AFRINTEL is an open-source Cyber Threat Intelligence project focused on cyber incidents affecting African organizations across all 54 countries on the continent. The project documents the nine canonical AFRINTEL incident types: ransomware, data leaks, access sales, DDoS, defacement, account takeover, system intrusion, malware and operational fraud. These events are observed through dark web sources, leak sites, underground forums and OSINT. Incident type, status, confidence and impact are kept separate so that a criminal claim is not silently treated as a confirmed compromise.
| Countries monitored | Threat actors tracked | Period covered | Formats |
|---|---|---|---|
| 54 | 100+ | 2024-2026 | Markdown, STIX 2.1, Visual CTI |
What ends up here is what got observed: posts on leak sites, underground forums and OSINT sources. A victim card keeps whatever status it had when AFRINTEL last reviewed it.
August 2026 collection contains 29 documented incidents across 10 countries: 17 ransomware incidents, 11 data leaks and 1 access sale. South Africa accounts for 11 records, followed by Egypt with 4, then Algeria and Morocco with 3 each. Government and administration account for 6 incidents, finance and banking for 6, and human resources/recruitment for 3. KRYBIT is associated with 6 ransomware publications.
The Furniture Bargaining Council acknowledged server encryption, and DC Partner published a public confirmation of the incident. The analyses document payment data at The Courier Guy, an account-reset workbook at Daily Trust, internal documents from the Conseil Gabonais des Chargeurs and identity data in the RAMED and DGSN/DGST cases. Reviewed samples do not automatically validate overall claimed volumes or acquisition methods.
The report includes follow-up information recorded through 14 September 2026 and distinguishes earlier publications discovered in August. The 13 fewer records than July (-31.0%) describe a change in collection without demonstrating an equivalent decline in compromises.
📄 Full CTI report - August 2026
📦 August 2026 STIX 2.1 / OpenCTI bundle
The September corpus contains 41 documented records across 14 countries: 24 Ransomware, 10 Data Leak, 4 System Intrusion, 2 Defacement and 1 Access Sale. It distinguishes 29 publications dated in September from 12 earlier incidents integrated retrospectively. South Africa accounts for 16 records, followed by Egypt with 7. Underground sources are treated as primary observations; reviewed samples, victim confirmations and indirect exposures remain separate in the analysis.
📄 Full CTI report - September 2026
📋 September 2026 victim records
🔄 August-September 2026 comparison
🖼️ September 2026 visual intelligence
📦 September 2026 STIX 2.1 / OpenCTI bundle
Month status: report, statistics, comparison and visual intelligence published from the 29-publication September cohort; the 12 earlier records remain separate in the retrospective 41-record corpus.
The October provisional corpus currently contains 10 records. The October CTI report, statistics and derived exports have not yet been published; victim records remain under collection and validation.
Between January and June 2026, AFRINTEL documented 294 deduplicated incidents: 113 ransomware, 121 data leaks, 6 access-sale records, 52 DDoS claims, 1 defacement and 1 operational-fraud incident. Q1 accounts for 82 incidents, compared with 212 in Q2. Ransomware is nearly stable between quarters (56 to 57), while the sharp increase in Q2 is driven mainly by data exposure/access activity and DDoS reporting. Six multi-country records expand the semester to 317 geographic occurrences.
The 52 DDoS entries are dated actor claims or availability observations, including 43 Keymous+ observations in May. Repeated observations of the same organization on different dates are not necessarily technically independent attacks.
📦 H1 2026 STIX 2.1 / OpenCTI bundle
Each annual report pulls together the validated monthly corpus for the year: incident-type distribution, country and regional exposure, sector patterns, actor visibility, evidence maturity and the CTI assessment. French and English are kept structurally aligned.
| Year | Documented records | FR | EN |
|---|---|---|---|
| 2024 | 121 | Rapport annuel | Annual report |
| 2025 | 228 | Rapport annuel | Annual report |
2024 current monthly corpus: 121 documented records, reclassified under the same nine-type taxonomy used for 2025. Earlier corrected semiannual reports retain 119-record snapshots and do not include every later retrospective addition present in the current monthly pairs.
