Kenya Threat Landscape Report 2024
enovise.com
Published On 06 Mar 2025
Enovise
Summary
The Kenya Threat Landscape Report, prepared by SOCRadar and Enovise, highlights various aspects of the cyber threat environment around Kenya — where public administration, information, and finance sectors collectively account for over 43% of observed incidents.
About the Report
The Kenya Threat Landscape Report was prepared collaboratively by SOCRadar and Enovise to highlight the key aspects of the cyber threat landscape affecting Kenya and the wider East African region.
Sector-Specific Targeting
The public administration, information, and finance sectors are the primary targets in Kenya's cyber threat landscape, collectively accounting for over 43% of observed incidents. This focus highlights the increasing risk to critical infrastructure and financial systems.
Geographical Focus
Kenya remains a primary target for cybercriminals, with 69.1% of threats directed solely at the country. However, 30.9% of attacks affect Kenya alongside other nations, indicating the regional scope of threat actor operations.
Ransomware Threats
Manufacturing is the top sector targeted by ransomware, representing over a quarter of ransomware incidents. LockBit variants dominate ransomware activities, with a combined share of 22.74%, indicating the sophistication and persistence of these threat actors.
Phishing Attacks
National Security and International Affairs sectors are highly targeted by phishing attacks (50%), reflecting the value of sensitive government information. Banking follows with 21.43%, signalling continued efforts by cybercriminals to exploit financial institutions.
Evolving Phishing Techniques
Phishing pages largely rely on generic or ambiguous titles (61.19%), making it difficult for users to immediately recognise malicious intent. However, titles such as "Sign in to your account" and "Redirecting…" suggest an increasing focus on user credentials and data harvesting.
HTTPS Adoption in Phishing
Despite the growing use of HTTPS (56.7%) in phishing domains, a significant portion (43.3%) still operates on HTTP. This emphasises the need for users to scrutinise URLs and not rely solely on secure connection indicators.
Diverse Threat Activity
Threat actors are not confined to one type of attack. Data and database compromises are the most prevalent attack type (61.8%), followed by access-related threats (21.1%), and website disruptions (14.5%). This variety reflects the multifaceted nature of the threat landscape and the need for a multi-layered defence strategy.
You May Also Like
View Blogs
Enovise Group and SOCRadar Partnership
Enovise has partnered with SOCRadar to deliver advanced, proactive cybersecurity solutions for organisations across Africa, integrating SOCRadar's Extended Threat Intelligence platform with Enovise's Managed Detection and Response services.
Garmin South Africa Hack
Customer data for purchases made through the Garmin South Africa shop has been stolen — including payment card numbers, CVV codes, names, physical addresses, phone numbers, and email addresses — containing all the information required to make fraudulent purchases.
Hackers Stole and Encrypted Data of 5 US Law Firms
Hackers compromised five United States law firms and demanded two 100 Bitcoin ransoms from each firm — one to restore access to the data, one to delete their copy instead of selling it. The Maze group published part of the stolen data, threatening to release increasingly sensitive material unless paid.
Hackers Tricked 3 British Private Equity Firms
In a highly targeted business email compromise attack, the Florentine Banker group tricked three British private equity firms into wiring $1.3 million — approximately $700,000 permanently lost — using man-in-the-middle tactics and lookalike domains to intercept and manipulate financial communications.