Cyber attacks targeting government systems and cloud service providers surged in the three months to September, exposing weaknesses that could compromise sensitive records and disrupt online public services, the Communications Authority of Kenya (CA) has warned.
The regulator detected 44.95 million brute-force attacks, an 85.41 per cent increase, and 27.44 million web application attacks, up 57.62 per cent, between July and September.
Brute-force attacks involve repeated attempts to guess passwords or login credentials, while web application attacks exploit weaknesses in software, server configurations and databases to gain unauthorised access.
Government systems and cloud service providers were the main targets of brute-force attacks, with criminals seeking to compromise database servers and user authentication credentials, the CA said in its latest cybersecurity report.
Government systems and internet service providers (ISPs) were also the main targets of web application attacks, with criminals exploiting vulnerable third-party libraries, insecure server configurations and weaknesses in open-source software. Such vulnerabilities can expose systems to remote access, allowing attackers to steal information, gain higher access privileges or interfere with operations.
The country recorded 2.696 billion cyber threat incidents during the quarter, a 14.45 per cent increase from the three months to June. System attacks accounted for more than 2.5 billion detected events, while malware attempts rose 20.01 per cent to 70.8 million.
The CA identified weak authentication controls, compromised credentials, inadequate patching and the absence of multi-factor authentication as key vulnerabilities that attackers exploited to access systems and escalate privileges.
These weaknesses can leave databases and other connected infrastructure exposed to unauthorised remote access.
Malware attacks targeting government systems, ISPs and cloud providers can steal confidential information, corrupt data, install backdoors or encrypt systems, potentially disrupting operations.
As more government services move online, successful intrusions could also expose citizens’ personal records or interfere with applications and digital payments, depending on the level of access obtained.
The regulator also warned that criminals were increasingly using artificial intelligence (AI) to support cybercrime, including generating convincing fraudulent messages and automating malicious activity.
Limited public awareness of phishing and social engineering further increases the risk of successful attacks, as unsuspecting users may be tricked into revealing credentials or opening malicious links.
Despite the rise in detected threats, the CA issued 20.26 million cybersecurity advisories during the quarter, a 2.36 per cent decline from the preceding three months.
The advisories provide technical guidance on emerging risks and recommended safeguards, including software updates, stronger authentication, secure password management and antivirus protection.
The findings come as government agencies respond to a separate warning about critical vulnerabilities in PHP, a widely used server-side programming language that supports websites, web applications and digital services.
Last week, the Ministry of Information, Communications and the Digital Economy directed ministries, departments and agencies to identify affected systems and investigate signs of possible attacks.
The warning followed an international security research report that identified weaknesses in PHP, which supports close to 70 per cent of websites worldwide. The flaws could allow hackers to execute unauthorised instructions on vulnerable systems.
“The vulnerabilities have the potential to expose affected systems to remote code execution,” the government said in a communication issued by the State Department for ICT and the Digital Economy in collaboration with the ICT Authority.
It warned that the flaws could threaten the confidentiality, integrity and availability of government information systems and online public services.