2025 current monthly corpus: 228 documented records. H1 contains 112 records and H2 116 after later additions. Geographic views may exceed the canonical total when one card covers multiple countries.
| Period | Documented records | FR | EN |
|---|---|---|---|
| H1 2024 | 46 | Rapport S1 | H1 report |
| H1 2025 | 112 | Rapport S1 | H1 report |
| H2 2025 | 116 | Rapport S2 | H2 report |
| H1 2026 | 294 | Rapport S1 | H1 report |
Counting note: these values follow the monthly pairs currently in the repository: H1 2024 = 46, H1 2025 = 112, H2 2025 = 116 and H1 2026 = 294. Earlier semiannual reports may show 45 or 114 after snapshot-specific deduplication; those values must not be mixed with the enriched monthly corpora.
| Month | FR | EN |
|---|---|---|
| January 2026 | Rapport | Report |
| February 2026 | Rapport | Report |
| March 2026 | Rapport | Report |
| April 2026 | Rapport | Report |
| May 2026 | Rapport | Report |
| June 2026 | Rapport | Report |
| July 2026 | Rapport | Report |
| August 2026 | Rapport | Report |
| September 2026 | Rapport | Report |
| October 2026 | In-progress tracking | Suivi en cours |
| Month | FR | EN |
|---|---|---|
| January 2026 | Statistiques | Statistics |
| February 2026 | Statistiques | Statistics |
| March 2026 | Statistiques | Statistics |
| April 2026 | Statistiques | Statistics |
| May 2026 | Statistiques | Statistics |
| June 2026 | Statistiques | Statistics |
| July 2026 | Statistiques | Statistics |
| August 2026 | Statistiques | Statistics |
| September 2026 | Statistiques | Statistics |
| Comparison | FR | EN |
|---|---|---|
| January vs February 2026 | FR | EN |
| February vs March 2026 | FR | EN |
| March vs April 2026 | FR | EN |
| April vs May 2026 | FR | EN |
| May vs June 2026 | FR | EN |
| June vs July 2026 | FR | EN |
| July vs August 2026 | FR | EN |
| August vs September 2026 | FR | EN |
| Period | Dashboard |
|---|---|
| January 2026 | Visual intelligence |
| February 2026 | Visual intelligence |
| March 2026 | Visual intelligence |
| April 2026 | Visual intelligence |
| May 2026 | Visual intelligence |
| June 2026 | Visual intelligence |
| July 2026 | LinkedIn visual |
| August 2026 | Visual intelligence |
| September 2026 | Visual intelligence |
| H1 2026 | Statistical visual |
| H1 2026 map | Visual map |
| Dataset | File |
|---|---|
| January 2026 | STIX Bundle |
| February 2026 | STIX Bundle |
| March 2026 | STIX Bundle |
| April 2026 | STIX Bundle |
| May 2026 | STIX Bundle |
| June 2026 | STIX Bundle |
| July 2026 | STIX Bundle |
| August 2026 | STIX Bundle |
| September 2026 | STIX Bundle |
| H1 2026 | STIX Bundle |
Every monthly STIX 2.1 bundle carries bilingual incident and victim descriptions, the CTI report, statistics, month-over-month comparisons, source references, and identity objects for AFRINTEL and its author. H1 bundles preserve the original monthly STIX IDs so OpenCTI can correlate records across reporting periods. When a monthly or half-year corpus is corrected, the corresponding aggregate STIX bundle should be regenerated before it is treated as an exact mirror of the Markdown source of truth. MITRE ATT&CK context lives in the report descriptions themselves.
AFRINTEL separates incident type, status, confidence and impact. A ransomware leak-site listing remains a claim unless stronger evidence is available. Published samples, victim confirmations, government confirmations and later corroboration are preserved as different evidence states.
Historical reposts are dated separately from the underlying claimed leak when that distinction is known. Multi-country records are counted once in deduplicated totals but may generate more than one geographic occurrence. AFRINTEL uses nine canonical incident types: Ransomware, Data Leak, Access Sale, DDoS, Defacement, Account Takeover, System Intrusion, Malware and Operational Fraud. Cases that cannot yet be classified with sufficient evidence remain under investigation rather than being forced into a category.
AFRINTEL/
├── CyberAttackAfrica/ # Monthly victim lists and CTI reports (2024-2026)
├── statistics/ # Monthly statistics
├── comparison/ # Month-over-month comparisons
├── visual-intelligence/ # Ecosystem maps and diagrams
├── stix/ # STIX 2.1 / OpenCTI bundles
├── scripts/ # Validation and utility scripts
└── workflows/ # Automation workflows
Adama ASSIONGBON - SOC & Cyber Threat Intelligence Consultant
🔗 LinkedIn | 📄 MIT License