Foreign intelligence agencies keeping a close eye on South Africa – report

South Africa – South Africa’s foreign policy positions and growing cybersecurity vulnerabilities could make the country an attractive target for foreign intelligence agencies, with experts warning that weaknesses in detecting and coordinating responses to cyber threats could leave sensitive government and business systems exposed.

According to MyBroadband, experts say South Africa is attracting international intelligence interest amid deteriorating relations with the United States under President Donald Trump, particularly following Pretoria’s decision to take Israel to the International Court of Justice and maintain ties with Iran.

However, cybersecurity specialists have cautioned against interpreting the country’s growing number of cyber incidents as evidence of a coordinated foreign-government campaign.

Maher Yamout, a lead security researcher at Kaspersky’s Global Research and Analysis Team, said he could find no conclusive evidence of a recent state-sponsored cyber campaign against South Africa with clear political motives. He warned that, although the country has strong cybersecurity capabilities across the public and private sectors, “the bigger challenge is connecting the dots across those different organisations.”

South Africa’s response to cybercrime

The report also highlighted weaknesses in South Africa’s response to cybercrime. Willem Steynberg, head of cybersecurity training at Orange Cyberdefence, said approximately 135 South African companies had been listed by ransomware groups since March, with about 40 confirmed incidents.

Steynberg criticised the response of the government’s Cybersecurity Hub, saying: “What’s missing is somebody whose actual job is to join the dots and publish.” He warned that sophisticated intelligence operations could remain undetected because foreign state actors typically operate covertly rather than publicly claiming responsibility.

DarkNotify, a dark-web monitoring service, separately reported a threefold increase in dark-web listings within the environments it monitors over three months. It cautioned that these listings do not necessarily represent individually confirmed data breaches.

The concerns follow earlier reporting by MyBroadband, which cited research by Recorded Future suggesting that a Chinese state-sponsored cyber-espionage group known as RedNovember had likely targeted a South African state security organisation. The organisation was not conclusively identified in the report, and the alleged compromise was not independently confirmed.

South Africa’s own national security priorities recognise espionage and cyber threats as significant risks. In a July 2025 statement, The Presidency said the country’s intelligence assessments covered threats ranging from espionage and cyberattacks to transnational organised crime. The government also identified the need to strengthen cybersecurity, counter-intelligence and the protection of critical infrastructure.

Experts say improved intelligence sharing between government agencies, cybersecurity companies and international law enforcement bodies will be essential to identifying patterns that might otherwise appear to be unrelated criminal incidents.

While financial gain remains the main motive behind most ransomware attacks identified by the experts, covert state-sponsored operations remain a concern because they can focus on gathering sensitive information without triggering the public disruption typically associated with cybercrime.

The central challenge for South Africa, therefore, is to improve its ability to identify and attribute sophisticated attacks without assuming that every breach is part of a geopolitical campaign.