Kenya logs 2.7 billion cyber threat events in three months as brute force attacks jump 85%

Get breaking business news on WhatsApp

Kenya’s national cyber response centre detected 2,696,335,021 cyber threat events between July and September 2026, a 14.45% rise on the previous three months, according to the latest cybersecurity report from the Communications Authority of Kenya (CA).

The report, the 43rd edition published by the National Kenya Computer Incident Response Team Coordination Centre (KE-CIRT/CC), attributes most of the activity to weak system patching, poor user awareness of phishing and the growing use of artificial intelligence by attackers.

“Between July and September 2026, the Authority’s National KE-CIRT/CC detected over 2.6 billion cyber threat events, largely attributed to the exploitation of system vulnerabilities,” CA Director General David Mugonyi says in the report.

The figures count detected attempts, not confirmed breaches. In response, the centre sent out 20,258,111 threat advisories, 2.36% fewer than in the April to June quarter. Its tally also lists 112 digital investigations and 24 digital forensics cases.

Where the attacks came from

System attacks made up the bulk of the total, at 2,552,948,966 events, up 13.25%. Nearly all of these were network attacks, with a further 5,508,102 aimed at industrial control systems and 228,507 at databases. The CA says most targeted the operating systems and database servers of internet service providers (ISPs) and cloud providers, exploiting poor patch management, legacy systems and badly secured Internet of Things devices.

Brute force attacks, where attackers repeatedly try passwords to break into accounts, grew fastest. The centre detected 44,949,518 attempts, up 85.41%, mainly against cloud service providers and government systems. It blames weak authentication, flaws in database setups and insecure Remote Desktop Protocol configurations.

Web application attacks rose 57.62% to 27,435,527. Government systems and ISPs were the main targets, and the report says a large share of these attacks took advantage of weak SSL/TLS security settings. Malware attempts climbed 20.01% to 70,800,154, hitting ISPs, cloud providers and government systems, as well as banks, cryptocurrency and forex trading platforms and online betting sites.

Two categories fell. Distributed denial-of-service (DDoS) attacks, which flood websites with traffic to knock them offline, dropped 97.18% to 23,124, with email and web servers the main targets and the health sector and government the most affected industries. Attacks on mobile applications fell 3.08% to 177,732, with Android phones, Android TVs and set-top boxes the main targets.

Ransomware and AI

The report names Qilin, The Gentlemen, Cl0p, Orova and Dire Wolf among the active ransomware groups in the period, and says Kenyan organisations were among those targeted or listed by such groups. It does not name the organisations.

It also flags the exploitation of vulnerabilities in Citrix NetScaler during the quarter as an example of the risk of slow patching, and warns that AI tools are helping criminals write more convincing scam messages and run larger campaigns.

At a meeting of the KE-CIRT cybersecurity committee on September 23, representatives of the e-government sector “stressed the need for stronger protection of information assets and the adoption of a more proactive approach to data security following a breach earlier in the year”, the report says. The sector is working on audit requirements raised by the Office of the Data Protection Commissioner.

What the regulator wants organisations to do

The CA’s advisories urge organisations to apply security updates quickly, switch on multi-factor authentication, secure remote access, keep isolated backups and test recovery plans. For brute force attacks it advises strong password management and disconnecting unused devices from networks. Phone users are told to disable Android Debug Bridge, install apps only from trusted sources and check app permissions.

Individuals worried about fraud linked to their identity can also check how many SIM cards are registered under their ID.

The authority will host the 7th Africa Cyber Defense Forum in Nairobi from November 2 to 5, with workshops on the first two days and the main conference on November 4 and 5.