At a recent media event held in Johannesburg, Maher Yamout, Lead Security Researcher for the Global Research & Analysis Team (GReAT) at Kaspersky, unpacked South Africa’s current cyberthreat landscape, looking at ransomware trends, and the rise of infostealers.

In South Africa in the first half (H1) of 2025, Kaspersky security tools blocked more than 6 million online attack attempts on users. With threats that include phishing scams, exploits, botnets, Remote Desktop Protocol attacks, and network spoofing, such as fake Wi-Fi networks, one in five users in the country (20.9%) were targeted. In the same period, 10.3 million on-device incidents were blocked, where 21.2% of South African users faced malware delivered via infected USB drives, CDs, DVDs, and hidden installers, including ransomware, worms, backdoors, trojans, password stealers, and spyware. Industrial environments also remain a target: attacks on 27.7% of ICS (Industrial Control Systems) computers in South Africa were blocked by Kaspersky solutions in H1 2025.

Kaspersky’s analysis shows that the number of backdoors more than doubled in South Africa in H1 2025, compared to the same period in 2024 (a 123% increase was recorded). Furthermore, banking trojans grew 136%, and password stealers increased 122%. Spyware attacks happened 3.6 times more often, alongside a 14% increase in exploits targeting vulnerabilities in applications like Microsoft Office.

Infostealers remain concerning for both consumers and enterprises. Kaspersky notes that many stealers still reach Windows PCs via phishing and pirated software, reinforcing the need for secure mail gateways, application control, and blocking unapproved software. Moreover, Kaspersky’s research this year exposed SparkCat, the first stealer to infiltrate Apple’s App Store, and also found on Google Play. It scans photo galleries for screenshots containing sensitive data, such as wallet recovery phrases or passwords, demonstrating that storing credentials in images is unsafe. A related family, SparkKitty, was later observed exfiltrating images and device details via apps distributed through official stores and scam sites.

“Knowing the threat landscape becomes an operational concern,” said Yamout. “When you understand which threats are registered in the region, you can tune controls that matter. In our recent work, we have also supported INTERPOL-led efforts to disrupt stealer operations affecting Africa. Meanwhile, cases like SparkCat show why screenshots of passwords or recovery phrases are not safe, even if the app came from an official store.”

Kaspersky solutions registered almost three million phishing attempts in South Africa in the first half of 2025. Although this marks a 29% decrease compared to the same period of 2024, the threat of targeted phishing is still rife in the region. Globally, Kaspersky has tracked phishing campaigns that use AI-generated text, deepfakes, and voice cloning, as well as trusted services such as Telegram pages and Google Translate links, to bypass filters. Some phishing sites also place CAPTCHA screens upfront to reduce machine detection. These realities mirror the lures and infrastructure abuse seen in local incidents.

Furthermore, ransomware remains a leading reason of corporate cyber incidents in South Africa, with targeted groups selecting high-value victims across government and enterprise. Effective defence combines prevention and response. These include adopting rigorous patching, strong authentication, limited remote access, endpoint detection and response (EDR) and extended detection and response (XDR) solutions, regular backups, and user awareness to blunt phishing-led initial access.

“Resilience is built in layers. Map your risks, reduce the attack surface, and plan for containment. If your controls shorten the time from the first suspicious event to isolation and rollback, you change the economics for cyber attackers,” concluded Yamout.

The post Infostealer and ransomware on the rise in South Africa appeared first on ProtectionWeb.

Kaspersky experts constantly track highly sophisticated attacks. Specifically, they are monitoring 25 APT groups currently active in the META region, including well-known ones such as SideWinder, Origami Elephant, and MuddyWater. The rise of creative exploits for mobile and further development of techniques aimed at evading detection are among the trends Kaspersky is seeing in these targeted attacks.

On a broader level, the first quarter of 2025 showed that Turkiye and Kenya had the highest number of users affected by web incidents (online threats) – 26.1% and 20.1% respectively. They were followed by Qatar (17.8%), Nigeria (17.5%) and South Africa (17.5%).

Ramsomware remains one of the most destructive cyberthreats. According to Kaspersky data, the share of users affected by ransomware attacks increased by 0.02 p.p to 0.44% from 2023 to 2024 globally. In the Middle East the growth is 0.07 p.p. to 0.72%, in Africa: 0.01 p.p. growth to 0.41%, in Turkiye 0,06 p.p. growth to 0.46%. Attackers often don’t distribute this type of malware on a mass scale, but prioritise high-value targets, which reduces the overall number of incidents. While ransomware is not increasing largely, that doesn’t mean that it becomes less dangerous.

