According to a recent Kaspersky study, the number of cyberattacks experienced by organisations in the last 12-months is reported to have increased by 29% in South Africa. The most ubiquitous threat came from phishing attacks, with 67% of those questioned in South Africa reporting this type of incident. With AI becoming a more prevalent enabler for cybercriminals, over half of the respondents in South Africa (53%) anticipate significant growth in the number of phishing attacks. In this text, Kaspersky examine how AI is used in phishing and why experience alone is sometimes not enough to avoid becoming a victim.

Personalisation through AI

Previously, phishing attacks relied on a generic mass message sent to thousands, hoping some of the recipients would fall for the bait. AI has changed this into scripting highly personalised phishing emails in large numbers. Using publicly available information like that on social media, job boards, and companies’ websites, these AI-powered tools can generate emails tailored to an individual’s role, interests, and communication style. For example, a CFO might receive a fraudulent email that mirrors the tone and formatting of their CEO’s messages, including accurate references to recent company events. This level of customisation makes it exceptionally challenging for employees to distinguish between legitimate and malicious communications. 

Deepfake technology

AI has also introduced deepfakes into the phishing arsenal. These are increasingly being leveraged by cybercriminals to create fake but highly accurate audio and video messages, crafted to reflect the voice and appearance of the executives they seek to impersonate. For example, in one reported case, attackers used a deepfake to impersonate multiple members of staff during a video conference, convincing the employee to transfer approximately $25.6 million. As deepfake technology continues to advance, it is expected that such attacks will become more frequent and harder to detect. 

Bypassing traditional defenses

Cybercriminals can manipulate the script of traditional e-mail filtering systems with the use of AI. By analysing and mimicking legitimate email patterns, AI-generated phishing emails can bypass security software detection. Machine learning algorithms can test and refine phishing campaigns in real time, enhancing their success rates and making them increasingly sophisticated.

Why experience is not enough

Even experienced employees are falling victim to these advanced phishing attacks. The level of realism and personalisation that AI can achieve may override the skepticism that keeps experienced professionals cautious. Moreover, AI-generated attacks often exploit human psychology, such as urgency, fear, or authority, pressuring employees into acting without double-checking the authenticity of the request.

Combatting AI-hyped phishing

To defend against AI-driven phishing attacks, organisations must adopt a proactive and multi-layered approach that emphasises comprehensive cybersecurity. Regular, up-to-date AI-focused cybersecurity awareness training is critical for employees, helping them identify the subtle signs of phishing and other malicious tactics. Kaspersky Automated Security Awareness Platform can help with such training. Alongside this, businesses should implement robust security tools, such as Kaspersky Next and Kaspersky Security for Mail Server, capable of detecting anomalies in emails, such as unusual writing patterns or suspicious metadata.K

A zero-trust security model also plays a vital role in minimising the potential damage of a successful attack. By restricting access to sensitive data and systems, this approach ensures that even if attackers breach one layer of security, they cannot compromise the entire network. Together, these measures create a comprehensive defense strategy, combining advanced technology with vigilant human oversight.

The post The evolution of AI in phishing attacks: Why even the most experienced can fall victim appeared first on ProtectionWeb.

Highest number of attacks and vectors reported in South Africa

South Africa once again recorded the highest number of DDoS attacks in the region by a considerable margin with 130,931 events, although this has dropped significantly compared to the more than 230,000 incidents seen over the first half of 2024. 

The largest attack peaked at 210.65 Gbps and 20.38 Mpps, with a maximum of 23 attack vectors used in a single incident — the highest in southern Africa – led by TCP ACK, DNS Amplification and TCP SYN/ACK amplification. 

Top targeted industries included computer-related services businesses, insurance agencies and brokerages as well as computing infrastructure providers, reflecting South Africa’s digital maturity and central role in Africa’s online ecosystem. Interestingly, both wired and wireless telecommunications providers, portfolio management companies and commercial banking organisations also rated amongst the 10 most attacked sectors in South Africa.

