Over 2.6 billion cyber threats detected in three months as hackers exploit weak passwords

Over 2.6 billion cyber threats detected in three months as hackers exploit weak passwords

Network attacks accounted for 2,547,212,357 incidents, while industrial control systems recorded 5,508,102 attacks and database attacks stood at 228,507.

Kenya detected more than 2.6 billion cyber threats between July and September 2026, prompting the issuance of more than 20.3 million cybersecurity advisories as hackers exploited outdated software, weak passwords, insecure applications and gaps in digital security.

A new report by the Communications Authority of Kenya (CA) shows that despite a 97.18 per cent reduction in Distributed Denial-of-Service (DDoS) attacks to 23,124, cybercriminals continued to target essential public services, email servers, web servers and databases.

"The National KE-CIRT/CC detected over 2,552,948,966 cyber threat events during the period between July - September 2026. This represented a 14.45 per cent increase from the threat events detected during the previous period, April - June 2026," reads the report.

Network attacks accounted for 2,547,212,357 incidents, while industrial control systems recorded 5,508,102 attacks and database attacks stood at 228,507.

Malware attack attempts targeting critical information infrastructure increased by 20.01 per cent to 70.8 million compared with the April to June 2026 quarter. Web application attacks also rose by 57.62 per cent to 27.4 million attempts.

Government systems and internet service providers remained among the main targets, with attackers seeking to steal login details, exploit weak web browsers and gain access to data servers.

Latest Stories

• Agnes Wanjiru’s family outraged as UK delays British soldier’s extradition hearing
• Judiciary adopts backup systems for 2027 election dispute filing
• 12 accused ordered to defend themselves in Sh283 million Nairobi cemetery land scandal
• Rights groups ask court to order probe into political violence ahead of 2027 polls

The regulator linked the attacks to weaknesses in third-party software libraries, insecure application programming interfaces (APIs), serverless configurations and open-source software dependencies.

It also warned that limited public awareness of phishing attacks and other methods used to trick people into sharing sensitive information continued to expose individuals and organisations to cybercrime.

"Web application attacks were primarily associated with the exploitation of vulnerable third-party libraries, inadequately secured Application Programming Interfaces (APIs), insecure serverless

configurations and weaknesses within open-source software dependencies. System attacks, on the other hand, were largely attributed to credential-stealing malware, weak access controls, information leakage, continued use of outdated and vulnerable operating systems, and user interaction with malicious links, among other attack techniques," the CA said.

It also warned that the growing use of artificial intelligence by cybercriminals has made fraudulent messages and other malicious activities harder to identify. According to the CA, failure to install software updates and security patches has also left known weaknesses open to exploitation.

The Authority said attackers mainly targeted critical information infrastructure for financial gain and to spread malware, resulting in data breaches, financial losses and the wider spread of malicious software.

Internet service providers and cloud service providers were among the affected industries. The targeted systems included operating systems, network devices, remote access systems, mailing servers, user accounts and backup systems.

The report identified stolen information, broken access controls, information leaks, vulnerable databases, zero-day exploits, remote code execution and insecure system configurations among the methods and weaknesses used in attacks.

Despite the sharp decline in DDoS attacks, hacktivist groups and politically motivated Advanced Persistent Threat actors continued to target critical systems, disrupting essential public services and raising the cost of responding to cyber incidents.

The affected sectors included health and government, while email and web servers remained key targets. The attacks also reduced service quality for users and increased the workload faced by cloud service providers seeking to detect and contain them.

To address the threat, the Authority said it strengthened cybersecurity awareness, promoted the use of firewalls and intrusion detection systems. It also urged users to update software, use strong passwords and enable multi-factor authentication.

"Implement appropriate access management with strong password management, disconnect devices from the network if not in use and update libssh software to the latest versions," reads the report.

The CA also stepped up regional and international cooperation through engagements with cybersecurity agencies from the UK, South Sudan and Tanzania, alongside training and information-sharing programmes involving government, security and private sector institutions.

The Authority is also expected to participate in the Africa Cyber Defence Forum in Nairobi from November 2 to 5, 2026, where participants will discuss cyber resilience, artificial intelligence, digital security and ways to improve Africa's response to cyber threats.