As the results are analysed from the release of the latest global threat intelligence report from NETSCOUT SYSTEMS, INC., we find that Kenya is once more the East African country with the most Distributed Denial of Service (DDoS) attacks during the first half of 2025, ranked third in across the continent overall following South Africa and Morocco.

“When we look at Kenya, Uganda, Tanzania, Seychelles, Madagascar, Djibouti and South Sudan, it becomes apparent that as the digital landscape evolves across the region, so too do the top targeted sectors across each country,” explains Bryan Hamman, regional director for Africa at NETSCOUT. 

“This shows the adaptability and focus of the DDoS attackers and their readiness to shift strategies as they pursue new victims. Across East Africa, we’re seeing increasing aim being taken at sectors that might not be fully established yet but rather are still up-and-coming on a sovereign country’s radar, as well as traditional targets such as the telecommunications sector.”

Kenya leads East Africa in DDoS attacks

Recording the highest number of offensives within East Africa during the first half of 2025 (46,786 in total), Kenya also saw repeated strikes on all forms of communications industries featuring strongly during this period. Attacks on wired telecommunications took the top spot for the recorded period (20,349), followed relatively closely by wireless telecommunications carriers (except satellite) in second place (15,919), with other computer related services rounding out the top three places (8,730).

Other targeted industries - though at much lower volumes - included portfolio management and investment advice organisations (720); computing infrastructure, data processing and web hosting services (217); all other telecommunications industries (149); clothing and accessories retailers (51); hotels (except casino hotels) and motels (15); commercial banking institutions (nine), and satellite communications carriers in the 10th spot (three).

“DDoS attacks may still be centred on wired and wireless communications carriers, in terms of both volume and impact, but what is noteworthy is the presence of other sectors, such clothing retailers and hotels,” says Hamman. 

“This shows the flexibility of DDoS attackers and their willingness to get to grips with the realities of a particular country’s industries as they test out areas of weakness – an adaptability on their part which should not be under-estimated.”

The most complex single bombardment involved 23 unique vectors, with the largest incident reaching 78.3 Gbps and 15.49 Mpps. 

Ugandan and Tanzania DDoS attacks decline

Uganda featured a total number of DDoS strikes of 881 during the reporting period, significantly down from 6,145 during 2H 2024. The largest peaked at 119.34 Gbps and 13.22 Mpps. 

As with Kenya, Uganda also saw notable activity in the telecommunications industry, with attacks on wireless communications (except satellite) taking the top position (357). Second place featured computing infrastructure providers data processing web hosting and related services (234), with wired telecommunications carriers coming in a distant third, on 12 incidents.

In Tanzania, a total of 326 DDoS attacks was recorded, a decrease of almost half from 531 during the second half of 2024. The most-preferred industry for attackers was that of computing infrastructure providers, data processing, web hosting and related services (94 incidents), with wireless telecommunications carriers (except satellite) second (on just 11 incidents). Hotels (except casino hotels) and motels, and new car dealers rounded out the top third and fourth spots, measured at four and three strikes respectively. The largest offensive reached 0.47 Gbps and 0.13 Mpps, with the most complex involving up to eight different vectors. 

“Even though there may be only a handful of strikes on a particular sector, this reiterates threat actors’ attention to regional detail, with the clear message being that no sector should regard itself as able to fly under the radar,” Hamman observes. And although the largest attack was under 0.5 Gbps, many are relatively short in duration (on average), which suggests attempts at quick disruption rather than prolonged siege.”

Djibouti in threat actors’ sights 

In contrast to Uganda and Tanzania, Djibouti was subjected to 3,172 strikes in the first half of 2025, significantly up from 2,860 in 2H 2024. The maximum number of vectors used in a single incident reached 13. Nearly all (3,085) targeted wireless telecommunications carriers (except satellite), while wired telecommunications carriers coming in second with two attacks.

“Djibouti, strategically situated on the Gulf of Aden, is home to ten submarine cables as well as terrestrial cables, and is regarded as an essential gateway for regional and international digital communication for Africa, enabling services in nearby Ethiopia, Somalia and Kenya. Again we see threat actors looking to disable strategically important sectors within a country.”

Seychelles, Madagascar, South Sudan: A mixed bag 

·       Seychelles experienced an almost doubling in the number of strikes since the second half of 2024, reflecting a total of 674 DDoS attacks compared to 386 previously. The largest of these peaked at 88.38 Gbps, as compared to 53.58 Gbps during the previous reporting period and a maximum throughput of 20.32 was detailed (previously 7.52 Mpps). Computing infrastructure, data processing and web hosting services were once again the main targeted organisations (305 up from 118 during the previous period), followed by software publishers at 183 in second place, and offices of other holding companies in third position (30). Wired telecommunications providers emerged as fourth with two strikes.  

·       An analysis of Madagascar, another island state, also showed that computing infrastructure, data processing and web hosting services were the primary focus (333 DDoS strikes), with wireless telecommunications carriers next in order at 30 attacks. Wired telecommunications carriers featured in third place, with four incidents. The total number of strikes for Madagascar was 368.

·       South Sudan experienced 1,439 onslaughts, with a maximum of nine vectors seen in a single attack and the largest peaking at 3.36 Gbps and 0.49 Mpps. Comments Hamman: “The average incident duration was just eight minutes, suggesting a scenario of threat actors putting out exploratory feelers within the country.” 

Hamman clarifies that the data for this reporting period for East Africa reflects that the key industries targeted continue to include wireless and wired telecommunications, computer-related services, and financial services as top quarries.

“The telecom sector, both wired and wireless, is undoubtedly the most attacked, both in volume and impact. All these sectors are critical infrastructure providers, so disruption here can have significant, far-reaching ripple effects. In addition, bombardments that last many hours, and not merely minutes, point to sustained adversary persistence, while multi-vector attacks show that threat actors are prepared to combine various methods to try to overwhelm their targets. 

“As DDoS onslaughts keep on evolving, with no end in sight, so too must their intended prey ensure that they employ proactive defence strategies to safeguard their critical infrastructure. NETSCOUT provides intelligent threat mitigation and real-time visibility to allow organisations to stay constantly on their guard as the threat landscape continues to evolve,” he concludes.