Report library
East AfricaThreat actor reviewTLP:GREEN
East Africa Ransomware Review 2026
28 Aug 2026 · Extortion Tracking Cell · 28 pages
A review of extortion activity affecting organisations in Ethiopia, Kenya, Uganda, Tanzania, Rwanda, Somalia and Djibouti, including affiliate behaviour, ransom demands and disclosure patterns.
Key findings
- 01
Leak site postings naming East African victims rose materially year on year, with financial services the second most named sector after logistics.
- 02
Affiliates increasingly exfiltrate before encryption, shifting the primary risk from downtime to regulatory and customer data exposure.
- 03
Recovery times are driven less by decryption and more by the absence of tested restore procedures for virtualised cores.
Affected entities
- — Microfinance
- — Insurance
- — Logistics
- — Mid-tier banks
Threat categories
Indicators of compromise
| Type | Value | Note |
|---|---|---|
| url | hxxp://kesari-leaks[.]onion | Leak site used by the Kesari Locker operation |
| sha256 | 4d81…a903 | Hypervisor-targeting locker build |
Recommended mitigations
- Immutable, offline backups for hypervisor datastores
- Restrict and monitor hypervisor management plane access
- Pre-agreed regulator and customer communication playbooks