INTERPOL’s 2026 Africa Cyberthreat Report Highlights Fraud, Ransomware and Enforcement Gaps
Summary
INTERPOL’s 2026 assessment draws on responses from 36 African countries and vendor telemetry to examine 2025 cybercrime trends, highlighting mobile money fraud, critical-infrastructure ransomware and gaps in cross-border investigations.
Key points
- The assessment covers January–December 2025, combining survey responses from 36 of 49 African member countries with vendor telemetry, national incident reports and operational intelligence.
- Mobile money fraud was reported by 97% of responding countries; the report links exposure to inconsistent identity checks and SIM swap abuse.
- TrendAI telemetry attributed 92% of African ransomware detections to South Africa. The report highlights attacks disrupting utilities, healthcare and public services.
- The report describes BEC campaigns using phishing or credential stuffing to compromise accounts, followed by executive impersonation and fraudulent payment instructions.
- The assessment identifies AI-generated phishing, deepfakes and synthetic identities as tools enabling fraud and extortion, while 92% of surveyed agencies cited insufficient technical expertise as a barrier to adopting AI tools.
- Underreporting was identified as a challenge by 89% of survey respondents, and 89% identified cross-border cooperation as the most significant barrier to successful investigations.
- Recommendations include interoperable forensic capabilities, harmonized evidence-preservation rules, faster cross-border data exchange and annual AI-threat literacy training.
Article Details
- Publisher
- INTERPOL
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- African cybercrime threats, law enforcement capabilities, legal frameworks, and cross-border cooperation.
- Sample Size
- 36 responses from 49 African member countries surveyed; 73% response rate. Supplemented by partner telemetry, national incident reports, and open-source reporting.
- Key Statistics
- Reported cybercrime-related losses increased from USD 192 million in 2024 to USD 484 million in 2025, according to figures attributed to the Microsoft Digital Defense Report 2025; the report cautions that national loss data are affected by underreporting and differing methodologies.
- South Africa accounted for 92% of African ransomware detections in TrendAI's 2025 telemetry; this measures detections rather than confirmed incidents.
- Mobile money fraud was reported by 97% of countries responding to the INTERPOL member country survey.
- 94% of surveyed agencies reported insufficient digital forensics tools.
- 89% of survey respondents identified cross-border cooperation as the most significant barrier to successful investigations.
- Recommendations
- Equip national cybercrime units with standardized digital forensic capabilities, prioritizing mobile extraction, cryptocurrency tracing, malware analysis, and deepfake identification.
- Harmonize cybercrime laws and establish binding, expedited protocols for cross-border evidence preservation and data requests, supported by 24/7 contact networks.
- Train investigators, prosecutors, and judicial personnel to recognize synthetic media, forged identities, and automated phishing.
- Formalize lawful information-sharing with telecoms, fintechs, and financial institutions through defined agreements, retention requirements, safeguards, and real-time fraud alerts.
- Mandate sector-wide cyber audits for critical infrastructure and enforce backup and recovery standards for public institutions.
MITRE ATT&CK
T1078 · Valid AccountsBEC operators use compromised email accounts to impersonate trusted personnel and divert payments.T1110.004 · Credential StuffingBEC operators reportedly compromise accounts through credential stuffing.T1486 · Data Encrypted for ImpactRansomware encrypts files for extortion; the report describes recovery difficulties and law enforcement decryption operations.T1566 · PhishingThe report describes phishing used to compromise accounts for BEC and obtain initial access to networks for ransomware.T1656 · ImpersonationFraud operators impersonate executives through AI-generated email and use deepfake audio and video to impersonate public figures and other trusted individuals.
People
Threat Actors
AkiraAn actor reportedly linked to this group targeted Paratus Telecom in Namibia, disrupting core network functions.DevManNamed among ransomware operators on which the report recommends coordinated regional intelligence-sharing.Hunters InternationalAn actor associated with this group reportedly compromised Namibia's national telecommunications provider's customer database in December 2024.QilinNamed as a ransomware group associated with attacks on essential sectors and as an operator requiring regional intelligence-sharing.RansomHubNamed among ransomware operators on which the report recommends coordinated regional intelligence-sharing.
