Kenya's National KE-CIRT/CC, based at the Communications Authority of Kenya, released its 43rd cybersecurity report, revealing that between July and September 2023, the country's national cyber monitoring team detected 2,696,335,021 cyber threat events. This translates to approximately 29 million events per day, representing a 14.45% increase from the April to June quarter. The report highlights the growing concern of cyber threats in Kenya.
System attacks dominated the threat landscape, accounting for 2,552,948,966 events, or about 95% of the total. Within this category, network attacks alone accounted for 2,547,212,357 events. Industrial control system attacks, database attacks, and domain attacks totaled 5,508,102, 228,507, and zero, respectively. System attacks grew by 13.25% from the previous quarter, with most attacks targeting operating systems and database servers at internet service providers and cloud companies.
The report attributes the surge in system attacks to unpatched software, outdated legacy systems, and poorly secured Internet of Things (IoT) devices. The exploits used included stolen credentials, broken access controls, outdated operating systems, malicious links, remote code execution, and zero-day vulnerabilities. The primary motives behind these attacks were financial gain and malware distribution. The report also notes that attackers mostly targeted operating systems and database servers at internet service providers and cloud companies.
While system attacks comprised the bulk of cyber threats, other categories experienced significant growth. Brute force attacks, which involve repeated automated guesses at logins, increased by 85.41% to 44,949,518. Web application attacks rose by 57.62% to 27,435,527. Malware attempts totaled 70,800,154, representing a 20.01% increase. These attacks targeted IoT devices, remote systems, and government systems, often exploiting exposed doors, weak passwords, and poor security configurations.
In contrast, mobile application attacks decreased by 3.08% to 177,732, with Android phones, TVs, and set-top boxes being the primary targets. Distributed denial-of-service (DDoS) attacks, which flood a service with traffic until it stops responding, plummeted by 97.18% to 23,124. The report notes that hacktivists and politically motivated advanced persistent threat groups continued to target public services, including the health sector and government.
Despite the increase in cyber threats, the National KE-CIRT/CC issued 20,258,111 threat advisories, a 2.36% decrease from the previous quarter. This represents approximately one advisory for every 133 detected events. Web application attacks generated the most advisories, at 10,380,579, while system attacks produced around 8.4 million advisories. The team also handled 112 digital investigations and 24 digital forensics cases.
The report identifies the primary factors behind the surge in cyber threats as unpatched systems, user lack of awareness about phishing and social engineering, and attackers using AI to make their attacks more convincing and faster. The report also highlights the growing concern of ransomware, with groups like Qilin, The Gentlemen, Cl0p, Orova, and Dire Wolf targeting Kenyan organizations. To mitigate these threats, the National KE-CIRT/CC advises organizations to implement multi-factor authentication, patch quickly, and maintain an accurate inventory of their systems.
Key points
- System attacks accounted for 95% of the total 2.7 billion cyber threat events detected in Kenya between July and September 2023.
- Brute force attacks and web application attacks experienced significant growth, increasing by 85.41% and 57.62%, respectively.
- The National KE-CIRT/CC issued 20,258,111 threat advisories, a 2.36% decrease from the previous quarter, despite the increase in cyber threats.
