Cyber adversaries targeting African organisations are increasingly shifting away from opportunistic attacks toward deliberate, sector-specific campaigns aimed at the continent’s most critical digital infrastructures, according to the esentry 2025 Annual Report released by esentry, Lagos-based Africa’s leading indigenous Managed Security Service Provider (MSSP).

The report identifies healthcare, financial services, and telecommunications as the primary staging grounds for high-velocity cyberattacks, reflecting a growing focus on sectors that underpin economic stability, public welfare, and digital connectivity across Africa.

The findings are drawn from one of the largest cybersecurity datasets analysed in the region. Over the course of 2025, esentry processed more than 31 billion security events, generating 3.5 million alerts and successfully blocking over 15,000 malicious attempts. This monitoring scale shows that, while traditional financial institutions remain a core target, the threat landscape has expanded to include digital lending platforms, healthcare systems that store sensitive personal data, and telecom operators responsible for national and regional connectivity.

Within the healthcare sector, the report highlights ransomware as the most acute risk, with attackers frequently exploiting exposed Remote Desktop Protocol (RDP) services to compromise patient data and disrupt essential medical operations. In financial services, organisations are facing a surge in credential abuse, insider-related threats, and info-stealer malware designed to enable fraud and unauthorised access. Telecommunications providers are increasingly targeted by highly tailored phishing campaigns and attacks on exposed web services, which aim to harvest credentials and compromise customer data.

Commenting on the findings, Gbolabo Awelewa, Chief Business Officer at esentry, said the nature of cyber threats across Africa has evolved significantly. “The threats we are seeing today are deliberate, informed, and carefully tailored to local enterprises. Attackers are exploiting trusted access and moving quietly within networks, which makes early detection critical. Our coordinated cybersecurity model, spanning Defence, Intelligence, Offence, and Security Engineering, allows us to combine scale, speed, and deep contextual insight to detect and neutralise threats before they escalate,” Awelewa said.

A defining trend identified in the report is the shift from overt system exploitation to the abuse of legitimate access. By leveraging compromised credentials and ‘living-off-the-land’ techniques, attackers can blend into routine enterprise operations and significantly delay detection. This approach has compressed the attack lifecycle, enabling adversaries to move from initial access to full operational impact in fewer than 15 days.

To counter this acceleration, the report emphasises the importance of early detection and automated response. esentry says it currently contains low-complexity incidents in under 90 seconds, using a combination of structured threat hunting and centralised telemetry to anticipate and absorb attacker pressure rather than reacting after damage has occurred.

As African organisations continue to digitise, the esentry 2025 Annual Report positions itself as a critical reference point for understanding the continent’s evolving cyber threat environment. The report concludes that protecting Africa’s digital trust will require a shift away from fragmented security tools toward disciplined, coordinated defence frameworks, what esentry describes as a unified Phalanx formation.

The African Development Bank Group (AfDB) and the United Nations Development Programme (UNDP) have launched an ambitious $10 billion project to support the adoption of Artificial Intelligence (AI) across the continent.

The 10 Billion Initiative intends to accelerate ethical AI adoption and inclusive digital economic growth in Africa.

The initiative follows the Nairobi AI Forum, which took place earlier this month in Kenya and brought together governments, private sector leaders, development partners, and tech innovators to define pathways for impactful AI adoption.

According to the organisations, the strategy is a co-designed collaboration between the Bank Group, UNDP, and commercial partners that aims to raise up to $10 billion by 2035.

The resources will be used to create up to 40 million new jobs across the continent by 2035, through targeted investments that provide the groundwork for AI and accelerate widespread adoption in everything from entrepreneurship and regional data infrastructure to policy frameworks and skill development.

Nicholas Williams, AfDB Group ICT operations division manager, commented: “As a leading multilateral development institution, the bank is leveraging its comparative advantage to ensure Africa is not left behind in the AI era.

“The AI 10 Billion Initiative paves the way for expanded partnerships and sustained investments that will accelerate AI entrepreneurship, strengthen data and infrastructure ecosystems, and support inclusive growth across the continent.”

Kaspersky Threat Research has revealed its analysis of RenEngine, a malware loader that has recently gained public attention. Kaspersky identified RenEngine samples as early as March 2025, with its solutions already protecting users from the threat at that time.

Beyond the cracked games highlighted in recent reports, Kaspersky researchers discovered that attackers created dozens of websites distributing RenEngine through pirated software, including graphics editors like CorelDRAW. This expands the known attack surface beyond the gaming community to anyone seeking unlicensed software.

Kaspersky has recorded incidents in Russia, Brazil, Turkey, Spain and Germany, among other countries. The distribution pattern indicates opportunistic attacks rather than targeted operations.

When Kaspersky first identified RenEngine, the loader was delivering the Lumma stealer. Current attacks distribute ACR Stealer as the final payload, and Vidar stealer has also been observed in some infection chains.

The campaign exploits modified versions of games built on the Ren’Py visual novel engine. When users launch infected installers, a fake loading screen appears while malicious scripts execute in the background. The scripts include sandbox detection capabilities and decrypt a payload that initiates a multi-stage infection chain using HijackLoader, a modular malware delivery tool.

“This threat extends beyond pirated games — attackers are using the same technique to distribute malware through cracked productivity software, which broadens the potential victim pool significantly,” said Pavel Sinenko, lead malware analyst at Kaspersky Threat Research. “Game archive formats vary by engine and title. If an engine doesn’t check the integrity of its resources, attackers can embed malware that executes the moment you click play.”

Kaspersky solutions detect RenEngine as Trojan.Python.Agent.nb and HEUR:Trojan.Python.Agent.gen. HijackLoader is detected as Trojan.Win32.Penguish and Trojan.Win32.DllHijacker.