Ransomware Threatens Africa's Critical Infrastructure: A 2026 Assessment

Executive Summary

As of March 2026, ransomware attacks have escalated across Africa, increasingly targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks pose significant operational and financial risks, highlighting the need for enhanced cybersecurity measures.

Current Threat Landscape

Ransomware has emerged as a predominant cyber threat in Africa, with a notable surge in attacks against critical infrastructure. In the first quarter of 2024, Kaspersky reported that 32.4% of ICS computers in Africa faced cyber threats, a rate higher than the global average of 24.4%. (kaspersky.co.za) This trend continued into 2025, with a 34% year-over-year increase in ransomware attacks targeting critical industries globally, including those in Africa. (prnewswire.com)

Notable Threat Actors

Several ransomware groups have been identified as active in Africa:

• Qilin (formerly Agenda): This group has been active since July 2022, primarily targeting organizations in developed markets and high-value industries. Between January and April 2025, Qilin ransomed 18 publicly disclosed victims in the healthcare sector. (flashpoint.io)

• Royal (also known as BlackSuit): Formed in 2022, Royal has targeted a wide range of industries, including healthcare, finance, and critical infrastructure. Ransom demands typically range from $1 million to $10 million in Bitcoin. (en.wikipedia.org)

• LockBit: A prolific Ransomware-as-a-Service (RaaS) gang, LockBit has been highly active in Africa, with significant attacks reported in 2024. (interpol.int)

Impact on Critical Infrastructure

The healthcare sector has been particularly vulnerable, with ransomware attacks leading to operational disruptions and data breaches. In 2024, Iranian hackers emerged as the most active cyber attackers targeting healthcare organizations, according to a Microsoft report. (beckershospitalreview.com)

The financial sector has also been targeted, with ransomware attacks leading to significant financial losses and data breaches. For instance, Telecom Namibia suffered a significant ransomware attack in late 2024, leading to the leakage of sensitive customer information. (darkreading.com)

Conclusion

Ransomware attacks on critical infrastructure in Africa are on the rise, with significant implications for operational continuity and financial stability. Organizations must prioritize cybersecurity measures, including regular system updates, employee training, and incident response planning, to mitigate these evolving threats.

Highlights:

• Cyberthreat landscape in Africa: risks and opportunities
• The Top Ransomware Groups Targeting the Healthcare Sector | Flashpoint, Published on Thursday, April 24
• South Africa faces escalating cybersecurity threats to critical infrastructure - DefenceWeb, Published on Sunday, January 19