Examining the Cybersecurity Impact of State-Linked Threat Actors in African Digital Infrastructure
Article content
Abstract
Our paper presents results from a review of impacts of foreign threat actors on African cyberspace, with a focus on Chinese nationals between 2007 and 2025. We identified three case in which, on demand of African officials, Chinese actors helped to access to citizen data and privacy or used citizen data without clear agreement. We also identified 21 threat actor groups involved in 55 incidents, acting on their own and targeting about 21 countries. Those 55 incidents were analyzed with respect to their frequency, perpetrator type, motivation, and victim type. We found that incidents related to hacking-on-demand of African countries are marginal compared to threat actor groups’ intrusions that are increasingly targeting Africa; that most frequent perpetrators are advanced persistent threat (APT) groups; that most incidents are motivated by information theft and espionage; that the more countries have close partnership with China, the more they are likely to be targeted; and that South Africa is the most targeted country. Based on findings, the author suggests that African Computer Security Incident Response Teams (CSIRT) should follow up on activities of threat actor groups globally and locally, and release reports allowing authorities to better understand the global and specific country’s cyber-threat landscapes. For example, those teams should be able to investigate and flush out hidden malwares in devices before these latter reach low-income households.
Keywords
Campaigns and advanced persistent threat (APT) groups, Chinese threat actors, information security, information theft and espionage
Downloads
References
Statista. “Number of internet users in Africa as of February 2025, by country.” Statista.com. https://www.statista.com/statistics/505883/number-of-internet-users-in-african-countries/ (accessed Jan. 27, 2026).
R. K. Reddy. “China’s going global policy: a prelude to the BRI.” Orcasia.org. https://orcasia.org/chinas-going-global-policy-a-prelude-to-the-bri (accessed Jan. 27, 2026).
P. Nantulya. “FOCAC 2024: elevating African interests beyond the Africa-China summit.” Africacenter.org. https://africacenter.org/spotlight/focac-2024-elevating-african-interests-africa-china-summit/ (accessed Jan. 27, 2026).
J. Meservey. “Government buildings in Africa are a likely vector for Chinese spying.” Heritage.org. https://www.heritage.org/sites/default/files/2020-06/BG3476.pdf (accessed Jan. 27, 2026).
Digwatch. “MTN and Huawei to launch Africa’s first 5.5G trial.” Dig.watch. https://dig.watch/updates/mtn-and-huawei-to-launch-africas-first-5-5g-trial (accessed Jan. 27, 2026).
J. Barton. “Orange partners with Huawei to deploy 5G in Egypt.” Developingtelecoms.com. https://developingtelecoms.com/telecom-technology/wireless-networks/18635-orange-partners-with-huawei-to-deploy-5g-in-egypt.html (accessed Jan. 27, 2026).
J. Aglionby, E. Feng and Y. Yang. “African Union accuses China of hacking headquarters.” FT.com. https://www.ft.com/content/c26a9214-04f2-11e8-9650-9c0ad2d7c5b5 (accessed Jan. 27, 2026).
China Law Translate. “PRC National Intelligence Law (as amended in 2018).” Chinalawtranslate.com. https://www.chinalawtranslate.com/en/national-intelligence-law-of-the-p-r-c-2017/ (accessed Jan. 27, 2026).
Statista. “Share of internet users in Africa as of February 2025, by country.” Statista.com. https://www.statista.com/statistics/1124283/internet-penetration-in-africa-by-country/ (accessed Jan. 27, 2026).
N. Kshetri. Cybercrime and cybersecurity in the Global South. Palgrave Macmillan, 2013.
C. Sall, “Analysis of cyber incidents in Senegal from 2005 to 2023.” Afr J. Inf Commun, no 34, pp. 1–19, Dec. 2024, https://doi.org/10.23962/ajic.i34.17851.
African Union. “African Union Convention on Cyber Security and Personal Data Protection.” AU.int. https://au.int/sites/default/files/treaties/29560-treaty-0048_-_african_union_convention_on_cyber_security_and_personal_data_protection_e.pdf (accessed Jan. 28, 2026).
