“The OTO hereby invites written comments on the eFiling profile hijacking draft report. By inviting public participation, the OTO aims to develop a robust and effective response to eFiling profile hijacking, thereby ensuring protection of taxpayers’ rights and enhancing trust in South Africa’s tax administration system,” the OTO said in a statement on Wednesday 1 October 2025.

The draft report was drafted by the ombud following its investigation into alleged eFiling profile hijacking.

“Between 3 February and 5 March 2025, the OTO conducted the eFiling Profile Hijacking Survey to capture taxpayers’ experiences and challenges related to eFiling profile hijacking. Preliminary findings from the survey were presented during a public workshop held on 28 May 2025.

“Initially, the OTO planned to publish the draft report for public comment in July 2025. However, SARS formally requested additional time to respond to the draft report and its recommendations. Consequently, on 2 July 2025, the OTO announced that the publication of the draft report would be postponed to 31 August 2025. Due to ongoing and extensive engagements with SARS, the publication was further delayed,” the statement read.

The report’s key findings include:
• eFiling profile hijacking is most prevalent among tax practitioners and individual taxpayers.
• The majority of cases involve Personal Income Tax and Value-Added Tax (VAT).
• Fraudulent transactions typically involve amounts under R10 000 but can reach up to R100 000.
• Vulnerabilities include inadequate authentication processes, challenges in fraud detection, delayed SARS response times, insider threats, and low digital security awareness among taxpayers.

The key recommendations include:
• South African Revenue Service (SARS): Enhance authentication protocols, improve fraud detection and refund verification systems, boost taxpayer education, and strengthen collaboration with banks, the Companies and Intellectual Property Commission (CIPC), and the South African Police Service (SAPS).
• Tax Practitioners: Implement stricter controls on third-party access and uphold high professional conduct standards.
• Taxpayers: Use strong passwords, activate two-factor authentication, and regularly monitor eFiling profile activities.
• National Treasury: Amend certain provisions in the Tax Administration Act and establish an Inspector-General as recommended by the Nugent Commission of inquiry.
• South African Reserve Bank: Investigate banking irregularities linked to eFiling profile hijacking.

The draft report can be accessed at https://www.taxombud.gov.za/oto-draft-report-on-the-investigation-into-alleged-efiling-profile-hijacking/

Written comments can be sent via: communications@taxombud.gov.za and for more information, visit www.taxombud.gov.za before the deadline on 31 October 2025.

The post Office of the Tax Ombud invites public comment on eFiling Profile Hijacking appeared first on ProtectionWeb.

This is according to cybersecurity and digital privacy company Kaspersky, which said it detected and blocked over 142 million phishing link clicks in Q2 2025, a 3.3% increase globally and a 25.7% increase in Africa from Q1.

AI has elevated phishing into a highly personalised threat, Kaspersky said. Large language models (LLMs) enable attackers to craft convincing emails, messages and websites that mimic legitimate sources, eliminating grammatical errors that once exposed scams. AI-driven bots on social media and messaging apps impersonate real users, engaging victims in prolonged conversations to build trust. These bots often fuel romantic or investment scams, luring victims into fake opportunities with AI-generated audio messages or deepfake videos.

Attackers also create realistic audio and video deepfake impersonations of trusted figures — colleagues, celebrities or even bank officials — to promote fake giveaways or extract sensitive information. For instance, automated calls mimicking bank security teams use AI-generated voices to trick users into sharing two-factor authentication (2FA) codes, enabling account access or fraudulent transactions. Additionally, AI-powered tools analyse public data from social media or corporate websites to launch targeted attacks, such as HR-themed emails or fake calls referencing personal details.

Employing new tactics to bypass detection

Phishers are deploying sophisticated methods to gain trust, exploiting legitimate services to prolong their campaigns. For instance, Telegram’s Telegraph platform, a tool to publish long texts, is used to host phishing content. Google Translate’s page translation feature generates links that look like https://site-to-translate-com.translate.goog/… and are used by attackers to bypass security solutions’ filters.

