Kenya Faces Surge in Cyber Threats as DDoS Attacks More Than Double
Kenya’s cyber threat landscape escalated sharply in the year ending June 2026, with detected incidents reaching 11.12 billion a 29% increase from the previous year’s 8.62 billion, according to the Communications Authority of Kenya (CA). The most alarming rise came from DDoS attacks, which surged 114.3%, from 33.7 million to 72 million events.
The National KE-CIRT/CC, Kenya’s cyber incident response center, recorded the highest activity between October and December 2025, with 4.56 billion threats nearly half the annual total. System vulnerability exploits dominated this period, accounting for 4.37 billion detections. However, threats declined in the following quarters, dropping 30% to 2.36 billion by April–June 2026.
DDoS attacks were most concentrated in the first half of the reporting period, with over 60 million incidents occurring between July and December 2025. The CA attributed the spike to attackers exploiting insecure protocols and remote desktop services, primarily targeting government and health sector systems. A notable disruption occurred in July 2023, when a DDoS campaign crippled the eCitizen portal, highlighting the real-world impact of such attacks.
Other fast-growing threats included:
- Web application attacks, which nearly doubled (+99%) to 51.5 million, often targeting login pages and online forms.
- Malware detections, rising 64.8% to 230.3 million.
- Mobile app attacks, increasing 54% to 789,826, though from a smaller base.
- Brute force attacks, which grew modestly (+3.6%) to 132.2 million.
Despite the staggering numbers, the 11.12 billion detections do not equate to successful breaches. Most incidents involved automated scans, exploit attempts, or malicious traffic, with only a fraction resulting in confirmed compromises. The CA also issued 83.1 million cyber advisories a 60.8% increase reflecting heightened detection and notification efforts.
The CA emphasized unpatched systems, low cybersecurity awareness, and AI-driven threats as key drivers of the surge. To combat this, the authority is advancing threat intelligence sharing, including a planned Threat Intelligence Sharing Platform in collaboration with Expertise France for sector-specific response teams.
While the DDoS wave subsided in early 2026, the broader trend underscores Kenya’s growing vulnerability as digital services including mobile money, online banking, and eCitizen platforms become integral to daily life. The CA’s next report, covering July–September 2026, will reveal whether the decline in attacks continues.
Source: https://www.itnewsafrica.com/cybersecurity/kenya-cyber-threats-hit-11-billion/
Electronic Citizen Solutions cybersecurity rating report: https://www.rankiteo.com/company/electronic-citizen-solutions-ecs-africa
"id": "ELE1790418368",
"linkid": "electronic-citizen-solutions-ecs-africa",
"type": "Cyber Attack",
"date": "7/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': 'Public Sector',
'location': 'Kenya',
'name': 'Government of Kenya',
'type': 'Government'},
{'industry': 'Healthcare',
'location': 'Kenya',
'name': 'Health Sector (Kenya)',
'type': 'Healthcare'}],
'attack_vector': ['Insecure protocols',
'Remote desktop services',
'Exploit attempts',
'Automated scans',
'Malicious traffic'],
'date_detected': '2025-07-01',
'date_publicly_disclosed': '2026-06-30',
'description': 'Kenya experienced a sharp escalation in cyber threats, with '
'detected incidents reaching 11.12 billion (a 29% increase '
'from the previous year). DDoS attacks surged by 114.3%, from '
'33.7 million to 72 million events, primarily targeting '
'government and health sector systems. Other threats included '
'web application attacks (+99%), malware (+64.8%), mobile app '
'attacks (+54%), and brute force attacks (+3.6%). The National '
'KE-CIRT/CC recorded the highest activity between October and '
'December 2025, with 4.56 billion threats, dominated by system '
'vulnerability exploits.',
'impact': {'downtime': 'Disruption of eCitizen portal (July 2023)',
'operational_impact': 'Disruption of digital services including '
'mobile money, online banking, and eCitizen '
'platforms',
'systems_affected': ['eCitizen portal',
'Government systems',
'Health sector systems']},
'investigation_status': 'Ongoing',
'lessons_learned': 'Unpatched systems, low cybersecurity awareness, and '
'AI-driven threats are key drivers of the surge in cyber '
'threats. Enhanced threat intelligence sharing and '
'sector-specific response teams are critical for '
'mitigation.',
'post_incident_analysis': {'corrective_actions': ['Threat intelligence '
'sharing',
'Sector-specific response '
'teams',
'Planned Threat '
'Intelligence Sharing '
'Platform with Expertise '
'France'],
'root_causes': ['Unpatched systems',
'Low cybersecurity awareness',
'AI-driven threats']},
'recommendations': 'Improve patch management, raise cybersecurity awareness, '
'deploy advanced threat detection, and collaborate on '
'threat intelligence sharing platforms.',
'references': [{'date_accessed': '2026-06-30',
'source': 'Communications Authority of Kenya (CA)'},
{'date_accessed': '2026-06-30',
'source': 'National KE-CIRT/CC'}],
'response': {'communication_strategy': 'Issued 83.1 million cyber advisories '
'(60.8% increase)',
'enhanced_monitoring': 'Threat intelligence sharing, planned '
'Threat Intelligence Sharing Platform '
'with Expertise France'},
'stakeholder_advisories': '83.1 million cyber advisories issued (60.8% '
'increase)',
'title': 'Surge in Cyber Threats and DDoS Attacks in Kenya (2025-2026)',
'type': ['DDoS',
'Web Application Attack',
'Malware',
'Mobile App Attack',
'Brute Force Attack'],
'vulnerability_exploited': ['Unpatched systems',
'Low cybersecurity awareness']}