International Telecommunication Union. “Global Cybersecurity Index 2024.” ITU.int. https://www.itu.int/dms_pub/itu-d/opb/hdb/d-hdb-gci.01-2024-pdf-e.pdf (accessed Jan. 28, 2026).
Kaspersky. “ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms.” Securelist.com. https://securelist.com/faq-the-projectsauron-apt/75533/ (accessed Apr. 09, 2026).
Kaspersky. “Equation Group: questions and answers.” Media.kasperskycontenthub.com. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf (accessed Apr. 09, 2026).
Kaspersky. “Unveiling Careto, the Masked APT.” Media.kasperskycontenthub.com. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20133638/unveilingthemask_v1.0.pdf (accessed Apr. 09, 2026).
A. Burgher. “Fantasy: a new Agrius wiper deployed through a supply-chain attack.” Welivesecurity.com. https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-chain-attack/ (accessed Apr. 09, 2026).
U.S.-China Economic and Security Review Commission. “Section 3: China’s strategic aims in Africa.” USCC.gov https://www.uscc.gov/sites/default/files/2020-12/Chapter_1_Section_3--Chinas_Strategic_Aims_in_Africa.pdf (accessed Jan. 28, 2026).
J. Parkinson, N. Bariyo and J. Chin. “Huawei technicians helped African governments spy on political opponents.” WSJ.com. https://www.wsj.com/articles/huawei-technicians-helped-african-governments-spy-on-political-opponents-11565793017 (accessed Jan. 28, 2026).
B. Jili. “The Spread of surveillance technology in Africa stirs security concerns.” Africacenter.org. https://africacenter.org/spotlight/surveillance-technology-in-africa-security-concerns/ (accessed Jan. 28, 2026).
D. Cave, F. Ryan and V. X. Xu. “Mapping more of China’s tech giants: AI and surveillance.” ASPI.org https://www.aspi.org.au/report/mapping-more-chinas-tech-giants/ (accessed Jan. 28, 2026).
L. Travers, “Algorithmic coloniality? The case of Chinese artificial intelligence technology and Zimbabwean surveillance.” Transcience J., vol. 15, no 2, pp. 48-82, 2024, https://www2.hu-berlin.de/transcience/Vol15_No2_S48_S82.pdf.
Kaspersky. “Kaspersky Lab uncovers operation NetTraveler, a global cyberespionage campaign targeting government-affiliated organizations and research institutes.” Kaspersky.com. https://www.kaspersky.com/about/press-releases/kaspersky-lab-uncovers-operation-nettraveler-a-global-cyberespionage-campaign-targeting-government-affiliated-organizations-and-research-institutes (accessed Jan. 28, 2026).
Common Vulnerabilities and Exposures. “CVE-2012-0158.” CVE.org. https://www.cve.org/CVERecord?id=CVE-2012-0158 (accessed Jan. 28, 2026).
Common Vulnerabilities and Exposures. “CVE-2010-3333.” CVE.org. https://www.cve.org/CVERecord?id=CVE-2010-3333 (accessed Apr. 09, 2026).
N. Villeneuve and K. Wilhoit. “Safe a targeted threat.” Cybercampaigns.net. http://cybercampaigns.net/wp-content/uploads/2013/05/Safe-A-Targeted-Threat.pdf (accessed Jan. 28, 2026).
Mandiant. “APT1: exposing one of China’s cyber espionage units.” Services.google.com. https://services.google.com/fh/files/misc/mandiant-apt1-report.pdf (accessed Jan. 29, 2026).
J. Jordan and Al Jazeera Investigative Unit. “Spy cables: China behind South Africa nuclear break-ins.” Aljazeera.com. https://www.aljazeera.com/news/2015/2/25/spy-cables-china-behind-s-africa-nuclear-break-ins (accessed Jan. 29, 2026).