Attackers now also integrate CAPTCHA, a common anti-bot mechanism, into phishing sites before directing users to the malicious page itself. By using CAPTCHA, these fraudulent pages deflect anti-phishing algorithms, as the presence of CAPTCHA is often associated with trusted platforms, lowering the likelihood of detection.

A switch in hunting: From logins and passwords to biometrics and signatures

The focus has shifted from passwords to immutable data. Attackers target biometric data through fraudulent sites that request smartphone camera access under pretexts like account verification, capturing facial or other biometric identifiers that cannot be changed. These are used for unauthorised access to sensitive accounts or sold on the dark web. Similarly, electronic and handwritten signatures, critical for legal and financial transactions, are stolen via phishing campaigns impersonating platforms like DocuSign or prompting users to upload signatures to fraudulent sites, posing significant reputational and financial risks to businesses.

“The convergence of AI and evasive tactics has turned phishing into a near-native mimic of legitimate communication, challenging even the most vigilant users. Attackers are no longer satisfied with stealing passwords — they’re targeting biometric data, electronic and handwritten signatures, potentially creating devastating, long-term consequences. By exploiting trusted platforms like Telegram and Google Translate, and co-opting tools like CAPTCHA, attackers are outpacing traditional defences. Users must stay increasingly sceptical and proactive to avoid falling victim,” said Olga Altukhova, security expert at Kaspersky.

Earlier in 2025 Kaspersky detected a sophisticated targeted phishing campaign which was dubbed Operation ForumTroll, as attackers sent personalised phishing emails inviting recipients to the “Primakov Readings” forum. These lures targeted media outlets, educational institutions and government organisations in Russia. After clicking on the link in the email, no additional action was needed to compromise their systems: the exploit leveraged a previously unknown vulnerability in the latest version of Google Chrome. The malicious links were extremely short-lived to evade detection and in most cases ultimately redirected to the legitimate website for “Primakov Readings” once the exploit was taken down.

To be protected from phishing, Kaspersky recommends:

Verify unsolicited messages, calls, or links, even if they appear legitimate. Never share 2FA codes.
Scrutinise videos for unnatural movements or overly generous offers, which may indicate deepfakes.
Deny camera access requests from unverified sites and avoid uploading signatures to unknown platforms.
Limit sharing sensitive details online, such as document photos or sensitive work information.

The post Phishing evolves with AI and stealth appeared first on ProtectionWeb.

In a joint statement issued on Friday 26 September, SARS and the OTO responded to a recent Sowetan article highlighting an increase in cybercriminals targeting taxpayer profiles and resulting in financial losses.

The institutions noted that at the time of publication, the OTO’s draft report had not yet been released for public comment and that the article contained “a number of factual inaccuracies.”

The organisations emphasised their distinct but complementary roles in South Africa’s tax administration. They are established in law to fulfil distinct yet mutually reinforcing roles for the sole benefit of taxpayers and the tax finance system for the country.

“SARS not only respects but considers the role of the OTO as an indispensable partner to ensure the functioning of the tax ecosystem is fair and beyond reproach. In this regard SARS has and continues to work hard to address whatever complaints that have been laid with the OTO,” the statement read.

The statement also emphasised that the two institutions play a paramount role in the functioning of tax administration. Each institution respects the other’s mandate, while both being the cornerstone for the fiscal integrity of South Africa tax ecosystem.

The OTO will release its draft report on 1 October 2025, following extensive engagement with all stakeholders.

Rising cybercrime risks

The OTO has been investigating compromised taxpayer profiles for more than a year, after receiving numerous complaints from both individuals and tax practitioners.

“In today’s digitally interconnected environment, cybersecurity risks have escalated dramatically, posing significant threats to individuals, businesses, and institutions.

