Positive Technologies, a leader in result-driven cybersecurity, analyzed the current cyber threats on the African continent for 2023–2024.

According to the experts, there has been a rise in attacks on the government sector and financial companies.

These attacks are often carried out by organized hacker groups aiming for financial gain and espionage, as well as by hacktivists.  

The data shows that in Ghana, like the rest of Africa, government and financial institutions make up 29% and 22% of all successful attacks on organisations, respectively.

The analysis of messages on the dark web forums confirmed that these sectors attract cybercriminals the most: they account for 19% and 13% of all darknet listings. 

Anastasia Bezborodko, an analyst from the International Analytics Group at Positive Technologies, noted, "The share of attacks against the government sector among all attacks on organizations in Africa is twice as much as was found in our previous research.

Most often, government institutions are targeted by APT groups (46%) aiming to collect data and perform cyber espionage, as well as by hacktivists (18%).

Cybercriminals primarily target government institutions in Nigeria (27%), Algeria (17%), Ethiopia (12%), and South Africa (12%), according to dark web data. Attacks on the financial sector also increased, rising from 18% to 22% of all successful attacks.

On the dark web, posts related to Africa's government sector typically mention free distribution of information (66%), while those related to financial institutions focus on selling data and access (64%)." 

According to Positive Technologies, more than half of the databases related to African countries are distributed for free on the dark web, while access to corporate networks can be bought for an average of 2,970 USD. 

One in 10 successful cyberattacks on organisations in the region targeted the industrial sector. The main goal of these attacks was to disrupt production processes and steal confidential information.

Another 10% of attacks targeted telecommunications: cybercriminals are drawn to the vast amounts of personal data and customer payment information. 

In attacks on organizations, criminals most often targeted computers, servers, and network equipment (65%).

This points to weak infrastructure protection, such as vulnerabilities on network perimeters and poorly configured services that are accessible externally.

Attacks targeting web resources surged from 15% to 27%, with DDoS attacks accounting for half. 

Malware was the most common method used in cyberattacks, accounting for 43% of attacks on organizations and 53% of attacks on individuals.

In almost one-third of successful attacks on companies, cybercriminals used ransomware, and in one out of every four attacks, they deployed spyware. In 18% of attacks on organizations, hackers exploited vulnerabilities.

The most common result of cyberattacks on organizations (61%) and individuals (53%) was hackers accessing confidential information.

Another common issue was disruption of core business operations, which occurred in 18% of successful attacks. 

According to open-source data, a significant share of cyberattacks happened in South Africa (22%) and Egypt (13%).

Meanwhile, analysis of posts on the dark web forums revealed that these messages primarily targeted South Africa (25%), Nigeria (18%), and Algeria (13%).

Most often, dark web listings feature databases (61%), and more than half of these databases (64%) are given away for free.

Criminals also sell data for accessing the networks of major African companies (38% of all analyzed dark web messages). Most of these posts (74%) are about selling access, with an average price of $2,970. 

In recent years, digital technologies have been implemented across various sectors in Africa, opening up new opportunities for cybercriminals.

To increase the region's cybersecurity and thwart future cybercrimes, experts at Positive Technologies recommend adopting protective measures, such as developing and timely updating cybersecurity strategies and identifying critical information infrastructure, the disruption of which could cause non-tolerable events at industry and national levels.

To ensure cyber resilience, experts recommend that organizations conduct risk analysis, put together a list of events that could cause irreparable damage, regularly update systems and applications, and continuously check the effectiveness and relevance of security mechanisms and tools in place.

Organisations should also host educational events to teach employees basic security rules and allocate budgets for training cybersecurity specialists. 

To improve cybersecurity, experts recommend forging strong partnerships between the government and private sectors. Strengthening international collaboration, sharing knowledge, and exchanging experiences on current cyber threats and protective measures are also crucial.