Have you ever been a victim of cyber criminals traversing the vast online spaces?
Many people have fallen victims to cyber attacks and have ended up losing a lot of money in the process.
In Kenya, the online crooks are now becoming choosy and complicated by meticulously picking on high profile victims, according to a a report by a leading global cybersecurity firm.
In their 2023 Annual Cybersecurity Report, experts from Trend Micro, a leading guru in this field note that the criminals are opting for quality over quantity, seeking higher returns from fewer, more valuable targets.
The report details that the firm, Trend Micro, blocked approximately 37 million email threats, and over half a million malicious Uniform Resource Locators (URLs) within the period.
Our latest data shows that threat actors are fine-tuning their operations, shifting away from large-scale attacks, and instead focusing on a smaller range of targets but with higher victim profiles for maximum gain with minimum effort
Gareth Redelinghuys, Country Managing Director for the African Cluster at Trend Micro
URLs is a unique identifier used to locate a resource on the Internet. It is also referred to as a web address.
The study notes that during the same period, more than one million malicious mobile apps directed at Kenyan businesses and consumers were also saved from falling victims.
“Our latest data shows that threat actors are fine-tuning their operations, shifting away from large-scale attacks, and instead focusing on a smaller range of targets but with higher victim profiles for maximum gain with minimum effort,” says Gareth Redelinghuys, Country Managing Director for the African Cluster at Trend Micro during a recent media interview.
Even as Trend Micro protected Kenyans from hundreds of ransomware attacks, the overall trend shows a decrease in the number of such raids. However, the nature of these attacks has evolved, becoming more sophisticated and harder to detect.
To achieve their evils schemes, the cybercriminals use advanced techniques to avoid being detected, such as Living-Off-The-Land Binaries and Scripts, which use non-malicious files native to operating systems to camouflage their activities.
Global ransomware detection have seen a significant drop from 2021 to 2023, averaging less than half the detections recorded in 2020. However, this decline should not lead to complacency among security teams, as the reduction in volume does not equate to a reduction in threat severity.
Cyber attackers more intelligent
The report also highlights an increase in Trojan FRS threats globally, suggesting that attackers are becoming more adept at bypassing initial detection measures. In 2023, several ransomware families exploited remote and intermittent encryption, as well as unmonitored virtual machines, to bypass Endpoint Detection and Response (EDR) systems. By using less content during encryption, these attacks minimize the chance of triggering detection mechanisms.
Prominent ransomware groups such as Clop and BlackCat were particularly active last year. Clop exploited major vulnerabilities, while BlackCat launched a new variant and leveraged regulatory requirements to pressure victims into quicker responses.
IT leaders must refine their processes and protocols to combat these persistent and increasingly sophisticated attacks with efficiency
Zaheer Ebrahim, Solutions Architect for the Middle East and Africa at Trend Micro
Email threats in Kenya have also seen a shift towards more sophisticated methods. Although email threat detections decreased from over 66 million in 2021 to 37 million in 2023, the rise in malware detection suggests a strategic shift by attackers. Rather than indiscriminately targeting large numbers of users, cybercriminals are now conducting more targeted operations, such as Business Email Compromise (BEC) schemes, which are designed to appear legitimate and evade scrutiny.
“IT leaders must refine their processes and protocols to combat these persistent and increasingly sophisticated attacks with efficiency,” urged Zaheer Ebrahim, Solutions Architect for the Middle East and Africa at Trend Micro.
“As attacks become more difficult to detect, the cost of successful breaches will rise,” added Zaheer.
Did you also know that Kenya has a law that protects you from all kinds of online harassment? The law is called Computer Misuse and Cybercrimes Act 2018 but which was in April, after revision, approved by The National Assembly as Computer Misuse and Cybercrime (Critical Information Infrastructure and Cybercrime Management) Regulations, 2024.
Referenced as Legal Notice No. 44 of 2024, the regulations were thoroughly reviewed and have now been acceded to, aligning with the Constitution, the Statutory Instruments Act of 2023, and Section 70 of the Computer Misuse and Cybercrimes Act, 2018.
This Acts in a nutshell co-ordinates collection and analysis of cyber threats, and response to cyber incidents that threaten cyberspace belonging to Kenya.
Kenya’s Computer Misuse and Cybercrimes Act makes it an offence, in Section 27, for a person to communicate with another a message that they know or ought to know would cause the recipient fear; is indecent or offensive in nature; or would detrimentally affect the recipient.
To report a cybercrime incident, you can visit their online reporting portal at https://www.ke-cirt.go.ke/report or send an email to incident@ke-cirt.go.ke.
Trend Micro is a global cybersecurity leader dedicated to making the world safe for the exchange of digital information. With a robust platform that protects millions of individuals and thousands of organizations across various environments, Trend Micro leverages decades of security expertise, global threat research, and continuous innovation to deliver advanced threat defense techniques optimized for clouds, networks, devices, and endpoints.
