Namibia wins Q1 battle, loses ground in Q2

Namibia’s cyber defences showed progress in the first quarter of 2026, only to face a sharp reversal in the second quarter, according to statistics from the Namibia Cyber Security Incident Response Team (NAM‑CSIRT).

In the first quarter of this year, detected cyber vulnerabilities across Namibia fell by 31.3% and reported cyber threat events dropped by 47.3%, a trend NAM‑CSIRT attributed to sustained monitoring, greater awareness and improved practices among organisations and critical infrastructure operators. By the second quarter of the year, however, vulnerabilities had jumped 39.8% to 513 921 detections, while cyber events rose 56.7% to 161 547, signalling that exposed services and legacy protocols remain a major weak point.

Q1: Fewer vulnerabilities, persistent risks

Mufaro Nesongano, Executive: Communication and Consumer Relations at NAM‑CSIRT, attributes the Q1 decline to “the positive impact of sustained monitoring efforts, increased cybersecurity awareness, proactive threat mitigation measures, and improved cyber hygiene practices among organisations and critical infrastructure operators.”

Even so, the quarter recorded 367,670 vulnerabilities and 103,085 cyber events, with exposed remote management services and legacy network protocols continuing to dominate the risk landscape. The most prevalent issues included open CWMP (CPE WAN Management Protocol), NTP version reports, accessible Telnet, open SNMP and open DNS servers.

The period also highlighted the growing stakes for critical national infrastructure. A cybersecurity incident at the Namibia Airports Company (NAC) involved unauthorised access to internal systems and the alleged exfiltration of about 500GB of data by the INC Ransomware Group. Airport operations, safety and security were not affected, but the breach served as a stark reminder of the need for strong controls, continuous monitoring and coordinated incident response.

Regionally, NAM‑CSIRT hosted a four‑day DNS Resilience Training in Windhoek in February 2026, facilitated by the Cybersecurity Capacity Centre for Southern Africa (C3SA). The session brought together stakeholders from nine SADC countries to strengthen DNS security awareness, resilience and cross‑border collaboration.

“The significant reduction in both cyber vulnerabilities and threat events is encouraging… However, the evolving threat landscape and incidents targeting critical infrastructure remind us that cybersecurity remains a shared responsibility,” Nesongano said.

Q2: Sharp rise in vulnerabilities, ransomware threats

The second quarter told a different story. NAM‑CSIRT recorded 513,921 cyber vulnerabilities, a 39.8% increase on Q1, and 161,547 cyber events, up 56.7%. Open CWMP again topped the list with 320,778 detections, followed by NTP version reports (52,420) and accessible Telnet (42,941). Other common exposures included open SNMP, open DNS servers, accessible FTP, SSL POODLE and accessible RDP.

Cyber events were driven largely by sinkhole HTTP traffic (109,593) and sinkhole non‑HTTP events (39,593). DDoS participant events also climbed significantly to 10,327, suggesting that some Namibian systems may have been exposed or compromised and potentially used in distributed denial‑of‑service activities.

The threat landscape evolved further with the emergence of new ransomware and extortion actors. The BAVACAI ransomware group, identified in May, employs a double‑extortion model that combines data theft with encryption. The Black X cybercriminal extortion group has been linked to data theft and extortion targeting organisations holding high‑value, sensitive information.

National guidelines launched as threats escalate

Namibia launched the National Cybersecurity Incident Management Guidelines 2026 on 29 April 2026 in Ondangwa. The Minister of Information and Communication Technology, Emma Theofelus, officially introduced the framework, which is designed to strengthen detection, reporting, response and coordination of cyber incidents across all sectors.

The Guidelines promote a proactive, risk‑based approach and align with international standards such as ISO/IEC 27001 and the NIST Cybersecurity Framework. They are intended to improve collaboration among government institutions, regulators, critical‑system operators, industry and the broader cybersecurity community.

Emilia Nghikembua, CRAN’s Chief Executive Officer and Head of NAM‑CSIRT, said the Q2 increase in vulnerabilities and events is a reminder that threats “remain persistent and continue to evolve.”

“It is important that organisations take proactive steps to address exposed services, protect digital identities, apply security updates timeously and report incidents early,” Nghikembua said. “The launch of the National Cybersecurity Incident Management Guidelines 2026 is an important step in strengthening Namibia's collective ability to manage cyber incidents. However, the effectiveness of these Guidelines will depend on their adoption and implementation across sectors.”

The reports converge on a few practical messages:

Remote management and legacy services (CWMP, Telnet, SNMP, open DNS, RDP, FTP) are the low‑hanging fruit attackers exploit at scale. Closing or properly securing these services is a low-cost, high-impact way to secure systems.

Ransomware groups are increasingly using double‑extortion: encrypting data and threatening to publish it unless paid. Paying does not guarantee recovery and may not stop data leakage.

Critical infrastructure is a prime target.

For individuals, the same underlying issues matter: weak passwords, reused credentials, unpatched devices and susceptibility to phishing and social engineering remain the main entry points for attacks that can lead to account takeover, financial loss and identity theft.

NAM‑CSIRT and CRAN urge both organisations and individuals to adopt good cyber hygiene: strong and unique passwords, regular updates, multi‑factor authentication, secure configuration of internet‑facing systems and heightened awareness of phishing and other social engineering attacks.