Check Point. “From HummingBad to worse: new details and an in-depth analysis of the Hummingbad android malware campaign.” Blog.checkpoint.com. https://blog.checkpoint.com/wp-content/uploads/2016/07/HummingBad-Research-report_FINAL-62916.pdf (accessed Jan. 29, 2026).
PwC and BAE Systems. “Operation Cloud Hopper: exposing a systematic hacking operation with an unprecedented web of global victims.” PwC.com. https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-report-april-2017.pdf (accessed Jan. 29, 2026).
Federal Bureau of Investigation (FBI). “APT10 group: conspiracy to commit computer intrusions; conspiracy to commit wire fraud; and aggravated identity theft.” FBI.gov. https://www.fbi.gov/wanted/cyber/apt-10-group (accessed Jan. 29, 2026).
G. Kadiri and J. Tilouine. “At Addis Ababa, the headquarters of the African Union spied on by Beijing (in French).” Lemonde.fr. https://www.lemonde.fr/afrique/article/2018/01/26/a-addis-abeba-le-siege-de-l-union-africaine-espionne-par-les-chinois_5247521_3212.html (accessed Jan. 29, 2026).
R. Satter. “Exclusive: suspected Chinese hackers stole camera footage from African Union–memo.” Reuters.com. https://www.reuters.com/world/china/exclusive-suspected-chinese-hackers-stole-camera-footage-african-union-memo-2020-12-16/ (accessed Jan. 29, 2026).
A. C. Cyr. “Mustang Panda’s hodur: old tricks, new Korplug variant.” https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/ (accessed Jan. 29, 2026).
Upstream. “xHelper/Triada malware pre-installed on thousands of low cost Chinese Android devices in emerging markets.” Upstreamsystems.com https://www.upstreamsystems.com/press/press-releases/xhelper-triada-malware-pre-installed-on-thousands-of-low-cost-chinese-android-devices-in-emerging-markets/ (accessed Jan. 29, 2026).
M. Faou and T. Dupuy. “Gelsemium: when threat actors go gardening.” Welivesecurity.com. https://www.welivesecurity.com/2021/06/09/gelsemium-when-threat-actors-go-gardening/ (accessed Jan. 29, 2026).
Kaspersky. “Kaspersky discovers poorly detected backdoor, targeting governments and NGOs around the globe.” Kaspersky.com. https://www.kaspersky.com/about/press-releases/kaspersky-discovers-poorly-detected-backdoor-targeting-governments-and-ngos-around-the-globe (accessed Jan. 29, 2026).
A. Burgher. “BackdoorDiplomacy: upgrading from Quarian to Turian.” Welivesecurity.com. https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/ (accessed Jan. 29, 2026).
T. Hegel. “Cyber soft power: China’s continental takeover.” https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/ (accessed Jan. 29, 2026).
Lookout. “Mobile APT surveillance campaigns targeting Uyghurs: a collection of long-running android tooling connected to a Chinese mAPT actor.” Lookout.com. https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf (accessed Jan. 29, 2026).
A. Ross, J. Pearson and C. Bing. “Exclusive: Chinese hackers attacked Kenyan government as debt strains grew.” Reuters.com. https://www.reuters.com/world/africa/chinese-hackers-attacked-kenyan-government-debt-strains-grew-2023-05-24/ (accessed Jan. 29, 2026).
T. Passilly. “Worok: the big picture.” Welivesecurity.com. https://www.welivesecurity.com/2022/09/06/worok-big-picture/ (accessed Jan. 29, 2026).
J. C. Chen, K. Lu, G. Chen, J. Horejsi, D. Lunghi and C. Pernet. “Delving deep: an analysis of Earth Lusca’s operations.” Trendmicro.com. https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf (accessed Jan. 29, 2026).
Mitre Att&ck. “MgBot.” Attack.mitre. https://attack.mitre.org/software/S1146/ (accessed Jan. 29, 2026).
Threat Hunter Team. “Daggerfly: APT actor targets telecoms company in Africa.” Security.com. https://www.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot (accessed Jan. 29, 2026).