“As personal and financial transactions increasingly migrate online, malicious actors exploit vulnerabilities in authentication protocols, data-sharing mechanisms, and user behaviour to perpetrate identity theft, fraud, and unauthorised system access. Even routine activities, such as accessing tax platforms or updating banking details, have become potential gateways for exploitation,” the statement said.

It added that SARS, as the custodian of revenue collection and refunds payment, is a prime target for cybercriminals exploiting vulnerabilities in online systems.

Cooperation and security measures

SARS and the OTO stressed that they maintain a cooperative relationship, with a shared goal of restoring public confidence in the eFiling system.

SARS said it continues to enhance security protocols to mitigate risks and urged taxpayers to remain vigilant by safeguarding login details and reporting suspicious activity through official channels.

“The release of the OTO’s draft report has been delayed allowing SARS to provide detailed input on preliminary findings, ensuring a comprehensive and balanced analysis.

“Whilst consultations have been extensive between the parties, parts of the draft may still carry areas of difference, which is to be expected in any review of this nature. This cooperative approach aims to strengthen the report’s recommendations and foster meaningful improvements,” the statement added.

Commitment to taxpayers

Both SARS and the OTO reiterated their unwavering commitment to enabling taxpayers to comply with their obligations safely and confidently.

The institutions urged taxpayers to remain cautious and report any irregularities through official SARS channels.

“We respect that the final report by the OTO will be made public soon, and SARS remain committed to continue its engagement with the public on its substance. The public must be assured though, that SARS continue to work with diligence to ensure the highest level of integrity and protection to taxpayers who uses the SARS digital platform,” SARS Commissioner Edward Kieswetter said.

The Tax Ombud added that OTO takes the hijacking of taxpayer eFiling profiles very seriously.

“As an independent institution, the OTO ensures objective oversight and the fair treatment of taxpayers. The OTO upcoming draft report reflects extensive engagement with all stakeholders and is aimed at driving real, practical solutions,” OTO said.

The post SARS, Tax Ombud join forces against cybercrime appeared first on ProtectionWeb.

The crackdown targeted transnational criminal networks exploiting digital platforms, particularly social media, to manipulate victims and defraud them financially, Interpol said. Specifically, the operation focused on romance scams, where perpetrators build online relationships to extract money from victims, and sextortion, in which victims are blackmailed with explicit images or videos.

During Operation Contender 3.0 (28 July – 11 August 2025) across Angola, Benin, Burkina Faso, Cote d’Ivoire, Gambia, Ghana, Guinea, Kenya, Nigeria, Rwanda, Senegal, South Africa, Uganda and Zambia, police identified IP addresses, digital infrastructures, domains and social media profiles linked to members of the scam syndicates. These leads and the subsequent arrests also resulted in the seizure of USB drives, SIM cards and forged documents, as well as the take down of 81 cybercrime infrastructures across Africa.

Investigators identified 1 463 victims linked to the scams, estimating their losses at nearly US$2.8 million.

The transnational operation was strengthened by collaboration with private sector partners Group-IB and Trend Micro, resulting in enhanced data sharing and operational capabilities. The exchange of Interpol cyber activity reports facilitated swift enforcement actions from participating countries, underscoring the value of international cooperation in combating cybercrime, Interpol said.

“Cybercrime units across Africa are reporting a sharp rise in digital-enabled crimes such as sextortion and romance scams. The growth of online platforms has opened new opportunities for criminal networks to exploit victims, causing both financial loss and psychological harm. By working closely with our member countries and private sector partners, we remain committed to disrupting and dismantling the groups that prey on vulnerable individuals online,” said Cyril Gout, Acting Executive Director of Police Services at Interpol.

Ghanaian authorities arrested 68 individuals, seized 835 devices and identified 108 victims. Their investigations revealed US$450 000 in financial losses, with US$70 000 recovered. For romance scams the suspects had used fake profiles, forged identities and stolen images to deceive victims. The scammers extracted payments using a range of schemes, including fake courier and customs shipment fees. In sextortion cases, offenders secretly recorded intimate videos during explicit chats and used them for blackmail.