Share of Kaspersky Security Network users whose computers were attacked by crypto-ransomware.

In the Middle East ransomware affected a higher share of users due to rapid digital transformation, expanding attack surfaces and varying levels of cybersecurity maturity. Ransomware is less prevalent in Africa due to lower levels of digitisation and economic constraints, which reduce the number of high-value targets. However, as countries like South Africa and Nigeria expand their digital economies, ransomware attacks are on the rise, particularly in the manufacturing, financial and government sectors. Limited cybersecurity awareness and resources leave many organisations vulnerable, though the smaller attack surface means the region remains behind global hotspots.

Ransomware trends

• AI tools are increasingly being used in ransomware development, as demonstrated by FunkSec, a ransomware group that emerged in late 2024 and quickly gained notoriety by surpassing established groups like Cl0p and RansomHub with multiple victims claimed in December alone. Operating under a Ransomware-as-a-Service (RaaS) model, FunkSec employs double extortion tactics — combining data encryption with exfiltration — targeting sectors such as government, technology, finance, and education in Europe and Asia. The group’s heavy reliance on AI-assisted tools sets it apart, with its ransomware featuring AI-generated code, complete with flawless comments, likely produced by Large Language Models (LLMs) to enhance development and evade detection. Unlike typical ransomware groups demanding millions, FunkSec adopts a high-volume, low-cost approach with unusually low ransom demands, further highlighting its innovative use of AI to streamline operations.
• In 2025, ransomware is expected to evolve by exploiting unconventional vulnerabilities, as demonstrated by the Akira gang’s use of a webcam to bypass endpoint detection and response systems and infiltrate internal networks. Attackers are likely to increasingly target overlooked entry points like IoT devices, smart appliances or misconfigured hardware in the workplace, capitalising on the expanding attack surface created by interconnected systems. As organisations strengthen traditional defenses, cybercriminals will refine their tactics, focusing on stealthy reconnaissance and lateral movement within networks to deploy ransomware with greater precision, making it harder for defenders to detect and respond in time.
• The proliferation of LLMs tailored for cybercrime will further amplify ransomware’s reach and impact. LLMs marketed on the dark web lower the technical barrier to creating malicious code, phishing campaigns and social engineering attacks, allowing even less skilled actors to craft highly convincing lures or automate ransomware deployment. As more innovative concepts such as RPA (Robotic Process Automation) and LowCode, which provide an intuitive, visual, AI-assisted drag-and-drop interface for rapid software development, are quickly adopted by software developers, we can expect ransomware developers to use these tools to automate their attacks as well as new code development, making the threat of ransomware even more prevalent.

“Ransomware is one of the most pressing cybersecurity threats facing organisations today, with attackers targeting businesses of all sizes and across every region, including META. Ransomware groups continue to evolve by adopting techniques, such as developing cross-platform ransomware, embedding self-propagation capabilities and even using zero-day vulnerabilities that were previously affordable only for APT actors. There is also a shift toward exploiting overlooked entry points — including IoT devices, smart appliances, and misconfigured or outdated workplace hardware. These weak spots often go unmonitored, making them prime targets for cybercriminals,” said Sergey Lozhkin, Head of META and APAC regions in Global Research and Analysis Team at Kaspersky. “To stay secure, organisations need a layered defense: up-to-date systems, network segmentation, real-time monitoring, robust backups, and continuous user education”.

Kaspersky encourages organisations to follow these best practices to safeguard their assets:

• Always keep software updated on all the devices you use to prevent attackers from exploiting vulnerabilities and infiltrating your network.
• Focus your defense strategy on detecting lateral movements and data exfiltration to the Internet. Pay special attention to outgoing traffic to detect cybercriminals’ connections to your network. Set up offline backups that intruders cannot tamper with. Make sure you can access them quickly when needed or in an emergency.
• Provide your SOC team with access to the latest threat intelligence and regularly upskill them with professional training. Use the latest Threat Intelligence information to stay aware of the actual Tactics, Techniques, and Procedures (TTPs) used by threat actors.
• Enable ransomware protection for all endpoints. There is a free Kaspersky Anti-Ransomware Tool for Business that shields computers and servers from ransomware and other types of malware, prevents exploits and is compatible with already installed security solutions.
• To protect the company against a wide range of threats, use solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, investigation and response capabilities of EDR and XDR for organisations of any size and industry. Depending on your current needs and available resources, you can choose the most relevant product tier and easily migrate to another one if your cybersecurity requirements are changing.

