Nigeria recorded 3,459 ransomware threat detections in 2024, placing it third on the continent behind Egypt and South Africa, according to INTERPOL’s newly released 2025 Africa Cyberthreat Assessment Report.

The findings highlight the growing scale and sophistication of cybercrime in Africa as the continent’s digital footprint expands rapidly.

The report, based on data from INTERPOL’s private sector partners, reveals a notable spike in monthly ransomware activity across Africa last year, with highly digitized economies bearing the brunt of the attacks.

Egypt topped the chart with 17,849 ransomware detections, followed by South Africa with 12,281. Kenya (3,030), Gambia (1,729), and Ghana (1,671) followed Nigeria in the top ten.

INTERPOL identified ransomware, online scams, business email compromise (BEC), and sextortion as Africa’s most dangerous cyber threats.

The report highlighted how the scale and methods of attack differ across regions depending on levels of cybersecurity awareness, infrastructure, and digital literacy.

Cybercrime has become increasingly prevalent, now accounting for more than 30 per cent of all reported crimes in West and East Africa, according to Nairametrics.

The economic impact has also been severe. Key sectors such as finance, telecommunications, government services, energy, and infrastructure have been affected by attacks that often result in business paralysis and large-scale financial losses.

One of the most prominent incidents cited in the report was the April 2024 breach at Nigerian fintech company Flutterwave, where hackers reportedly made away with about $7 million.

The report noted that “in many cases, ransom demands ranged from tens of thousands to millions of dollars, typically demanded in cryptocurrency,” leading to substantial recovery costs, prolonged operational downtimes, and lost revenue.

Across the continent, organizations have struggled to recover from the fallout of such attacks.

In Cameroon, electricity provider ENEO suffered disruptions to its power management systems, while in Kenya, the Urban Roads Authority (KURA) faced a significant data breach compromising infrastructure records.

The INTERPOL report emphasizes the urgent need for governments, businesses, and institutions in Africa to adopt proactive cybersecurity strategies to safeguard digital systems and critical infrastructure from increasingly complex threats.

In the context of World Social Media Day, celebrated on June 30, Kaspersky warns of fraudulent websites created to steal users’ personal data.

Kaspersky experts warn of a wave of scams using social engineering and phishing techniques on social media and messaging apps to steal credentials and distribute malware.

Taking advantage of the popularity of platforms such as WhatsApp, Facebook, Instagram, X, Telegram, and TikTok, cyber attackers are creating fake pages that mimic legitimate websites and promise everything from account verification to benefits like free followers or premium features. This situation is especially worrying considering the high level of digital exposure users face today.

Over the past year, Kaspersky has identified multiple fraudulent campaigns employing sophisticated tactics and widely recognised platforms to execute their attacks. These scams operate in a variety of ways, but they all have a common goal: to obtain users’ credentials or install malicious software on their devices. Below are examples of such schemes.

Fake verification pages: Users were led to websites mimicking WhatsApp and other app’s official interfaces. These fraudulent pages ask users for their phone number and the verification code received via SMS. With this information, cyber attackers could access accounts, take full control, and perform actions such as impersonating them, sending messages in the victim’s name, or accessing confidential information.

Promises of free followers: Fraudulent pages offered to boost users’ digital popularity on platforms like Instagram by supposedly giving away followers. However, to access the benefit, victims had to voluntarily enter their login credentials. This strategy allows cyber attackers to take control of accounts, use them to spread further scams, or even sell them on dark markets.

Fake shops on TikTok: This social network has also been the target of targeted attacks, especially through its TikTok Shop feature, which allows sellers to directly associate products with posted videos, making them easier to purchase. Taking advantage of this functionality, cybercriminals created fake sites that simulate being part of TikTok Shop, with the aim of stealing sellers’ credentials.

Fake security notifications: Cybercriminals sent alerts pretending to be from Facebook and similar platforms’ security teams, warning of suspicious activity on the user’s account.

Through these notifications, they directed victims to phishing forms requesting their credentials. Once entered, the attackers could take control of personal profiles or manage pages, using them for scams, spreading malicious content, or extortion.