In Senegal, police arrested 22 suspects, uncovering a network that impersonated celebrities and used emotional manipulation on social media and dating platforms to defraud 120 victims of approximately US$34 000. A total of 65 devices, forged identification documents and money transfer records were seized during the operation.

Police in Cote d’Ivoire dismantled a cybercrime ring that created fake profiles online to manipulate vulnerable individuals into sharing intimate images. Once in possession of compromising material, the criminals blackmailed victims, demanding payments to prevent public exposure. Police arrested 24 suspects, seized 29 devices and identified 809 victims.

In Angola authorities arrested 8 individuals and identified 28 domestic and international victims, primarily targeted via social media. Offenders used fraudulent documents to create fake identities, facilitating financial transactions and concealing their real identities while engaging victims.

Operation Contender 3.0 was funded by the United Kingdom’s Foreign, Commonwealth and Development Office, under the African Joint Operation against Cybercrime project.

In June, Interpol released the 2025 Africa Cyberthreat Assessment Report, revealing that two-thirds of surveyed African member countries said cyber-related offences make up a medium-to-high proportion of all crimes.

The post 260 suspected scammers arrested in pan-African cybercrime operation appeared first on ProtectionWeb.

Deepfakes began to be widely created in 2017 after they’d first appeared on Reddit, a discussion website of forums where people exchange information. A Reddit user called Deepfakes shared an AI software tool that could superimpose celebrities’ faces on pornographic videos. AI-generated media became widely accessible through software apps that enable people to freely create deepfakes.

There are several types of deepfakes:

text deepfakes in the form of fake receipts and identification documents

photo deepfakes, often swapping faces and bodies using apps to create memes

audio deepfakes, where text-to-speech apps are used for voice cloning, often targeting politicians

video deepfakes, where face and movement are transferred onto someone else’s video, commonly used to create “revenge pornography”.

Deepfakes pose three main dangers:

They deceive audiences into believing fabricated media.

They enable cybercrimes, reputational harm and misrepresentation.

They can be published by anyone, including anonymous social media users.

The key issue is how law can protect people from the illegal use of their images, voices, and likenesses in deepfakes.

Since 2020, I have looked at laws that regulate deepfakes in South Africa and their implementation. My findings show that the biggest problem with deepfakes is law enforcement, rather than any lack of laws that prohibit the unlawful creation and distribution of deepfakes.

Deepfake threats

South Africa has seen notable cases that highlight the growing impact of deepfakes. In 2024, Leanne Manas, an award-winning South African broadcast anchor, was a victim when her image was used in fake endorsement of weight loss products and online trading on Facebook and TikTok.

South African-born businessman Elon Musk also appeared in a deepfake video that induced many South Africans to invest in a financial scam that promised high returns.

In 2025, Professor Salim Abdool Karim, the director of the Centre for the AIDS Programme of Research in South Africa, appeared in a deepfake video showing him making anti-vaccination statements while endorsing counterfeit heart medicine.

Legal protection in South Africa

South Africa has a mixed legal system that combines constitutional rights, legislation and common law rules to provide deepfake victims with remedies.

There are laws that provide remedies in both civil and criminal cases. For example:

Cybercrimes Act 19 of 2020: criminalises electronic publication of intimate private images without consent.

Electoral Act 73 of 1998: bans publishing false information to influence elections.

Films and Publications Act 65 of 1996: prohibits online distribution of private sexual photographs and films to cause harm.

Protection of Personal Information Act: prohibits misuse of personal information that infringes privacy.

Common law remedies

Anyone can claim violation of privacy if their private images are used without permission. They can also enforce their right to identity if a deepfake misrepresents them or gives a perpetrator commercial advantage.

I investigated these principles in an article about the impact of deepfakes on the right to identity in South Africa. Using South African cases, I found that the unauthorised use of a person’s identity attributes in a deepfake deserves protection.