Mauritius under siege, as DDoS attacks jump by 37 percent

Mauritius continues to be a key local hotspot, registering over 41,800 attacks, a marked increase over the 30,446 incidents in the first half of last year. The wireless telecommunications carriers sector alone accounted for nearly 40,000 incidents, making it one of the most targeted verticals across the region, followed to a lesser degree by wired telecommunications and full-service restaurants. 

Peak throughput reached 35 Mpps and peak bandwidth reached 224 Gbps, confirming the nation’s growing vulnerability due to its increasing digital infrastructure.

Namibia sees fewer attacks but remains regional hotspot

Despite a relatively small population size when compared to other southern African countries, Namibia reported 45,283 attacks, placing it among the top five in the region.  However, this was a noteworthy decrease after the 76,337 experienced in the former half of 2024.

The most used vector was DNS amplification (34,508 incidents), followed by TCP ACK and TCP SYN/ACK amplification. The largest recorded attack reached 30.11 Gbps and 2.88 Mpps. Notably, restaurants were flagged as the number one targeted sector, followed by computer services businesses and wireless telecommunications organisations.

More attacks, greater complexity: Angola’s growing DDoS challenge

With an increased 19,046 DDoS attacks over the 14,281 incidents in the first half of 2024, Angola faced up to 18 distinct vectors in a single event. The DNS amplification vector was dominant (4,753 attacks), with significant use of TCP ACK and TCP SYN as well. 

Wired telecommunications and computing infrastructure providers were the primary victims, with the largest attack hitting 85.94 Gbps and an average duration of 76.13 minutes.

Botswanan telecommunications in the crosshairs

Botswana recorded 981 attacks, which almost exclusively affected wireless telecommunications organisations, with a maximum bandwidth of 2.49 Gbps and average duration of 29 minutes. The dominant vector was TCP SYN/ACK amplification.

Eswatini suffers specific targeting

Eswatini saw 619 incidents over the last six months of 2024; up from 209 for the first half of the year and representing an increase of effectively 200 percent. A number of these attacks were specifically directed toward the real estate sector, suggesting focused rather than opportunistic activity. The average attack duration was shorter than for other southern African countries, at 7.3 minutes, with bandwidth below 1 Gbps.

High intensity strikes in Zimbabwe

Zimbabwe experienced 476 DDoS attacks over the period, with the largest recorded attack reaching a bandwidth of 1.07 Gbps and a throughput of 2.51 Mpps.

Where the country had previously recorded only 189 attacks over the first six months of 2024, telecommunications bore the brunt of high-impact attacks over the second part of the year, experiencing the maximum bandwidth and throughput. This was followed by supermarkets and grocery retailers, as well as one attack on a local sporting goods retail business, which was the longest specific DDoS duration in the country at 37 minutes.

Tech and telecoms under fire in Mozambique

Mozambican organisations were subjected to a total of 425 DDoS attacks, most commonly of the TCP ACK and TCP SYN/ACK amplification variety, a serious reduction in attack frequency after the 3,145 incidents over the first half of the year.

With a peak attack rate of 1.83 Gbps, computer-related services and satellite telecommunications were the two main verticals under attack noted in the 2h 2024 report.

DDoS attacks drop in Zambia

Zambia experienced the lowest number of DDoS events in the region, at 153, down from 428 from January to June 2024, with the largest attack measured at 9.63 Gbps and 0.95 Mpps. 

While relatively low in volume, the attacks were technically diverse, with up to eight vectors used in a single incident. Top vectors included TCP SYN/ACK, TCP ACK and DNS amplification, and almost all attacks were directed at the computer services field. 

Shared vectors and regional trends

“The NETSCOUT data revealed in the second Threat Intelligence Report for 2024 underlines a rapidly evolving DDoS threat landscape across southern Africa, with countries like South Africa, Mauritius and Angola facing high volumes of increasingly sophisticated attacks,” explains Bryan Hamman, regional director for Africa at NETSCOUT. 

“Across the board, TCP ACK, DNS amplification, TCP SYN/ACK amplification and ICMP remain the most used attack vectors within the region, and the practice of multivector attacks in many of the countries shows a shift toward more sophisticated, layered methods designed to bypass standard mitigation measures.

