases an innovative use of AI to streamline operations.
- Exploiting Unconventional Vulnerabilities: Ransomware in 2025 is expected to evolve by targeting overlooked entry points. The Akira gang’s use of a webcam to bypass endpoint detection and response systems exemplifies this trend. Attackers are likely to increasingly focus on IoT devices, smart appliances, and misconfigured hardware in the workplace, capitalizing on the expanding attack surface created by interconnected systems.
- LLMs Lowering the Barrier to Entry: The proliferation of LLMs tailored for cybercrime on the dark web is lowering the technical barrier for creating malicious code, phishing campaigns, and social engineering attacks. This allows less skilled actors to craft highly convincing lures and automate ransomware deployment, further amplifying the threat. The adoption of AI-assisted tools like RPA and LowCode by ransomware developers is also anticipated, making attacks more automated and prevalent.
Sergey Lozhkin, Head of META and APAC regions in the Global Research and Analysis Team at Kaspersky, emphasized the evolving nature of ransomware, noting the adoption of techniques such as cross-platform ransomware, self-propagation capabilities, and even the use of zero-day vulnerabilities. He stressed the importance of a multi-layered defense for organizations, including up-to-date systems, network segmentation, real-time monitoring, robust backups, and continuous user education, to effectively combat these growing threats.
In conclusion, while Africa may currently experience a lower overall prevalence of ransomware, the increasing digital transformation in key economies like Kenya, Nigeria, and South Africa is making them increasingly attractive targets for cybercriminals. The widespread impact of web incidents in these nations, coupled with the sophisticated and evolving tactics of ransomware and APT groups, necessitates urgent and comprehensive cybersecurity strategies to protect users and critical infrastructure across the continent.