F. Muñoz. “Evasive Panda APT group delivers malware via updates for popular Chinese software.” Welivesecurity.com. https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/ (accessed Jan. 29, 2026).
J. C. Chen and D. Lunghi. “Trend Micro. Earth Krahang exploits intergovernmental trust to launch cross-government attacks.” Trendmicro. https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html (accessed Jan. 29, 2026).
FBI, CNMF, NSA et al. “People’s Republic of China-linked actors compromise routers and IoT devices for botnet operations.” IC3.gov. https://www.ic3.gov/CSA/2024/240918.pdf (accessed Jan. 29, 2026).
Recorded Future. “Chinese state-sponsored RedJuliett intensifies Taiwanese cyber espionage via network perimeter exploitation.” Assets.recordedfuture.com. https://assets.recordedfuture.com/insikt-report-pdfs/2024/cta-cn-2024-0624.pdf (accessed Jan. 29, 2026).
L. M. Chang, T. Chen, L. Bermejo and T. Lee. “Game of emperor: unveiling long term Earth Estries cyber intrusions.” Trendmicro.com. https://www.trendmicro.com/en_us/research/24/k/earth-estries.html (accessed Jan. 29, 2026).
M. Faou and T. Bin Taj. “FamousSparrow: a suspicious hotel guest.” Welivesecurity.com. https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/ (accessed Jan. 29, 2026).
M. Lechtik, A. Kayal, P. Rascagneres and V. Berdnikov. “GhostEmperor: from ProxyLogon to kernel mode.” Securelist.com. https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407 (accessed Jan. 29, 2026).
Recorded Future. “TAG-100 uses open-source tools in suspected global espionage campaign, compromising two Asia-Pacific intergovernmental bodies.” Go.recordedfuture.com. https://go.recordedfuture.com/hubfs/reports/cta-2024-0716.pdf (accessed Jan. 29, 2026).
L. Rochberger and D. Frank. “Operation Diplomatic Specter: an active Chinese cyberespionage campaign leverages rare tool set to target governmental entities in the Middle East, Africa and Asia.” https://unit42.paloaltonetworks.com/operation-diplomatic-specter/ (accessed Feb. 07, 2026).
L. Rochberger. “Phantom Taurus: a new Chinese Nexus APT and the discovery of the NET-STAR malware suite.” Unit42.paloaltonetworks.com. https://unit42.paloaltonetworks.com/phantom-taurus/#post-158604-_7mib773okdxz (accessed Jan. 24 2026).
Recorded Future. “Chinese state-sponsored RedDelta targeted Taiwan, Mongolia, and Southeast Asia with adapted PlugX infection chain.” Go.recordedfuture.com. https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf (accessed Jan. 29 2026).
Kaspersky. “APT41 targets Southern African organization in espionage attack.” Kaspersky.com. https://www.kaspersky.com/about/press-releases/kaspersky-apt41-targets-southern-african-organization-in-espionage-attack (accessed Jan. 29 2026).
D. Kulik and D. Pogorelov. “The SOC files: rumble in the jungle or APT41’s new target in Africa incidents.” Securelist.com https://securelist.com/apt41-in-africa/116986/ (accessed Jan. 29 2026).
FBI. “Most wanted: APT41 group.” https://www.fbi.gov/wanted/cyber/apt-41-group (accessed Jan. 29 2026).
Electronic Transactions Development Agency, Jan. 2026, “Threat group cards: a threat actor encyclopedia,” Electronic Transactions Development Agency. [Online]. Available: https://apt.etda.or.th/cgi-bin/aptsearch.cgi (accessed Apr. 09 2026).
Cybersecurity and Infrastructure Security Agency. “Nation-state threats.” CISA.gov. https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors (accessed Jan. 29 2026).
U.S.-China Economic and Security Review Commission. “Hearing on China’s strategic aims in Africa.” USCC.gov. https://www.uscc.gov/sites/default/files/2020-06/May_8_2020_Hearing_Transcript.pdf (accessed Jan. 29 2026).
Article details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
You must read and accept the copyright terms and conditions(click here for copyright terms).