“And even while other countries, such as Zambia and Mozambique, reported fewer incidents, the technical diversity and targeted nature of the attacks reveal a concerning trend toward more calculated and industry-specific campaigns.

“As digital ecosystems across southern Africa expand, so too does the attack surface,” adds Hamman. “Organisations must remain vigilant, investing in proactive threat intelligence and robust, multi-layered cybersecurity strategies to stay ahead of threat actors targeting the region.”

The post Latest NETSCOUT Threat Intelligence Report Reveals Diverse DDoS Threats Across Southern Africa  appeared first on ProtectionWeb.

Who are we? MWR CyberSec is a South African cyber security consultancy with research and bespoke consultancy at the core of what we do. Solving our clients’ unique cyber security challenges and ensuring they are more resilient to cyber-attacks is why we exist and continue to exist.

Some foundational concepts are useful for fully understanding cyber-attacks, so we’ll speed run them. The Lockheed Martin Cyber Kill Chain is a model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective and, at a high-level, details the seven steps that Advanced Persistent Threat (APT) groups often follow during their attacks.

An APT group is a highly skilled and organised team of cyber attackers that conduct prolonged and targeted campaigns to infiltrate specific organisations or nations, aiming to achieve various goals such as: data theft, financial gain, disruption of operations, intelligence gathering, espionage, amongst others.

For APTs, so-called zero-day exploits are the holy-grail because they enable these attackers to infiltrate systems undetected, maintain prolonged access, and extract valuable information without triggering security defences and in a way that bypasses protection mechanisms wholesale. A zero-day exploit is a vulnerability that is unknown to developers and has no available fix, making it a prime target for cyber attackers to exploit before it is patched. As a side-note, to quantify their value, depending on the software systems targeted, zero-day exploits can easily sell for $10 million on exploit development markets.

Cyber-attacks to further a nation states goals have for a long while been the ideas of movies and fiction. However, in the near past (the last decade) this has rapidly moved from an ephemeral idea into real-world actions and scenarios that could play out in pursuit of a nation’s geopolitical goals. We have taken some time in our introductory article to unpack some of these below.

Around 2010, one of the most prevalent examples of cyber warfare and the weaponisation was in full effect, namely the Stuxnet worm. Stuxnet was a powerful computer worm, designed by U.S. and Israeli intelligence, that was used to derail a key part of the Iranian nuclear program by destroying the centrifuges that Iran was using to enrich their uranium. When Stuxnet infected a computer, it would check if it was connected to specific types of Programmable Logic Controllers (PLCs) manufactured by Siemens. PLCs are a fundamental element of many industrial control systems, in this case uranium centrifuges. If no PLCs were detected, the worm did nothing. However, if PLCs were detected, Stuxnet then manipulated the PLCs, which would result in the centrifuges being spun irregularly, and thus damaging or destroying them. After deploying Stuxnet, it was successful and ultimately set the Iranian nuclear program back approximately 2 years.

The only reason Stuxnet was discovered, was because it accidentally spread beyond the Iranian nuclear facility. One of the more notable bits related to Stuxnet is that PLCs are commonly air gapped (i.e. disconnected from external networks, especially the internet) as a hard defensive mechanism. Stuxnet was coded to spread via USB and it would spread to the computers controlling the PLCs via this mechanism. The fundamental take-away from this attack is that even highly secured areas, against an adversary that is dedicated and committed to the cause, are hard to detect and defend successfully 100% of the time.

In a similar manner, could a relatively innocuous piece of tech be used in ways unexpected. A simple question jumps to mind, is it possible to hack a Jeep Cherokee wirelessly from a number of kilometres away? The answer is yes. It was done by two researchers in 2015 who put a journalist behind the wheel and demonstrated their control over the vehicle from a distance. The journalist recounted the experience vividly: “I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold”. The researchers were able to fully take control of the vehicle using only a laptop and an internet connection, leading to them toying with the likes of the air-conditioning, radio, and windshield wipers. But it goes beyond this, the researchers were able to cut all power to the drive train rendering the car useless on the highway and no means to move. They were still able to take this a step further by cutting the Jeep’s brakes, leaving the journalist frantically pumping the pedal as the SUV slid uncontrollably into a ditch.