The post What’s on the cybersecurity horizon: Kaspersky shares cybersecurity trends for the Middle East, Turkiye and Africa appeared first on ProtectionWeb.

In fact, recent insights from Datacentrix partner, Check Point revealed that manufacturing emerged as the most impacted by cyberattacks in the third quarter of 2024, with the sector experiencing 30 percent of all reported ransomware attacks globally over the period.

Another concerning statistic was the fact that – at a regional level – Africa bore the brunt of cyber threats over the timespan, with local organisations facing an average of 3,370 attacks per week – an alarming 90 percent increase from the previous year.

Cybercriminals are exploiting vulnerabilities within manufacturing supply chains, targeting not only the manufacturers themselves, but also suppliers, logistics providers and even critical infrastructure. This underscores the urgent need for robust, proactive cybersecurity measures within this sector.

Attacks in manufacturing can originate from many sources, including energy suppliers, logistics providers and shop floor equipment. Methods could include:

• Ransomware: Disrupting supplier operations and production schedules, leading to delays and financial losses.
• Phishing: Extracting sensitive information such as login credentials or financial data, which could be used to disrupt operations or steal intellectual property.
• Distributed Denial of Service (DDoS) attacks: Overwhelming IT infrastructure and causing reputational damage.
• Malware infiltration: Introducing compromised components or software into the supply chain, potentially disrupting operations or compromising safety.
• Industrial espionage: Targeting manufacturing processes or intellectual property for competitive advantage or resale on the black market.

Building a secure framework for manufacturing

To address these challenges, global criteria such as the International Electrotechnical Commission’s (IEC) 62443 standards and the International Organization for Standardization’s (ISO) 27001 standard for information security management systems (ISMS)have been developed. These frameworks promote comprehensive cybersecurity practices across the manufacturing value chain, encompassing development, production and distribution.

ISO 27001 helps organisations identify and address risks holistically, integrating people, policies and technology into their security strategies. The IEC 62443 series, tailored for operational technology (OT), specifies security requirements suited to industrial automation and control systems, which differ from traditional IT environments.

Proactive cybersecurity measures

To strengthen cybersecurity and comply with the related standards, South African manufacturing organisations should begin with a comprehensive risk assessment to pinpoint vulnerabilities. Datacentrix recommends adopting advanced cybersecurity technologies for both OT and IT environments, alongside regular workforce training, including non-IT employees, on security best practices.

It’s also possible to perform offline cyber audits for new equipment, where shop floor equipment can be scanned at staging or pre-production planning and certified as virus, malware and configuration risk free at that time and place. Furthermore, PLC code protection offers advanced PLC versioning, code management, code backup and function block level deployment services. This removes IP from engineering workstations and puts code in secure locations that are easily backed up, restored and documented for compliance and audits.

Securing manufacturing’s future

Manufacturing plays a vital role in driving economic growth and innovation. To remain resilient against cyber threats, organisations within this industry must adopt a proactive and collaborative approach to cybersecurity. As a hybrid ICT systems integrator and managed services provider, Datacentrix is committed to equipping manufacturing businesses with the tools and expertise needed to strengthen their supply chains and safeguard their operations.

The post Securing Africa’s manufacturing sector against cybercrime appeared first on ProtectionWeb.

Geopolitical disputes have become a key driver of cyberwarfare, with state-sponsored actors targeting critical infrastructure to disrupt economies and destabilise societies. The ongoing conflict in Ukraine, for instance, has revealed the devastating impact of cyberattacks on essential services, including energy and telecommunications. These incidents highlight the urgent need for governments and businesses to bolster defences against such threats.

Nearly 60% of organisations surveyed stated geopolitical dynamics have influenced their cybersecurity strategies. Business leaders cite cyber espionage and operational disruptions as primary concerns, signalling an increased focus on safeguarding sensitive information and ensuring resilience in volatile times.

While emerging technologies like artificial intelligence (AI) and quantum computing hold transformative promise, they also present significant challenges. Cybercriminals are weaponising these tools to enhance the scale and sophistication of their attacks. Generative AI for example, can enable highly personalised phishing schemes, making it increasingly more difficult for organisations to identify and mitigate threats.

Despite these risks, the report reveals a concerning gap: only 37% of organisations have the appropriate processes in place to evaluate the security of AI systems prior to deployment. Experts emphasise the growing importance of integrating cybersecurity into the adoption of new technologies to mitigate potential vulnerabilities before they can be exploited.

