Ransomware attacks against South African organisations are becoming faster and more coordinated, leaving companies with significantly less time to detect and contain breaches before they result in data theft and extortion.
This is according to Lukas van der Merwe, associate director at Cyanre, commenting on the cyber security firm’s 2025 Cyber Incident Statistics and Comparative Analysis.
In an e-mail interview with ITWeb, he says the company’s incident response data shows average attacker dwell time – the period an attacker remains inside an organisation before detection – fell sharply from 117 days in 2024 to just 18 days in 2025.
In several cases, he notes that attackers executed their operations within a day of gaining initial access.
“We believe this acceleration reflects the increasing industrialisation of cyber crime. Ransomware-as-a-service platforms, specialised criminal ecosystems, automated reconnaissance and exploitation tools, and the growing use of artificial intelligence are enabling threat actors to identify vulnerabilities, navigate environments, extract data and execute attacks far more efficiently.”
The result, he says, is not simply a higher volume of attacks but compressed attack timelines that leave organisations with less opportunity to identify malicious activity before significant damage occurs.
Data becomes the target
Cyanre’s 2025 incident data points to a broader shift in the cyber threat landscape, with attackers increasingly targeting data, rather than simply seeking to disrupt IT systems.
Van der Merwe says cyber crime has become systematic, scalable and operationally repeatable, with threat actors increasingly operating like structured businesses.
“Data has replaced systems as the primary asset under threat,” he says, adding that the objective is increasingly “data acquisition, control and leverage”.
System disruption, he says, remains an important tactic for creating pressure, but is not always the ultimate objective.
Identity security has also emerged as a critical line of defence, with many successful breaches beginning with compromised credentials, access-control failures or identity mismanagement.
Van der Merwe says organisations need to rethink cyber security around resilience rather than prevention alone.
“Prevention remains essential, but no control environment can guarantee that every attack will be stopped.”
The key question, he says, is therefore whether an organisation can detect, contain, recover and continue operating when preventative controls fail.
Attractive target
According to Van der Merwe, South African organisations are increasingly exposed because the country combines a relatively mature digital economy with uneven levels of cyber resilience.
He notes companies hold valuable financial, personal and operational information and increasingly depend on cloud platforms, digital systems, suppliers and remote access.
At the same time, Van der Merwe points to skills shortages, legacy infrastructure, inconsistent security maturity and weak monitoring as factors that can make some organisations easier to compromise.
For financially motivated cyber criminals, this creates an attractive combination of valuable data, accessible targets and organisations that can face significant financial and operational pressure when systems are disrupted.
However, he cautions that attacks are not always specifically aimed at South Africa.
“Much cyber crime is opportunistic: attackers scan for vulnerable systems, exploit stolen credentials or purchase access from criminal marketplaces, and only then assess the value of the victim.”
As a result, South African organisations are increasingly exposed because they are “connected, discoverable, commercially valuable and, often enough, vulnerable”.
Ransom payments rising
Cyanre’s incident response work also shows that some companies continue to pay ransomware demands.
The firm facilitated 15 threat actor engagements during 2025, of which five – or 30% – resulted in payment.
In the first seven months of 2026, Cyanre facilitated 13 engagements, with six – 46% – resulting in payment.
Van der Merwe also points to Sophos’s annual State of Ransomware in South Africa research, which found that 43% of surveyed South African organisations whose data was encrypted paid the ransom in 2024. That figure rose to 71% in 2025.
He points out that ransom payments are generally made using crypto-currency, most commonly Bitcoin.
However, Van der Merwe says paying a ransom is a more complex process than simply transferring crypto-currency to an attacker.
It involves negotiation, sanctions screening, sourcing crypto-currency, validating wallets, executing payment and verifying what the attacker delivers in return, he explains.
Critical preparedness
Cyanre’s findings point to a shift in how organisations should approach cyber security, with preparedness becoming as important as preventative technology.
Van der Merwe says organisations should increasingly operate on the assumption that a breach is possible, given the availability of stolen credentials and criminal tools.
“Cyanre’s experience continues to reinforce that cyber resilience is not defined by the ability to prevent every attack, or even by how quickly technology can be restored.”
Instead, resilience depends on an organisation's ability to continue making decisions and maintaining critical operations during a crisis.
“Prepared organisations have already considered who makes decisions, how incidents are escalated, how stakeholders communicate, which operations must continue, what constitutes a trusted recovery point and when recovery should give way to rebuilding.”
He says these decisions need to be rehearsed before an attack, rather than developed while an organisation is under pressure.
“The organisations that recover best are therefore not necessarily those with the best technology, but those that endeavoured to reduce uncertainty in advance, established clear leadership and decision structures, and prepared both their systems and their people to operate when the available choices range from bad to worse.”
Share