Furthermore, the control of the vehicle enables surveillance too, providing the capability of tracking a targeted Jeep’s GPS coordinates, measuring its speed, as well as dropping pins on a map to trace its route. If you want to see more, the full video of this endeavour was uploaded to WIRED’s blog. This is an interesting attack avenue as it explores hacking cars, which just about everyone uses in some shape or form on a daily basis and are incorporating more of this sort of technology into them, but regardless back to the more military focused incidents.

A huge step-up in the cyber warfare area has been playing out as part of the Russia Ukraine conflict. The best example of this is the suspected Russian attack on the Viasat KA-SAT network that shut down communications that Kyiv, Ukraine heavily relied upon. The Russian operation resulted in an immediate and significant loss of communication in the earliest days of the war for the Ukrainian military, which relied on Viasat’s services for command and control of the country’s armed forces. The interesting part, this attack was initially launched 1 hour before Russians invaded Ukraine in February 2022. The attack was executed with a new strain of wiper malware called “AcidRain” that was designed to remotely erase vulnerable modems and routers. In the cross-fire of this targeted attack, remote control of 5800 wind turbines belonging to Enercon in Central Europe was also affected. This scenario demonstrated a real example of how cyber-attacks can be targeted and timed to amplify military forces on the ground by disrupting and even destroying the technology used by enemy forces. The Danish defence minister stated that, “The cyber threat is constant and evolving.

Cyber-attacks can do great damage to our critical infrastructure, with fatal consequences”, further highlighting the importance of cyber defence and incident response capabilities. These capabilities don’t explicitly end at the terrestrial. There are companies who can be incredibly technically advanced in the solutions they provide; however, they are not immune to cyber breaches. Cyber security is often neglected until the inevitable happens, they are breached. Russia has attempted attacks against the Starlink systems in order to jam the internet service in Ukraine.

A Belgian cyber security researcher was able to breach Elon Musk’s Starlink satellite system using a simple Raspberry Pi device in conjunction to other electronic components costing the equivalent of 500 ZAR. This is a prime example of the fact that hacking does not always follow the “traditional” path of compromising an individual’s computer or an organisations server, but can instead begin with targeting embedded electronic systems in hardware-based attacks.

A notable ATP group to mention is that of the “Volt Typhoon” group, which has been linked to the Chinese government and active since 2021. The existence of this particular APT group surfaced publicly in May 2023, when Microsoft reported that the group, had targeted US critical infrastructure in espionage operations, and lay dormant within their infrastructure for as long as 5 years. Specifically, this APT group was targeting Operation Technology (OT) systems using zero-day exploits, to pre-position themselves for future attacks of sabotage. This group even demonstrating critical capabilities in compromising Microsoft to see the level of detail that the organisation had on them, during the course of Microsoft raising these events publicly.

In early 2024 the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory that raised concerns about the potential for these threat actors to use their network access for highly disruptive effects in the event of potential geopolitical tensions and/or military conflicts. It is critical to note that no impact from this attack was witnessed in any of the systems they were found to have compromised. This largely indicates a co-ordinated effort, from a highly sophisticated state sponsored actor pre-positioning for maximum damage to enhance geopolitical outcomes. It was noted through the investigation that activity related to this threat actor had gone back, in some cases, in excess of 10 years. Once again highlighting why cyber defensive capabilities are so important. Can you imagine the fallout had this ATP group been able to disrupt critical infrastructure, power stations, water supplies and government infrastructure, within the United States.

MWR has long spoken of the need for organisations to assume that at some point they will be breached, and prepare as such. The reality is an organisation can only prepare for compromise, by having a robust, encompassing and sound cyber security strategy and a capable suite of armaments to deal with this unfortunate scenario. The three pillars of people, process and technology need to be soundly practiced, complementary in all they do and have the ability to rapidly work to contain, eradicate and recover from a cyber security compromise. Unfortunately, in our experience, often the hardest phase for an attacker to complete is the initial phase to gain access. Once in a target environment it is far too common that organisations have minimal controls and restrictions within their internal network. We therefore advise our clients to work backward. Understand what you have that an attacker would want access to, and structure controls, defences and barriers from this point outward towards the external perimeter. Performing this exercise will give you a view you never had of your internal network and how an attacker is likely to target you. This ultimately makes you more robust against their attacks.

