Between July and September 2026, Kenya’s national cyber monitoring team detected 2,696,335,021 cyber threat events. That works out to roughly 29 million a day, and it is 14.45% more than the April to June quarter.

The numbers come from the 43rd cybersecurity report of the National KE-CIRT/CC, the national computer incident response team based at the Communications Authority of Kenya.

The headline figure is big, but the more interesting part is how lopsided it is and which categories moved in strange directions.

System attacks made up 2,552,948,966 of the 2.7 billion events, about 95% of the total. Within that, network attacks alone accounted for 2,547,212,357. Industrial control system attacks came to 5,508,102, database attacks to 228,507, and domain attacks to zero.

System attacks grew 13.25% from the previous quarter.

According to the report, these attacks mostly went after operating systems and database servers at internet service providers and cloud companies.

The usual causes were unpatched software, old legacy systems and poorly secured Internet of Things devices. The exploits named include stolen credentials, broken access controls, outdated operating systems, malicious links, remote code execution and zero-day vulnerabilities.

The motive was mainly money and spreading malware.

The smaller categories are where the growth was sharpest. Brute force attacks, which are repeated automated guesses at logins, hit 44,949,518, up 85.41%. Web application attacks reached 27,435,527, up 57.62%. Malware attempts totalled 70,800,154, up 20.01%.

The brute force story is mostly about exposed doors. Attackers went after IoT devices and remote systems through open Telnet ports and badly set up Remote Desktop Protocol services.

Compromised passwords, a lack of multi-factor authentication and the wider shift to remote work made it easier. Cloud providers and government systems took most of the pressure.

Web application attacks leaned on weaknesses in widely used code libraries such as Log4J, APIs with weak security, insecure serverless functions and flaws in open-source components.

Many of them also exploited poor SSL/TLS configurations, which lets attackers get in or read data in transit. Government systems and internet service providers were the main targets.

Malware went after end-user devices, IoT gear, web applications, email systems, network devices and remote access trojans.

Internet service providers, cloud providers and government were hit hardest, followed by schools and universities, individuals, banks, crypto platforms, foreign exchange platforms and online gambling sites.

Mobile application attacks dropped 3.08% to 177,732. The targets were Android phones, Android TVs, set-top boxes and the Google TV app.

Attackers abused the Android Debug Bridge, a developer feature that should be switched off on consumer devices, and took advantage of default credentials that nobody changed.

Distributed denial-of-service attacks, the kind that flood a service with traffic until it stops responding, fell 97.18% to 23,124.

There’s no explanation for the drop, but hacktivists and politically motivated advanced persistent threat groups kept going after public services, with the health sector and government among the most affected.

The common techniques were spoofed DNS, NTP and SSDP traffic used to amplify floods, networks that fail to validate source addresses so IP spoofing works, and botnets built from home routers and other devices still running default passwords.

The team issued 20,258,111 threat advisories in the quarter, which is 2.36% fewer than the quarter before, even though detections rose. That means roughly one advisory for every 133 detected events.

For system attacks specifically, many related events get bundled into one consolidated report so that affected organizations receive a single, usable warning with mitigation steps instead of millions of near-identical alerts.

System attacks produced about 8.4 million advisories from 2.5 billion events.

The breakdown by category is uneven. Web application attacks produced the most advisories at 10,380,579 even though they were only about 1% of detected events.

System attacks followed with 8,379,145, then brute force at 916,418, malware at 549,931, mobile at 18,837 and DDoS at 13,201. Mobile was the only small category where advisories rose sharply, up 34.43%, while detections of mobile attacks fell.

The team also handled 112 digital investigations and 24 digital forensics cases.

The biggest blame goes to the volume mainly on three things: systems that were not patched, users who were not aware enough about phishing and other social engineering, and attackers using AI to make their attacks more convincing and faster to run.

The report also points to AI-assisted phishing and credential harvesting, and to cybercrime sold as a service, which lowers the technical skill needed to attack someone.

Ransomware stayed a steady problem. Groups named as active include Qilin, The Gentlemen, Cl0p, Orova and Dire Wolf, and the report says some Kenyan organizations were among those targeted or listed by ransomware groups.

Attackers typically got in through phishing, stolen credentials, exposed remote access services or flaws in internet-facing systems, then moved sideways through the network and copied out data before locking anything.

The report singles out Citrix NetScaler as an example, where disclosed flaws and observed exploitation showed the cost of slow patching.

The advice repeated across by National KE-CIRT/CC is plain. Turn on multi-factor authentication, patch quickly, keep an accurate inventory of what you run, remove unnecessary internet exposure, segment networks, keep isolated backups and test restoring them, change default passwords, and turn off features like the Android Debug Bridge when they are not needed.

The quarter also had a busy calendar. In July, 16 people from the Authority, the National Computer and Cybercrimes Coordination Committee, the ICT Authority, the Directorate of Criminal Investigations and the ministry took part in a five-day training in Nairobi on building a national threat intelligence sharing platform

It is part of the Kenya Cyber Resilience initiative, a three-year programme funded by the European Union and run by Expertise France with the Estonian Centre for International Development. The training produced an initial action plan and work on a national threat intelligence dashboard.

In August, the Authority’s cybersecurity director, Dr. Vincent Ngundi, spoke at the Africa PKI Consortium meeting in Abuja and said the Authority has licensed and accredited six electronic certification service providers.

Tanzania’s regulator visited to learn how to run a cybersecurity operations centre, and Kenya Navy communications students came through for a benchmarking visit.

September brought delegations from South Sudan’s national CIRT and the National Police Service’s General Service Unit, and a visit from Ollie Whitehouse, chief technology officer at the UK’s National Cyber Security Centre.

On September 23, the National KE-CIRT/CC Cybersecurity Committee, which has representatives from more than 50 organizations, held its 56th meeting.

The e-government sector reported it was tightening data protection after a breach earlier in the year while working through audit requirements from the Office of the Data Protection Commissioner.

The aviation sector flagged credential theft, third-party software compromise and known vulnerabilities as its main risks, and said it is working toward its own security operations centre.

Nairobi hosts the 7th Africa Cyber Defense Forum from November 2-5 2026, with workshops on the first two days and the main conference on the last two.

The theme is cyber sovereignty in a fragmented world, and the agenda covers regional cooperation between national response teams, home-grown security tools, secure cloud infrastructure, AI and local talent development.

If the next quarterly report shows another jump in brute force and web application attacks, the cause is unlikely to be exotic. The report’s own findings suggest it will be unpatched servers, exposed remote access and passwords that were never changed.