A ransom note is the last thing an attacker leaves on a South African network – and before it appears, someone has usually signed in with a stolen password or got in through a router that missed its updates.
The attacker likely spent days or weeks finding the data worth stealing.
Interpol’s African Cyberthreat Assessment Report 2026 found that South Africa accounted for 92% of all ransomware detections in Africa in 2025. And while detection figures may be influenced by factors such as connectivity levels and reporting requirements, the report nonetheless highlights South Africa as a primary target for ransomware activity on the continent.
“The 92% tells you where ransomware got caught,” says Doros Hadjizenonos, regional director, Southern Africa at Fortinet. “By that stage the attacker had got in and very likely taken what they wanted weeks earlier. Locking the files is how they get paid, yes, but the part South Africans can most effectively do something about happens at the start.”
Fortinet is one of the partners whose threat data Interpol drew on for the report. Its FortiGuard Labs data shows criminals running automated tools that scan tens of thousands of systems per second for unpatched routers and exposed cloud services.
The passwords a browser remembers
Southern Africa’s malware detections lean heavily towards infostealers and backdoors, which Interpol suggests may cover for deploying ransomware later. An infostealer copies saved passwords and active login sessions from an infected computer and sends them to whoever runs it – and the victim usually notices nothing.
Fortinet’s 2026 Global Threat Landscape Report found a further 79% increase in logs from infostealer-infected systems available to criminals – after a 500% jump the year before. These stealer logs now make up 67% of the datasets advertised and shared in dark web database markets, against about 6% for lists of leaked passwords. Interpol’s report adds that African-origin material on dark web forums grew 62% year on year, much of it identity documents and banking details.
“Picture a family laptop that a parent also uses for remote work,” Hadjizenonos says. “A child installs a free game add-on that carries an infostealer, while the browser already has the work email password saved, and the VPN login too. Nothing crashes because of the newly installed software, so nobody suspects anything, but weeks later someone buys that login and signs in to the employer’s network as if they work there.”
Equipment that missed its updates
The other general route in is a lot more mundane, but no less serious. According to the report, South Africa accounted for 43,6% of the exploitable vulnerabilities the Shadowserver Foundation detected across Africa in 2025. Among the most targeted were outdated routers and unpatched VPNs – weaknesses Interpol describes as publicly known and well documented.
Fortinet’s research puts the time between a critical flaw going public and attackers exploiting it at as little as 24 to 48 hours, down from four to five days in earlier reports.
“A small business with one IT person, or none, used to have several days to patch a firewall,” says Hadjizenonos. “Now scanning software is hunting for the flaw before anyone in the office has potentially even read the advisory.”
What to change this month
October is Cybersecurity Awareness Month, and Hadjizenonos says the most useful changes cost little.
For households, he suggests keeping work logins off shared devices and using a trusted password manager. “Turn on multi-factor authentication wherever it’s available, because then a stolen password on its own gets the illicit buyer of the data nowhere.”
For organisations, he puts Internet-facing equipment at the top of the list.
“Patch what attackers can see from outside first – the firewalls and VPN gateways,” he says. “Then find out which of your employees’ passwords and sessions are already for sale, because the people selling them won’t wait for your next audit.”