From MWR’s experience, what we can say is that you do not want to end up in a position where you have to perform incident response activities to eradicate the threat actor. However, you want to prepare as if you will end up there someday. It can prove to be a very challenging endeavour whilst potentially incurring financial and reputational damage as a result of such a breach. As an example, IBM’s 2024 Cost of a Data Breach report shows data breaches in South Africa cost 53.10 million ZAR per incident, on average. The main driving factors of these costs are business disruption, post-breach customer support as well as remediation. In addition to this non-compliance with regulations also contributes to this number. It is substantially easier to be proactive when it comes to security rather than being forced to become reactive to such events.

Companies developing new technology face near constant attempts to breach their security. Unfortunately, those companies without mature cyber security environments may never realise a breach has occurred, let alone actually respond in an appropriate manner until it is too late. Real-world attackers essentially have “unlimited” time, and if advanced and persistent enough, they will find a way in. Would you be able to respond and eliminate the threat before substantial amounts of damage can be caused, or would you rather take the proactive approach and diminish the chances of ever having to be in such a position?

The post Tactical Typing: The Rise of Cyber Security in Modern Warfare appeared first on ProtectionWeb.

The attack that took down the weather service on January 26 followed a failed attempt the day before, according to South African officials. The breach did not block the service from using its weather forecasting technology, but it did block the service’s ability to report aviation and marine forecasts and shut down its email system and website. The cyberattack also affected Mozambique, Zambia and other countries that rely on South Africa for weather forecasts.

The attack against the South African Weather Service is part of a broader pattern of cyberattacks across the continent. Attacks rose by 37% in 2024 compared to 2023. Worldwide, attacks rose about 30%, according to cybersecurity company Check Point Software Technologies.

As one of the continent’s countries with the highest internet connectivity, South Africa has become a major target for cybercriminals.

“The attack surface has increased, while the attacks by cybercriminals have grown in frequency, strength and severity,” Adius Ncube, a senior advisor with South Africa’s Oliver Wyman risk management company, wrote for the Daily Maverick.

Cyberattacks are also increasingly targeting the nation’s critical infrastructure, including health care systems, utilities and ports, he noted. In 2024, South African organizations and government agencies, on average, each experienced 1,450 cyberattacks a week.

Among the attacks on government institutions, cyberattacks:

• Shut down blood testing at the National Health Laboratory Service, which screens for tuberculosis, HIV/AIDS, mpox, among other things.
• Breached the Companies and Intellectual Property Commission, which handles registration of businesses and intellectual property rights.
• Hacked the Government Employees Pension Fund, Africa’s largest pension fund, worth more than $85 billion.

Even the State Security Agency, which tracks foreign and domestic threats, was not immune from attacks The agency was hacked just days before the 2023 BRICS economic summit.

In a presentation to South Africa’s Parliament last July, Minister in the Presidency Khumbudzo Ntshavheni acknowledged the “exponential increase” in cyberattacks on government institutions and the impact they can have on the economy.

“In our efforts to strengthen cybersecurity, we are hard at work building and strengthening our capabilities and capacity to proactively combat emerging cyberthreats and potential cyberattacks on our communications environment,” Ntshavheni said.

The government will speed up the implementation of its decade-old National Cyber Security Framework to improve the response to attacks, she said

Critics of South Africa’s cybersecurity say that even though the government has made some strides in cyber readiness, including creating a military Cyber Command, more must be done.

“The reality, however, is that other issues have been consistently ranked above cybersecurity,” analysts Joe Devanny and Russell Buchan wrote in 2024 for the Carnegie Endowment.

Ncube is among those calling for the government to invest more in cybersecurity and to take a more strategic approach to protect its online resources.