The Supreme Court of Appeal confirmed, in Grütter v Lombard, that South African law protects a person’s identity from being exploited without permission. And this protection is supported by the constitutional guarantee of human dignity. Grütter and Lombard once practised on the same premises under the name “Grütter and Lombard”, but Grütter later left. Lombard kept using Grütter’s name without consent. The court ordered him to stop as it falsely implied an ongoing professional association and infringed Grütter’s right to identity.

In another case, a surfer’s magazine called ZigZag published a photo of a 12-year-old girl as a pin-up cover image. The court stressed that the key issue was whether an image was exploited for another’s benefit without consent. The defendants were ordered to pay compensation and costs.

Another case is that of South African television personality, beauty pageant titleholder, businesswoman and philanthropist Basetsana Kumalo. She sued a business that took photos of her while she was shopping in their store and used those images in an advertisement for their products without her permission. The court ruled that using someone’s likeness for false endorsements infringes identity and privacy, because it creates the misleading impression of support for the product, service or business.

These cases fit squarely into the deepfakes misuses, showing that false endorsement, election disinformation and non-consensual pornography on social media can trigger liability.

Enforcement challenges

While South African law provides remedies against deepfakes, four hurdles frustrate enforcement:

South African courts have capacity constraints and struggle to resolve backlogs.

Litigation remains a “rich man’s” option. The poor struggle to access justice or wait too long for pro bono help.

While South African courts can assert jurisdiction over global platforms like Meta and TikTok, serving court orders abroad and compelling compliance is still costly, and takedown notices are often enforced too late.

Perpetrators hide behind fake profiles and are hard to trace through the South African Police Service. Social media companies delay revealing the perpetrators’ true identities upon request.

These enforcement challenges can be addressed through capacity building and legal reform. AI research centres should work with law enforcement to train personnel and provide practical skills and tools for tracing and authenticating deepfakes. Parliament must update social media laws so that platforms are directly accountable for fast and fair action when people’s identities are misused in deepfakes.

Legal rules should set minimum standards that deepfake apps and platforms must follow. Rather than relying on age restrictions or consent alone, the law should require these tools to embed watermarking to signal that content is a deepfake, enable tracing of where it comes from, and make sure takedown systems actually work.

Justice on paper

South African law clearly prohibits the misuse of identity through deepfakes, but enforcement gaps leave victims exposed. Without affordable legal access, faster platform accountability, and effective international cooperation, illegal deepfakes will continue to increase.

Written by Nomalanga Mashinini, Senior Lecturer, University of the Witwatersrand.

Republished with permission from The Conversation. The original article can be found here.

The post Deepfakes and South African law: remedies on paper, gaps in practice appeared first on ProtectionWeb.

Border Security Deployment

In December 2023, government committed to recruiting 400 junior border guards to bolster frontline security. By June 2025, 395 recruits had successfully completed training and were deployed to major border posts and airports.

Deployment figures show that:

• Beitbridge received 100 officers

• Lebombo received 90 officers

• OR Tambo International Airport received 30 officers

• Other high-risk points such as Maseru Bridge, Oshoek and Ficksburg received between 20 and 30 each

Smaller allocations were made to posts including Platjan, Tshidilamolomo, Telle Bridge, and Vioolsdrift.

Five recruits did not complete the programme, with two resigning during training and three dismissed. Officials confirmed there is no outstanding deployment, with all available personnel now assigned to border protection duties rather than administrative functions.

Cybersecurity Progress

Alongside physical border enforcement, government has been working to strengthen protection of digital systems under the 2024 National Cybersecurity Strategy. By the end of the second quarter of 2025, seven critical government systems and databases, including ABIS, NIS, eHomeAffairs and the Live Capture platform, had completed independent security audits.

The Department of Home Affairs reports that the average response time to cyber incidents handled by the State Security Agency’s Cyber Security Centre is around four hours. High-priority cases receive initial triage within one to two hours, aided by real-time monitoring and forensic detection tools.