These situations reflect the real risks associated with using social media: exposure of personal data, loss of control over accounts, dissemination of false information, and threats to privacy.

Despite the increase in these types of threats, users are not defenseless. With increased awareness, good cybersecurity practices, and the use of reliable protection tools, it is possible to significantly reduce the risk of falling victim to these scams.

“Social media and communication apps have become a part of our lives, but with their popularity comes cyber risks. With the rise of artificial intelligence-based tools, scams can be more believable and personalised than ever.

Therefore, it is key to maintain cybersecurity awareness, develop critical thinking, and use robust cybersecurity solutions,” comments Seifallah Jedidi, Head of Consumer Channel for META at Kaspersky.

Cybercriminals continue to profit handsomely, with nearly half of all victimised organisations paying ransom demands in 2025.

This is despite global efforts to curb the spread of ransomware, according to the State of Ransomware 2025 report released by Sophos, a global leader in cybersecurity solutions.

The sixth annual edition of the report, which surveyed 3,400 IT and cybersecurity leaders across 17 countries, revealed that 49 per cent of organisations hit by ransomware attacks opted to pay the ransom to regain access to their encrypted data, the second-highest payment rate recorded by Sophos in the last six years.

While the median ransom demand decreased by a third compared to 2024, the median payment still stood at $1 million, underscoring the continued profitability of ransomware for cybercriminals. Notably, 53 per cent of organisations that paid a ransom were able to negotiate a lower settlement than initially demanded, often through third-party negotiators or internal efforts.

In his reaction, Chester Wisniewski, director and field CISO at Sophos,  averred that for many organisations, the chance of being compromised by ransomware actors is just a part of doing business in 2025, adding that the good news is that, thanks to this increased awareness, many companies are arming themselves with resources to limit damage.

Among those who paid less than the initial demand, 71 per cent successfully negotiated a lower figure. While this signals an increasing awareness and tactical response among victim organisations, the report also noted persistent challenges.

For the third consecutive year, exploited vulnerabilities were identified as the leading technical root cause of ransomware attacks.

Alarmingly, 40 percent of victims said attackers exploited a security gap they were unaware of, underscoring a widespread lack of visibility into organizations’ digital infrastructure.

Additionally, 63 per cent of respondents cited resource constraints, including insufficient personnel or expertise, as contributing factors to their susceptibility. For large enterprises (3,000+ employees), lack of expertise topped the list, while mid-sized organisations (251–500 employees) most frequently cited a lack of personnel.

The use of data backups to restore information following an attack has fallen to its lowest point in six years, with only 54 per cent of companies relying on backups — a drop from previous years.

Despite this, organisations are recovering faster: 53 per cent reported full recovery within one week, up from 35 per cent in 2024. Only 18 percent of firms took over a month to recover, a significant improvement from last year’s 34 per cent.

Sophos attributes these gains to better incident response capabilities and a growing trend toward using Managed Detection and Response (MDR) services.

Such services help companies detect attacks early, respond effectively, and, in some cases, stop attacks in progress.

The report also found significant variation in ransom demands based on industry and company size, adding that organisations with over $1 billion in revenue faced median ransom demands of $5 million; those earning $250 million or less saw demands under $350,000; state and local governments reported the highest median ransom payments at $2.5 million and healthcare organisations paid the lowest, at a median of $150,000.

While attackers are still extracting sizable payments, the overall cost of ransomware recovery has dropped, from $2.73 million in 2024 to $1.53 million in 2025. Sophos credits increased preparedness, improved threat visibility, and wider use of professional response services for this decline.

To further reduce the risk and impact of ransomware, Sophos advises organisations to regularly patch known vulnerabilities and maintain updated security systems; employ multi-factor authentication (MFA) and anti-ransomware protection across all endpoints; use MDR services or maintain 24/7 internal security monitoring; test and maintain a robust incident response plan and ensure regular backups are not only taken but tested for restoration.

As ransomware evolves, so must corporate defenses.

Though the profitability of ransomware remains alarmingly high, the increasing resilience among targeted organisations is a sign of hope and a call to action for those still behind the curve.