“While South Africa has yet to experience a truly devastating attack, it’s certainly not immune to one,” Ncube wrote. “Experts agree that in the case of South Africa, as with most countries, it is only a matter of time before the country experiences a highly disruptive attack.”

Even as the government pledges to step up high-level cybersecurity efforts, the true defense against malicious hackers starts with individual users, Ncube noted. For that reason, the government and businesses must educate internet users about the risks they face from cyberattacks. The majority of cyberattacks begin by tricking an individual internet user into opening an innocent-looking email or message.

“While an integrated approach won’t stop every attack, it will prevent many more than allowing organizations in charge of critical infrastructure to each take care of their own cybersecurity needs,” Ncube wrote. “Moreover, such an approach can also help mitigate the impact of any such attack.”

This article was republished with permission from African Defence Review, the original article can be found here.

The post South Africa Faces Increased Cyberattacks Against Government Agencies appeared first on ProtectionWeb.

Bryan Hamman, regional director for Africa at NETSCOUT, explains: “We’re witnessing AI not just as a defence mechanism but also as a potential threat amplifier. The adoption of machine learning allows adversaries to automate reconnaissance and tailor attacks at extraordinary scale.”

In many African countries, digital adoption is outpacing cybersecurity measures, placing businesses, governments and individuals in a precarious position. According to Hamman, without the right proactive measures in place, local organisations risk falling victim to AI-powered threat scenarios, where malware can evade traditional defences, phishing attacks become hyper-personalised and response times shrink dangerously.

“AI can be a double-edged sword, and African businesses must ensure they leverage its benefits for better protection, while steering clear of the darker side of AI by staying a step ahead of attackers,” he advises.

Generative AI (GenAI) can take many facets of cyberthreats to new levels. These could include:

• Enhancements to social engineering, such as:
  • Crafting more convincing and unique phishing emails.
  • Mimicking voices in audio messages.

• Image or video generation:
  • Deepfake images have been shown to trick biometric facial recognition if executed correctly.

• Attack scale:
  • Scaling an attack to be bigger and better is easier than ever due to the automation AI can empower.
  • Automating rudimentary processes, such as sending phishing emails, can allow cyber criminals target more individuals within an organisation to increase their chances of gaining access.

Furthermore, the integration of AI into denial-of-service (DDoS) attacks is becoming a reality, allowing threat actors to optimise botnet behaviour and target selection, making these disruptions more destructive and difficult to mitigate.

NETSCOUT urges organisations to stay vigilant by investing in AI-driven security solutions and fostering a culture of cybersecurity awareness through consistent training. “The key lies in not just reacting to threats, but pre-empting them,” Hamman concludes. “As African markets grow, robust, AI-driven cybersecurity strategies will become increasingly crucial to ensuring that digital innovation is secure and sustainable.”

NETSCOUT’s Arbor DDoS protection assures the world’s largest networks and service providers against DDoS attacks of all shapes and sizes. For more information, click here. 

The post Is AI a game-changer for cyberthreats in Africa? appeared first on ProtectionWeb.

Critical sectors such as telecommunications, finance, transportation, energy, education, and healthcare have been affected, highlighting vulnerabilities in systems essential to the economy. Among the notable incidents in the public sector were attacks on the National Health Laboratory Service and Denel, showcasing the growing sophistication and reach of cybercriminals.

The SSA warns that threats to South Africa’s critical information infrastructure are likely to escalate, driven by the nation’s advanced communications systems, its position in the global community, and evolving geopolitical dynamics. These factors make the country an attractive target for malicious actors seeking to exploit vulnerabilities for financial or strategic gain.

To combat these risks, the SSA has intensified collaboration with public and private sector entities. This coordinated approach aims to monitor, detect, and respond to cyber threats, safeguarding the integrity of critical information infrastructure and maintaining national security.

While these efforts are ongoing, the SSA emphasises that the challenges posed by cybercrime will require continued vigilance and adaptation as the digital landscape evolves.

The post South Africa Faces Escalating Cybersecurity Threats to Critical Infrastructure appeared first on ProtectionWeb.