Malware
01flip(C2) framework often abused by threat actors to facilitate ransomware attacks such as the novel 01flip ransomware[^32] – remains widespread in Africa (see Figure 7).Andromeda.BotnetMirai.Botnet (39.1M / 25.4%), Sliver.Botnet (14.5M / 9.5%), Socks5systemz.Botnet (9.4M / 6.1%), Andromeda.Botnet (7.7M / 5.0%), SystemBC.Botnet (6.4M / 4.2%), Phorpiex.Botnet (5.3M / 3.5%), Mozi.Botnet,Mirai.Botnetchart showing botnet detections in Africa in 2025 by malware family: Prometei.Botnet (62.9M / 40.9%), Mirai.Botnet (39.1M / 25.4%), Sliver.Botnet (14.5M / 9.5%), Socks5systemz.Botnet (9.4M / 6.1%), Andromeda.BotnetMozi.Botnet/ 6.1%), Andromeda.Botnet (7.7M / 5.0%), SystemBC.Botnet (6.4M / 4.2%), Phorpiex.Botnet (5.3M / 3.5%), Mozi.Botnet, XorDDOS.Botnet, Purelogs.Botnet (2.6M / 1.7%).PhorpiexSocks5systemz.Botnet (9.4M / 6.1%), Andromeda.Botnet (7.7M / 5.0%), SystemBC.Botnet (6.4M / 4.2%), Phorpiex.Botnet (5.3M / 3.5%), Mozi.Botnet, XorDDOS.Botnet, Purelogs.Botnet (2.6M / 1.7%).Prometei.Botnet![Figure 7: Doughnut chart showing botnet detections in Africa in 2025 by malware family: Prometei.Botnet (62.9M / 40.9%), Mirai.Botnet (39.1M / 25.4%), Sliver.Botnet (14.5M / 9.5%), Socks5systemz.Botnet (9.4M / 6.1%),Socks5systemz.BotnetPrometei.Botnet (62.9M / 40.9%), Mirai.Botnet (39.1M / 25.4%), Sliver.Botnet (14.5M / 9.5%), Socks5systemz.Botnet (9.4M / 6.1%), Andromeda.Botnet (7.7M / 5.0%), SystemBC.Botnet (6.4M / 4.2%), Phorpiex.BotnetSystemBC.BotnetSliver.Botnet (14.5M / 9.5%), Socks5systemz.Botnet (9.4M / 6.1%), Andromeda.Botnet (7.7M / 5.0%), SystemBC.Botnet (6.4M / 4.2%), Phorpiex.Botnet (5.3M / 3.5%), Mozi.Botnet, XorDDOS.Botnet, Purelogs.Botnet (2.6M /XorDDOS.Botnet(7.7M / 5.0%), SystemBC.Botnet (6.4M / 4.2%), Phorpiex.Botnet (5.3M / 3.5%), Mozi.Botnet, XorDDOS.Botnet, Purelogs.Botnet (2.6M / 1.7%).
Tools
Countries
AngolaMauritius and Angola also surged in DDoS attacks,[^23] reflecting the concentration of high-value digital infrastructure.Cameroonand individual victims. Mobile credit application fraud became more prevalent in Côte d’Ivoire, while Cameroon and Chad have also been identified as areas of potential vulnerability. This is because the countriesCôte d’Ivoireboth corporate and individual victims. Mobile credit application fraud became more prevalent in Côte d’Ivoire, while Cameroon and Chad have also been identified as areas of potential vulnerability. This isGhanadetections in Africa by country: Angola (37.95%), Cameroon (23.89%), South Africa (9.12%), Kenya (7.78%), Ghana (6.29%), Zambia (1.81%), Nigeria (1.38%), Ethiopia (1.36%), Botswana (1.34%), Côte d'Ivoire (1.01%),KenyaEast Africa emerged as a hub of mobile money fraud and infrastructure-targeted ransomware. Kenya recorded more than 46,786 DDoS attacks in the first half of 2025 targeting telecoms,[^14] and was included in SOCRadar’sNamibiaobserved, relating to users and organizations originating from South Sudan, South Africa, Nigeria, and Namibia, between January 2024 and September 2025.[^4] Ransomware incidents were similarly prevalent across SouthNigeriabreaches was observed, relating to users and organizations originating from South Sudan, South Africa, Nigeria, and Namibia, between January 2024 and September 2025.[^4] Ransomware incidents were similarly prevalentSouth Africaof data breaches was observed, relating to users and organizations originating from South Sudan, South Africa, Nigeria, and Namibia, between January 2024 and September 2025.[^4] Ransomware incidents wereUgandaUganda’s Electricity Transmission Company Limited (UETCL) experienced a suspected ransomware incident in August 2025, marking a case involving a national power grid.[^16] The incident highlighted potential areas forZambiaRansomware incidents were similarly prevalent across South Africa, Nigeria, Namibia, Senegal, and Zambia, with attackers increasingly targeting healthcare institutions, utility providers, and public service
Industries
EducationInternet users now rely on digital platforms for financial services, government access, healthcare, and education.EnergySouthern, and West Africa, including Communications, Defense industrial base, Education and research, Energy sector or public utilities, Financial services, Food and agriculture, Government or publicFinancial Servicesglobal digital economy.[^1] More than 570 million Internet users now rely on digital platforms for financial services, government access, healthcare, and education.Governmenteconomy.[^1] More than 570 million Internet users now rely on digital platforms for financial services, government access, healthcare, and education.Healthcarevariants, such as those associated with the Qilin and Akira groups, are increasingly targeting healthcare systems, power utilities, and educational institutions, disrupting essential services and extortingTelecommunicationsgratitude to the national law enforcement agencies, cybersecurity units, judicial authorities, and telecommunications regulators across Africa who contributed their time, expertise, and operational experience to thisTransportationGovernment or public administration, Healthcare or public health, ICT, Manufacturing and ICS, Transportation systems, Water and wastewater systems.