Broader Security Picture

The twin focus on reinforcing border posts and tightening cyber defences reflects government’s acknowledgement of mounting threats to both territorial integrity and digital infrastructure. Officials stressed that continued investment in personnel and technology will be required to keep pace with evolving risks.

The post Border Guards Deployed and Cybersecurity Response Times Revealed appeared first on ProtectionWeb.

The INTERPOL-coordinated sweep, codenamed Operation Serengeti 2.0, ran from June to August 2025 and brought together investigators from 18 African nations alongside the United Kingdom. In total, authorities recovered USD 97.4m (£76.7m), dismantled over 11,000 malicious infrastructures and targeted crimes ranging from ransomware to business email compromise (BEC).

The operation followed warnings from INTERPOL’s Africa Cyberthreat Assessment Report, which highlighted the region’s exposure to high-impact online threats.

Large-Scale Fraud and Crypto Crackdowns

Authorities in Angola shut down 25 illegal cryptocurrency mining centres run by 60 Chinese nationals. The crackdown uncovered 45 illicit power stations and equipment worth more than USD 37m, now earmarked by the government to bolster electricity distribution in vulnerable communities.

In Zambia, police dismantled an investment fraud scheme that tricked some 65,000 victims into investing in bogus cryptocurrency ventures. Losses are estimated at USD 300m. Investigators seized domains, mobile numbers and bank accounts, while 15 arrests were made. In a separate case, Zambian authorities uncovered a scam centre linked to human trafficking, seizing 372 forged passports.

Meanwhile, officers in Côte d’Ivoire arrested the ringleader of a transnational inheritance scam operating out of Germany. The fraud, which duped victims into paying fees to claim fictitious inheritances, caused losses of around USD 1.6m. Items seized included electronics, jewellery, vehicles and cash.

Training, Intelligence Sharing and Prevention

The operation was bolstered by intelligence from private sector partners including Kaspersky, Trend Micro and TRM Labs, who provided data on suspicious IPs, domains and command-and-control servers. Ahead of the crackdown, investigators also underwent intensive training in cryptocurrency tracing, open-source intelligence and ransomware analysis.

INTERPOL Secretary General Valdecy Urquiza said:

“Each INTERPOL-coordinated operation builds on the last, deepening cooperation, increasing information sharing and developing investigative skills across member countries. With more contributions and shared expertise, the results keep growing in scale and impact.”

The initiative also linked with the International Cyber Offender Prevention Network (InterCOP), a consortium of 36 countries led by the Netherlands, which works to detect and deter cybercriminal activity before it escalates.

Global Cooperation

Operation Serengeti 2.0 formed part of the African Joint Operation against Cybercrime, supported by the UK’s Foreign, Commonwealth and Development Office. Participating countries included Nigeria, Kenya, South Africa, Ghana, Tanzania, and Zimbabwe, alongside European partners.

The results highlight both the scale of cybercrime across Africa and the growing effectiveness of cross-border policing. Authorities say further arrests and asset seizures are likely as investigations continue into international collaborators.

The post African cybercrime networks dismantled in major INTERPOL operation appeared first on ProtectionWeb.

Two-thirds of the Organization’s African member countries surveyed said that cyber-related crimes accounted for a medium-to-high share of all crimes, rising to 30 per cent in Western and Eastern Africa.

Online scams, particularly through phishing, were the most frequently reported cybercrimes in Africa, while ransomware, business email compromise (BEC) and digital sextortion also remain widespread.

Neal Jetton, INTERPOL Cybercrime Director, said:

“This fourth edition of the INTERPOL African Cyberthreat Assessment provides a vital snapshot of the current situation, informed by operational intelligence, extensive law enforcement engagement and strategic private-sector collaboration. It paints a clear picture of a threat landscape in flux, with emerging dangers like AI-driven fraud that demand urgent attention. No single agency or country can face these challenges alone.”

