Africa Registers Highest Industrial Systems Attacks

Malicious objects of all types were detected and blocked on 34 percent of Industrial Control System (ICS) computers in the first half of 2023, according to the ICS CERT landscape report by Kaspersky.

In Africa over this period attacks were detected on 40.3 percent of ICS computers, placing it in first place among the other regions. The top industries under attack were energy (45.9 percent), engineering & integration (44 percent), and building automation (40 percent). All these attacks were blocked after detection.

ICS computers are used in oil & gas, energy, automotive manufacturing, building automation infrastructures and other spheres to perform a range of operational technology (OT) functions – from the workstations of engineers and operators to supervisory control and data acquisition (SCADA) servers and Human Machine Interface (HMI). Cyberattacks on industrial computers are considered to be extremely dangerous as they may cause material losses and production downtime for the controlled production line and even the facility as a whole. Moreover, industrial enterprises put out of service can seriously undermine a region’s social welfare, ecology and macroeconomics.

An analysis of the most significant and targeted threats detected on ICS computers in selected countries of Africa in the first half of 2023 shows that the threat landscape can vary between countries and between industries due to the differences in the security maturity of different countries/industries and the current focus of threat actors. In South Africa in the first half of 2023 malware was detected and blocked on 29.1 percent of ICS computers, in Nigeria on 32.6 percent, in Kenya on 34.5 percent of machines.

There are different types of cyberthreats that OT-related computers face – malicious scripts, spy trojans, worms, ransomware, and others. In the first half of 2023, Africa had the highest percentage of ICS computers on which spyware was blocked (9.8 percent). The Middle East and Southeast Asia had similarly high percentages (8.3 percent and 8.1 percent). The global average stands at 6.1 percent.

Africa was also the region with the highest percentage of ICS computers (14,8%) on which attacks from denylisted Internet resources were blocked (these are web resources associated with distributing or controlling malware). The global average is 11.3 percent.

Viruses and worms spread across ICS networks by means of removable media, shared folders, infected files, such as backups, and network attacks on outdated software. The percentage of ICS computers on which worms were detected was very high in Africa (7 percent vs. 2.3 percent global average), making this region the leader by percentage of ICS computers on which threats were detected after removable devices were connected.

“Africa’s industrial landscape is diverse, ranging from large-scale mining operations to small-scale agriculture. This means that ICS cybersecurity solutions need to be adaptable to various sectors and technologies. In some regions, legacy ICS systems that lack modern security features are still in use. These systems are often more vulnerable to cyberthreats and require significant upgrades. Lastly, some critical infrastructure in Africa is located in remote areas with limited connectivity, which can make it difficult to monitor and secure ICS assets effectively,” comments Evgeny Goncharov, Head of Kaspersky ICS CERT. “By understanding these risks, organisations can make informed decisions, allocate resources wisely, and efficiently fortify their defenses. In doing so, they not only protect their bottom line but also contribute to a safer and more secure digital ecosystem for all.”