CYBER CRIME & CYBER SECURITY TRENDS IN AFRICA OVERALL MALICIOUS ACTIVITY—AFRICA The Overall Malicious Activity metric looks at malicious activity originating from Africa across several different categories during the reporting period. To determine this, Symantec has compiled geographical threat data on malware, attacks, spam, phishing hosts, bots, and C&C servers (see Figure 1). See Appendix A: Methodology for descriptions of these activities. Figure 1: Malicious Activity Types Spam Phishing Hosts Attacks Malware Bots Malicious Activities C&C Servers Symantec has observed that malicious activities are often related and detection of any one of these malicious activities may indicate the presence of others. For example, C&C servers communicate with bots to relay commands, bots are often used to distribute spam and phishing campaigns, spam can often have malicious attachments that contain malware, and once infected with malware, a website can be leveraged to perform attacks on visitors. Malicious activity usually affects computers that are connected to high-speed broadband Internet because these connections are attractive targets for attackers. Broadband connections provide larger bandwidth capacities than other connection types, faster speeds, the potential of constantly connected systems, and typically more stable connections. Spam incidents originating from Africa accounted for the greatest number of incidents of the six malicious behaviors during the reporting period (see Figure 2 and Table 1). During the reporting period, there were 1.1 billion spam events observed by Symantec that originated from Africa, representing 3.5% of the global total. It is not surprising that spam is the top malicious activity since Symantec has observed that monthly global spam rates in September 2016 were at 53%1. This means that half of all email messages sent are spam emails. Spam is a financially profitable business that requires very little infrastructure investment, especially if the actors involved use spam bots to send out the emails. A few hundred spam bots can send out tens of thousands of spam messages per day. Even if the click-through rate on these spam campaigns is very small, scammers can still make a large profit on millions of spam emails. During the reporting period, bot activity ranked second with 14 million distinct IP addresses accounting for 11.4% of the global total, while malware activity ranked third with 8.5 million incidents representing 1.5% of the global total. Globally, Africa was not a significant source of malicious activity, accounting for less than 3% of the worldwide activity total. 1 https://www.symantec.com/security_response/publications/monthlythreatreport.jsp#Spam 23