Africa: 2023 cyberthreats landscape, next year predictions

In recent years, African countries have been working hard to adopt the 2030 African digital transformation agenda.

Sectors such as finance, education, agriculture, government, security, and manufacturing are actively moving to online platforms and adopting digital technologies to improve their operations.

As technology continues to advance across the continent, it is important to remember that cybersecurity and personal data protection are key principles in making sure the digital transformation project runs smoothly and minimizes the risks that come with it.

The year 2023 saw many cyberattacks across several countries. These attacks targeted important infrastructure, financial institutions, governments, and businesses.

As African countries push for digital transformation and experience rapid economic growth, cybersecurity remains a serious concern for businesses.

Unfortunately, some African countries have weak security systems to fight cybercrime, leaving them vulnerable to cyberattacks. They lack strong prevention mechanisms and effective intrusion detection systems, which puts sensitive transactions at risk.

Financial institutions in particular have seen an increase in the volume and complexity of cyberattacks. According to the 2023 Africa Financial Industry Barometer, 97% of leaders in African financial institutions ranked cybercrime and cybersecurity regulations as the biggest threats to the financial services industry, along with worsening economic conditions.

These cyberattacks pose a serious threat to the region’s economic growth and its critical infrastructure. For example, MTN Nigeria lost $53 million from its mobile money service, forcing the company to take legal action against several banks in Nigeria.

In Kenya, distributed denial of service (DDoS) attacks affected financial institutions and the e-citizen portal. In South Africa, there has been a rise in backdoor and spyware attacks, with over 106,000 attempts recorded.

Cybersecurity incidents like these are happening across many African countries, and there is an urgent need to strengthen protection measures.

Failing to do so could have serious consequences for individuals, businesses, and the overall socio-economic development of the continent.

Africa is not facing this problem alone. In September 2023, other parts of the world also experienced major cyberattacks. For example, on September 6, the travel booking company Sabre suffered a ransomware attack where 1.3 terabytes of data were stolen.

A few days later, on September 11, another ransomware attack on Save the Children resulted in the loss of 6.8 terabytes of data. MGM Resorts also faced a cyberattack that severely impacted its operations.

On September 12, CoinEx, a Hong Kong-based cryptocurrency exchange, lost $70 million due to a cyberattack.

In Africa, the most common cyberthreats in 2023 included insider threats, phishing attacks, mobile malware, ransomware, and man-in-the-middle (MitM) attacks, among others. According to the 2023 Positive Technology report, financial institutions were the most targeted (18%), followed by telecommunications companies (13%), government agencies (12%), and organizations in trade (12%) and industry (10%).

The consequences of these cyberattacks include the loss of customers or business, loss of critical data, threats to national security, damage to reputation, revenue losses, temporary or permanent closures, lawsuits, and time wastage due to system downtime.

Cyberthreat Predictions for 2024

Looking ahead to 2024, reports suggest that Africa will continue to be a major target for cyberattacks. New techniques are expected to emerge, including the use of AI, increased hacktivism, and the targeting of smart home technologies.

New botnets and rootkits may appear, and hacker-for-hire services are likely to rise, along with supply chain attacks.

According to cybersecurity experts, there will likely be more attacks on smart home devices such as home cameras and connected car systems.

These devices are often not well-protected, making them attractive targets for hackers. With more people working from home, weak points in home systems could be exploited to target businesses.

Hacktivism is also expected to increase in many parts of Africa, with hackers launching Distributed Denial of Service (DDoS) attacks, using deepfakes, and spreading disinformation.

Additionally, cybercriminals may develop new methods to automate cyberespionage, gathering information from social media and other online platforms related to their targets.

State-sponsored cyberattacks could also rise due to increasing geopolitical tensions. These attacks could lead to data theft, IT infrastructure damage, espionage, and cyber-sabotage.

Generative AI tools may be used to create more convincing phishing emails, which are often the starting point of cyberattacks on organizations. The use of AI could make these messages more persuasive and tailored to specific individuals, increasing the risk of successful attacks.

Many African countries are still struggling with inadequate cybersecurity measures, insufficient skilled professionals, and a lack of information security laws. Economic challenges also make it difficult for governments to allocate enough funds for cybersecurity.

What Can Be Done?

African governments need to develop, implement, and regularly update national cybersecurity policies and strategies, involving various stakeholders in the process.

Creating a national institution dedicated to cybersecurity is crucial to coordinate activities, monitor threats, and help organizations recover from cyberattacks.

Governments should also work on enacting and enforcing laws that protect personal data and combat cybercrime, ensuring the digital security of citizens and organizations. Regular cybersecurity awareness campaigns are needed to educate people about privacy risks in the digital world.

It is also important for governments to identify critical infrastructure that could be severely affected by cyberattacks. Collaboration between governments and industries is key to strengthening defenses and sharing best practices.

Organizations must adopt best practices for protecting personal and business data. This includes having an updated incident response plan in place, conducting regular cybersecurity training, and testing their systems against attacks.

Implementing strict access controls and using network segmentation can limit the damage from cyberattacks.

In conclusion, as Africa continues its digital transformation journey, improving cybersecurity measures will be essential for protecting the continent’s growing economy, its critical infrastructure, and its people from the increasing threat of cyberattacks.