Ambassador Jalel Chelba, Acting Executive Director of AFRIPOL, said:

“Cybersecurity is not merely a technical issue; it has become a fundamental pillar of stability, peace, and sustainable development in Africa. It directly concerns the digital sovereignty of states, the resilience of our institutions, citizen trust and the proper functioning of our economies.”

Africa’s top cyberthreats

In the past year, suspected scam notifications rose by up to 3,000 per cent in some African countries, according to data from Kaspersky – one of several private sector partners that works with INTERPOL’s cybercrime directorate.

Ransomware detections in Africa also rose in 2024, with South Africa and Egypt suffering the highest number, at 17,849 and 12,281 detections respectively according to data from Trend Micro, followed by other highly digitized economies such as Nigeria (3,459) and Kenya (3,030).

Incidents included attacks on critical infrastructure, such as a breach at Kenya’s Urban Roads Authority (KURA), and on government databases, such as hacks of Nigeria’s National Bureau of Statistics (NBS).

BEC-related incidents also rose significantly, with 11 African nations accounting for the majority of BEC activity originating on the continent. In West Africa, BEC fraud has driven highly organized, multi-million-dollar criminal enterprises, such as transnational syndicate Black Axe.

Sixty per cent of African member countries reported an increase in reports of digital sextortion, where threat actors use sexually explicit images to blackmail their targets. The images can be authentic – shared voluntarily or obtained through coercion or deception – or they can be generated by artificial intelligence.

Law enforcement challenges

Cybercrime continues to outpace the legal systems designed to stop it, according to African law enforcement. Seventy-five per cent of countries surveyed said their legal frameworks and prosecution capacity needed improvement.

At the same time, countries also reported struggling to enforce the existing laws on cybercrime, with 95 per cent of respondents reported inadequate training, resource constraints and a lack of access to specialized tools.

Despite rising caseloads, most African member countries surveyed still lack essential IT infrastructure to combat cybercrime. Just 30 per cent of countries reported having an incident reporting system, 29 per cent a digital evidence repository and 19 per cent a cyberthreat intelligence database.

While cybercrime routinely crosses national borders, 86 per cent of African member countries surveyed said their international cooperation capacity needs improvement due to slow, formal processes, a lack of operational networks, and limited access to platforms and foreign-hosted data.

Cybercrime investigations increasingly rely on cooperation from private sector partners, yet 89 per cent of African countries said their cooperation with the private sector needed ‘significant’ or ‘some’ improvement due to unclear channels for engagement, low institutional readiness and other barriers.

Strengthening cyber resilience

Nevertheless, the INTERPOL report also details positive steps that many African member countries have made to strengthen their cyber resilience.

Several African countries advanced their legal frameworks, harmonizing cybersecurity laws with international standards. Many countries also enhanced their cybercrime response capabilities, investing in specialized units and digital forensics infrastructure.

This increased operational capacity was demonstrated in two high-impact international cybercrime operations coordinated by INTERPOL – Operation Serengeti and Operation Red Card – which collectively led to more than 1,000 arrests and the dismantling of hundreds of thousands of malicious networks.

To further improve Africa’s cybercrime response capabilities, the INTERPOL report proposes six strategic recommendations, including improving regional and international cooperation, expanding prevention and public awareness, and leveraging emerging technologies.

The post New INTERPOL report warns of sharp rise in African cybercrime appeared first on ProtectionWeb.

According to NETSCOUT, the DieNet group announced itself on 7 March 2025, via a now-banned Telegram channel, and its targets span transportation, energy, medical systems and digital commerce.

DieNet has leveraged DDoS-as-a-service infrastructure, commonly shared with other groups such as OverFlame and DenBots Proof, to launch ideologically driven attacks against the US, Iraq, Israel, Sweden, and Egypt to date. And, although the group claims some success, it is often difficult to validate whether the attacks have had any impact on the targets. 

