Examining the Cybersecurity Impact of State-Linked Threat Actors in African Digital Infrastructure

Our paper presents results from a review of impacts of foreign threat actors on African cyberspace, with a focus on Chinese nationals between 2007 and 2025. We identified three case in which, on demand of African officials, Chinese actors helped to access to citizen data and privacy or used citizen data without clear agreement. We also identified 21 threat actor groups involved in 55 incidents, acting on their own and targeting about 21 countries. Those 55 incidents were analyzed with respect to their frequency, perpetrator type, motivation, and victim type. We found that incidents related to hacking-on-demand of African countries are marginal compared to threat actor groups’ intrusions that are increasingly targeting Africa; that most frequent perpetrators are advanced persistent threat (APT) groups; that most incidents are motivated by information theft and espionage; that the more countries have close partnership with China, the more they are likely to be targeted; and that South Africa is the most targeted country. Based on findings, the author suggests that African Computer Security Incident Response Teams (CSIRT) should follow up on activities of threat actor groups globally and locally, and release reports allowing authorities to better understand the global and specific country’s cyber-threat landscapes. For example, those teams should be able to investigate and flush out hidden malwares in devices before these latter reach low-income households.