AFRINTEL is an open-source Cyber Threat Intelligence project focused on cyber incidents affecting African organizations across all 54 countries on the continent. The project documents the nine canonical AFRINTEL incident types: ransomware, data leaks, access sales, DDoS, defacement, account takeover, system intrusion, malware and operational fraud. These events are observed through dark web sources, leak sites, underground forums and OSINT. Incident type, status, confidence and impact are kept separate so that a criminal claim is not silently treated as a confirmed compromise.
| Countries monitored | Threat actors tracked | Period covered | Formats |
|---|---|---|---|
| 54 | 100+ | 2024-2026 | Markdown, STIX 2.1, Visual CTI |
What ends up here is what got observed: posts on leak sites, underground forums and OSINT sources. A victim card keeps whatever status it had when AFRINTEL last reviewed it.
The October corpus contains 48 records, all assigned to October after redistributing publications to their actual publication or first documented observation month. It records 23 Data Leak, 17 Ransomware, 5 System Intrusion and 3 Access Sale cases.
📄 Full CTI report - October 2026
🔄 September-October 2026 comparison
August 2026 collection contains 32 documented incidents: 18 ransomware incidents, 13 data leaks and 1 access sale.
The Furniture Bargaining Council acknowledged server encryption, and DC Partner published a public confirmation of the incident. The analyses document payment data at The Courier Guy, an account-reset workbook at Daily Trust, internal documents from the Conseil Gabonais des Chargeurs and identity data in the RAMED and DGSN/DGST cases. Reviewed samples do not automatically validate overall claimed volumes or acquisition methods.
The report includes follow-up information recorded through 14 September 2026 and distinguishes earlier publications discovered in August. The 13 fewer records than July (-31.0%) describe a change in collection without demonstrating an equivalent decline in compromises.
📄 Full CTI report - August 2026
📦 August 2026 STIX 2.1 / OpenCTI bundle
The September corpus contains 33 documented records: 20 Ransomware, 11 Data Leak and 2 System Intrusion. Earlier records have been redistributed to their respective publication months rather than retained in September.
📄 Full CTI report - September 2026
📋 September 2026 victim records
🔄 August-September 2026 comparison
🖼️ September 2026 visual intelligence
📦 September 2026 STIX 2.1 / OpenCTI bundle
Month status: report, statistics, comparison and visual intelligence published from the validated 33-record September cohort.
Between January and June 2026, AFRINTEL documented 304 incidents: 116 ransomware, 126 data leaks, 5 access-sale records, 52 DDoS claims, 2 system intrusions, 1 defacement and 2 operational-fraud incidents.
The 52 DDoS entries are dated actor claims or availability observations, including 43 Keymous+ observations in May. Repeated observations of the same organization on different dates are not necessarily technically independent attacks.
📦 H1 2026 STIX 2.1 / OpenCTI bundle
Each annual report pulls together the validated monthly corpus for the year: incident-type distribution, country and regional exposure, sector patterns, actor visibility, evidence maturity and the CTI assessment. French and English are kept structurally aligned.
| Year | Documented records | FR | EN |
|---|---|---|---|
| 2024 | 124 | Rapport annuel | Annual report |
| 2025 | 231 | Rapport annuel | Annual report |
2024 current monthly corpus: 124 documented records, reclassified under the same nine-type taxonomy used for 2025. Earlier corrected semiannual reports retain historical snapshots and do not include every later retrospective addition present in the current monthly pairs.
2025 current monthly corpus: 231 documented records. H1 contains 115 records and H2 116. Geographic views contain 232 occurrences because one card covers multiple countries.
| Period | Documented records | FR | EN |
|---|---|---|---|
| H1 2024 | 46 | Rapport S1 | H1 report |
| H2 2024 | 78 | Rapport S2 | H2 report |
| H1 2025 | 115 | Rapport S1 | H1 report |
| H2 2025 | 116 | Rapport S2 | H2 report |
| H1 2026 | 304 | Rapport S1 | H1 report |
Counting note: these values follow the monthly pairs currently in the repository: H1 2024 = 46, H2 2024 = 78, H1 2025 = 115, H2 2025 = 116 and H1 2026 = 304. Earlier semiannual snapshots may differ after snapshot-specific deduplication; they must not be mixed with the enriched monthly corpora.