The complexity of modern supply chains has emerged as a critical vulnerability, with 54% of large organisations identifying third-party risks as a major challenge. Software flaws introduced by suppliers, inadequate oversight, and dependence on a few key providers create systemic risks that can ripple across industries.

Global initiatives like the EU Cyber Resilience Act aim to address these vulnerabilities by enforcing stricter regulations on suppliers. However, implementing these measures across intricate, multi-tiered supply chains remains a daunting task.

The commoditisation of cybercrime is further fuelling a rapid expansion. Cybercrime-as-a-Service (CaaS) platforms offer ready-made tools for ransomware, phishing, and other attacks, enabling even non-technical actors to wreak havoc. The convergence of traditional organised crime with digital operations adds an additional layer of risk and complexity, amplifying the social and economic impacts of these threats.

The report calls for a united front to address the evolving cyberthreat landscape. Key recommendations include enhancing public-private partnerships, investing in cybersecurity talent, and fostering international cooperation to combat cybercrime.

“Cybersecurity is no longer just an IT issue,” said Jeremy Jurgens, Managing Director of the World Economic Forum. “It’s a business, social, and geopolitical challenge. Organizations must act now to build resilient systems and protect against an increasingly complex array of threats.”

As digitalisation continues to reshape the global economy, the stakes have never been higher. The ability to navigate this challenging landscape will define not just the success of businesses but also the security of nations in the years to come.

The post Rising Cyberthreats: How the Digital Battlefield is Shaping the Future appeared first on ProtectionWeb.

The Kaspersky Security Bulletin is an annual series of end-of-year predictions and analytical reports on key developments within the cybersecurity landscape. Last year, most of Kaspersky experts’ predictions for the evolution of Crimeware and financial cyberthreats in 2024 turned out to be true. These included an increase in AI-powered cyberattacks, a surge in fraudulent schemes targeting direct payment systems, a rise in open-sourced backdoored packages, more sophisticated ransomware techniques, and others.

In 2025, more advancements in ransomware techniques are anticipated. First, ransomware will covertly manipulate or introduce erroneous data into databases, rather than merely encrypting data. Even if decrypted, this “data poisoning” technique casts doubt on the accuracy of a business’s complete dataset. Second, advanced ransomware organisations will start using post-quantum cryptography as quantum computing develops. The encryption techniques used by this “quantum-proof” ransomware are designed to withstand decryption attempts from both classical and quantum computers, making it nearly impossible for victims to decrypt their data. Third, ransomware-as-a-service is projected to grow: less experienced actors will be able to launch sophisticated attacks with kits as inexpensive as $40, increasing the number of occurrences.

A surge in attacks based on stolen information is also expected in 2025. Popular stealers, such as Lumma, Vidar, Redline and others will withstand the pressure from law enforcement, will adapt and adopt new techniques. New players will appear, and all stolen information will be put to use.

Other important predictions include:

• Attacks against central banks and open banking initiatives. These will be attacks on instant payment systems run by central banks, and as a result cybercriminals may get access to sensitive data.
• Increase in supply-chain attacks on open-source projects. Following the XZ backdoor incident, the open-source community is likely to uncover both new attack attempts and backdoors that have been previously successfully implanted.
• More AI and machine learning on the defense side. We will see AI increasingly adopted in cyber defense to accelerate anomaly detection, reduce analysis time through predictive capabilities, automate response actions, and strengthen policies to counter emerging threats.
• Appearance of new blockchain-based threats. New blockchain protocols will emerge due to the need for a secure and private network based on blockchain and peer-to-peer technology. As a result, new malware developed using these obscure protocols will be distributed and utilised with various purposes.

“In 2025 and beyond, resilience against financial cyberthreats will demand robust security measures from both individual users and businesses. The best defense will combine threat intelligence, predictive analytics, continuous monitoring, and a zero-trust mindset to safeguard critical data and operations from sophisticated attackers. It is also important to organise regular cyber-training programs for employees and warn them about potential cyberthreats, as uninformed staff are among the most common initial attack vectors that can lead to serious financial losses for an organisation,” comments Fabio Assolini, head of the Latin American unit of the Global Research and Analysis Team (GReAT) at Kaspersky.

Read the full Kaspersky Security Bulletin: Crimeware and financial cyberthreats in 2025 report to find out how accurate our predictions for 2024 turned out to be, along with a full list of predictions for 2025 on Securelist.com. KSB pieces from previous years can be found here.

The post Kaspersky predicts quantum-proof ransomware and advancements in mobile financial cyberthreats in 2025 appeared first on ProtectionWeb.