Incident Reporting – A Major Concern in the Africa CyberThreat Assessment Report 2023 by Interpol.

Having taken a thorough look at the African Cyberthreat Assessment Report 2023 by Interpol’s African Cybercrime Operations Desk with data drawn from Interpol’s member countries in the region and other private partners. A major concern where the emphasis was placed across the report is the issue of incident reporting within the African region limiting the effort of law enforcement to curb cybercrimes.

The following are major highlights of the report –

• 7 Key prominent cyber threat captured in the reports are as follow; Business Email Compromise (BEC), Phishing, Ransomware Attacks, Banking Trojan and Stealers Online Scams, and Crimeware-as-a-Service.
• Many of the actors carrying out BEC scams have been found to be based in West Africa, but unfortunately for their victims, their schemes are not confined by geographical borders.
• Two operations disrupting the ongoing BEC activities in collaboration with EFCC and NPF in Nigeria
• Factors that contribute to the rise in BEC attacks across Africa; lack of basic cybersecurity practices within companies, and lack of reporting also hinder law enforcement agencies ability to properly prosecute the criminals involved.
• A huge number of malicious phishing attacks were detected in the African region, but the number of reports to law enforcement agencies is much lower than expected. This was found to be due to incorrect classification of attacks to a lack of public awareness on how to report such crimes
• The lack of knowledge surrounding cyber hygiene in Africa makes people even more vulnerable and makes it even easier for those committing these crimes to launch successful phishing campaigns without detection or reprisals from local authorities.
• Most of these malicious activities that come with ransomware infections may have been facilitated by outdated systems and ineffective security solutions that leave gaps for cybercriminals to exploit.
• A lack of cybercrime regulations and legislation may be contributing to the spread of ransomware and no clear-cut guidelines for protecting against such threats.
• The top five most frequently attacked sectors include government agencies, education, energy, retail, and fast-moving consumer goods. Other reports pointed to critical infrastructure like healthcare and transportation.
• From data shared from 42 countries, only 59 reports of ransomware cases have been filed with law enforcement agencies in 11 African countries.
• Victims often remain silent about incidents and pay ransoms quietly, while attackers do not always publish data from compromised networks.
• Banks and financial institutions need to put in place measures to protect customers from cybercrime such as phishing scams and malware infections –
• Individuals must also remain aware and be proactive when using the Internet for financial transactions
• A collective effort between banks, government agencies, and individual users is required in order to stem the tide of cybercrime caused by banking trojans in Africa
• Scams are also very common on social media platforms, from fake job, offers to pyramid schemes and investment fraud.
• Tech support scams are on the rise wherein criminals pose as legitimate representatives from technology companies offering technical assistance in order to gain access to users’ computers and extract valuable data such as passwords and financial information.
• These types of online crimes are particularly prolific in the African region due to a lack of public awareness about their existence and the way they operate.
• The CaaS model makes it difficult to attribute a crime to a particular individual because the means and infrastructure is shared among multiple malicious actors or syndicate groups.

Stakeholders should work together and collaborate to change this narrative, as they can help improve proactiveness towards curbing cybercrime in the African region.