| Month | FR | EN |
|---|---|---|
| January 2026 | Rapport | Report |
| February 2026 | Rapport | Report |
| March 2026 | Rapport | Report |
| April 2026 | Rapport | Report |
| May 2026 | Rapport | Report |
| June 2026 | Rapport | Report |
| July 2026 | Rapport | Report |
| August 2026 | Rapport | Report |
| September 2026 | Rapport | Report |
| October 2026 | French report | Report |
| Month | FR | EN |
|---|---|---|
| January 2026 | Statistiques | Statistics |
| February 2026 | Statistiques | Statistics |
| March 2026 | Statistiques | Statistics |
| April 2026 | Statistiques | Statistics |
| May 2026 | Statistiques | Statistics |
| June 2026 | Statistiques | Statistics |
| July 2026 | Statistiques | Statistics |
| August 2026 | Statistiques | Statistics |
| September 2026 | Statistiques | Statistics |
| October 2026 | Statistiques | Statistics |
| Comparison | FR | EN |
|---|---|---|
| January vs February 2026 | FR | EN |
| February vs March 2026 | FR | EN |
| March vs April 2026 | FR | EN |
| April vs May 2026 | FR | EN |
| May vs June 2026 | FR | EN |
| June vs July 2026 | FR | EN |
| July vs August 2026 | FR | EN |
| August vs September 2026 | FR | EN |
| September vs October 2026 | FR | EN |
| Period | Dashboard |
|---|---|
| January 2026 | Visual intelligence |
| February 2026 | Visual intelligence |
| March 2026 | Visual intelligence |
| April 2026 | Visual intelligence |
| May 2026 | Visual intelligence |
| June 2026 | Visual intelligence |
| July 2026 | LinkedIn visual |
| August 2026 | Visual intelligence |
| September 2026 | Visual intelligence |
| H1 2026 | Statistical visual |
| H1 2026 regions | Regional chart |
| H1 2026 visualisations | Complete EN set |
| Dataset | File |
|---|---|
| January 2026 | STIX Bundle |
| February 2026 | STIX Bundle |
| March 2026 | STIX Bundle |
| April 2026 | STIX Bundle |
| May 2026 | STIX Bundle |
| June 2026 | STIX Bundle |
| July 2026 | STIX Bundle |
| August 2026 | STIX Bundle |
| September 2026 | STIX Bundle |
| October 2026 | STIX Bundle |
| H1 2026 | STIX Bundle |
Every monthly STIX 2.1 bundle carries bilingual incident and victim descriptions, the CTI report, statistics, month-over-month comparisons, source references, and identity objects for AFRINTEL and its author. H1 bundles preserve the original monthly STIX IDs so OpenCTI can correlate records across reporting periods. When a monthly or half-year corpus is corrected, the corresponding aggregate STIX bundle should be regenerated before it is treated as an exact mirror of the Markdown source of truth. MITRE ATT&CK context lives in the report descriptions themselves.
AFRINTEL separates incident type, status, confidence and impact. A ransomware leak-site listing remains a claim unless stronger evidence is available. Published samples, victim confirmations, government confirmations and later corroboration are preserved as different evidence states.
Historical reposts are dated separately from the underlying claimed leak when that distinction is known. Multi-country records are counted once in deduplicated totals but may generate more than one geographic occurrence. AFRINTEL uses nine canonical incident types: Ransomware, Data Leak, Access Sale, DDoS, Defacement, Account Takeover, System Intrusion, Malware and Operational Fraud. Cases that cannot yet be classified with sufficient evidence remain under investigation rather than being forced into a category.
AFRINTEL/
├── CyberAttackAfrica/ # Monthly victim lists and CTI reports (2024-2026)
├── statistics/ # Monthly statistics
├── comparison/ # Month-over-month comparisons
├── visual-intelligence/ # Ecosystem maps and diagrams
├── stix/ # STIX 2.1 / OpenCTI bundles
├── scripts/ # Validation and utility scripts
└── workflows/ # Automation workflows
Adama ASSIONGBON - SOC & Cyber Threat Intelligence Consultant
🔗 LinkedIn | 📄 MIT License