Kenya's computer systems were hit by nearly 2.7 billion cyber threat events between July and September 2026, a 14.45 per cent rise from the previous quarter, with password-guessing and website attacks growing fastest, the Communications Authority of Kenya (CA) says.

The figures are contained in the latest quarterly report of the National Kenya Computer Incident Response Team Coordination Centre (National KE-CIRT/CC), which is based at the Authority. The report, the team's 43rd, was highlighted by The Star and Techweez on Monday, October 26, 2026.

In total, the team detected 2,696,335,021 threat events in the three months, about 29 million a day. The totals count detected events, such as scans, intrusion attempts and malicious traffic, rather than confirmed breaches or victims.

Brute-force attacks nearly double

The sharpest jump was in brute-force attacks, where attackers repeatedly try usernames and passwords to break into accounts. These rose 85.41 per cent to almost 45 million. The report links the surge to exposed Telnet ports, badly configured Remote Desktop Protocol services, reused or stolen passwords and the lack of multi-factor authentication, much of it tied to remote working.

Web application attacks climbed 57.62 per cent to 27.4 million. Government systems and internet service providers were among the main targets, with attackers exploiting weaknesses in widely used software libraries, weak application programming interfaces (APIs) and poor server settings.

Malware detections rose 20.01 per cent to 70.8 million, while system attacks, the largest category, accounted for about 2.55 billion events, or roughly 95 per cent of the total.

Two categories fell. Distributed denial-of-service (DDoS) attacks dropped 97.18 per cent to about 23,000, and mobile application threats dipped 3.08 per cent. However, Techweez reported that hacktivists and politically motivated groups remained active against public services, with the health sector and government the most affected by DDoS attacks.

Ransomware and AI-powered scams

The report warns that ransomware gangs are combining system disruption with data theft and ransom demands, typically breaking in through phishing emails, stolen credentials or poorly secured systems facing the internet. Groups named as active include Qilin, Cl0p and Dire Wolf, some of which targeted or listed Kenyan organisations.

It also flags artificial intelligence as a growing threat, saying AI tools are making phishing messages more convincing and easier to send in bulk, making scams harder for ordinary users to spot.

Besides government and internet providers, the report lists cloud companies, banks and financial platforms, schools and universities, crypto and forex platforms, online betting sites and individual users among those hit.

CA's advice

CA Director-General David Mugonyi said that "the exploitation of system vulnerabilities by threat actors continued to pose considerable threats" to critical services and business continuity, according to The Star.

He urged organisations to prioritise "timely patching of operating systems, software applications and firmware," enforce multi-factor authentication, monitor their networks, keep isolated and tested backups, review who has access to systems, secure remote connections and train staff to independently verify unusual payment requests.

The team issued 20.26 million threat advisories during the quarter, 2.36 per cent fewer than in the previous three months. It also handled 112 digital investigations and 24 digital forensics cases, according to Techweez.

Building a shared defence

Kenya is developing a national platform for sharing threat intelligence among government agencies, regulators and private firms under the Kenya Cyber Resilience initiative, a three-year programme funded by the European Union. Nairobi will also host the 7th Africa Cyber Defense Forum from November 2 to 5.

The report comes days after the government issued an urgent alert over critical flaws in PHP software affecting government and business websites, underlining the pressure on organisations to keep their systems up to date.

Photos: BalticServers.com/Wikimedia Commons (data centre, CC BY-SA 3.0); Nbi101/Wikimedia Commons (Nairobi skyline, CC BY-SA 4.0)