“However, their scale and frequency – often allegedly averaging one attack per day – expose the ease with which new actors can exploit widely accessible rented infrastructure to launch their own DDoS campaigns,” says Bryan Hamman, regional director: Africa at NETSCOUT, “and this is something that should raise concern across Africa.” 

“Local organisations are increasingly being targeted by DDoS and other cyberattacks, particularly in sectors like telecoms, government and financial services. The rapid mobilisation and global scale of groups like DieNet highlight just how easily bad actors can take advantage of available tools to disrupt services on any continent, including ours.”

Since its emergence earlier this year, DieNet has gained visibility through other known active threat actor organisations, such as Mr. Hamza, Sylhet Gang-SG and LazaGrad Hack. Its attack methods are characterised by a mixture of vectors such as TCP RST, DNS amplification, TCP Syn and NTP amplification. The chosen vectors and attack patterns vary between targets.

Despite DieNet’s claims, NETSCOUT’s analysis reveals no evidence of a proprietary botnet. Instead, the group appears to rely on the same attack infrastructure used by other threat actors, reinforcing the risk posed by DDoS-as-a-service ecosystems.

The tactics used by DieNet demonstrate how easily malicious actors can launch attacks using widely accessible platforms, without needing large-scale technical infrastructure, comments Hamman.

“What’s clear is that organisations in Africa can no longer afford a reactive approach,” he adds. “Early detection, real-time visibility and proactive mitigation are critical to staying one step ahead of cyber criminals.”

The post NETSCOUT warns of new hacktivist threat posing global risks, from the US, Middle East, Africa and beyond appeared first on ProtectionWeb.

The charges against Erasmus relate to a 2023 incident in which he and co-accused Felix Unathi Pupu (43), both former employees of Ecentric, installed software on the company’s systems that enabled unauthorized remote access. This access was later exploited in an attempted ransomware scheme that included multiple extortion attempts and led to significant data breaches.

Erasmus was convicted on a wide range of charges, including:

• One count of contravening section 12 of the Cybercrimes Act No. 19 of 2020

• One count of theft of data

• Two counts of attempted cyber extortion

• Four counts of cyber fraud

• Four counts of unlawful access to a computer system

• Three counts involving unlawful use of software or hardware tools

• Two counts of unlawful interference with network or data

• One count of interference with a data storage medium

• One count of password resetting

• One count of unlawful access

• One count of trespassing

According to court documents, the software installed by the accused allowed a third party to breach Ecentric’s IT infrastructure. On 14 November 2023, a ransom demand was made to Ecentric’s CEO, requesting payment of US$534,260 within 16 hours, with the threat that company data would be leaked publicly—including to competitors and regulators—within 30 hours. When the initial demand was not met, a second ransom of US$1 million was issued on 30 November 2023.

Ecentric did not comply with either demand. However, four of its retail clients sustained financial losses totalling R794,808.51 as a result of the cyberattack.

Erasmus has been in custody since 14 December 2023. His co-accused, Felix Pupu, remains in custody and is scheduled to appear in court on 30 June 2025 for plea and sentencing.

As part of the conditions tied to the suspended portion of his sentence, Erasmus must not commit any further offences relating to fraud, cybercrime, or trespassing during the five-year suspension period. A violation would lead to the activation of the suspended sentence.

The court also declared Erasmus unfit to possess a firearm.

This case marks a significant application of South Africa’s Cybercrimes Act and highlights the growing focus on criminal accountability for cybersecurity breaches involving insider threats.

Ecentric welcomed the court’s decision, confirming Erasmus’s conviction and sentencing. Digital forensics firm Cyanre, which assisted in the investigation, praised the outcome, calling it a milestone in South Africa’s fight against cybercrime. The company lauded the collaboration between law enforcement and legal experts, highlighting the success as a testament to the Cyber Crimes Act’s effectiveness.

The post Landmark cybercrime conviction: Former IT employee sentenced to eight years for fraud and extortion plot appeared first on ProtectionWeb.