China-Linked Hackers Launch Targeted Espionage Campaign on African IT Infrastructure

A China-linked cyber espionage group, identified as APT41, has initiated a sophisticated and targeted campaign aimed at compromising government IT services across the African continent. This latest activity highlights a significant escalation in cyber threats facing African nations, as foreign state-sponsored actors increasingly focus on the region’s burgeoning digital infrastructure.

According to reports from cybersecurity researchers at Kaspersky, the APT41 group has been exploiting vulnerabilities within African government IT networks, utilizing a range of both custom-built and publicly available tools to gain persistent access and exfiltrate sensitive data. A notable tactic involves the use of compromised SharePoint servers within the victim’s own infrastructure for command-and-control (C2) communications, effectively blending malicious activity with legitimate internal services to evade detection.

The attackers have demonstrated a keen ability to adapt their methods to specific target environments, deploying C#-based Trojans and leveraging penetration testing tools like Cobalt Strike. Their operations involve harvesting privileged account credentials, facilitating lateral movement within networks, and deploying advanced malware to establish long-term control. Researchers noted the malware often includes checks for specific language packs (Japanese, Korean, Chinese) to avoid execution in those regions, further indicating a deliberate targeting strategy.

While APT41 has a long history of targeting various sectors globally, including telecommunications, energy, and education, its intensified focus on Africa marks a significant shift. Cybersecurity reports indicate a broader trend of increased cyberattacks on African organizations, with some analyses showing Africa as the most targeted region globally in early 2025. This surge is attributed to the continent’s accelerating digital transformation, coupled with persistent vulnerabilities in IT infrastructure and, in some cases, less robust cybersecurity measures.

The implications of such espionage campaigns are far-reaching. Beyond the immediate compromise of sensitive information, these attacks can undermine national security, economic stability, and public trust. Persistent access to critical infrastructure, particularly in the telecommunications sector, could enable eavesdropping or even sabotage during periods of heightened geopolitical tension. As African nations continue their digital growth, enhancing cybersecurity resilience and international cooperation will be paramount to defending against these evolving threats.