A wave of cyber incidents hits South Africa

In two months, Cartrack confirmed a ransomware attack on twenty-sixth August. RelyComply, an identity-verification provider, confirmed an intruder. Alexforbes, Cell C, Bidvest Bank and Air Traffic and Navigation Services all reported incidents.

Cartrack attack looks like ordinary crime

Cartrack told customers the incident was believed carried out by Dire Wolf, a double-extortion ransomware crew. Dire Wolf listed Cartrack on its leak site and claimed five hundred gigabytes of data. Much concerned American customers.

RelyComply breach affects multiple firms

EasyEquities and Satrix warned clients after RelyComply confirmed an intruder in its environment. Dire Wolf separately claimed RelyComply and says it seeks only money and has no political stance.

“it seeks only money and has no political stance”

Air Traffic Services case is more complex

Air Traffic and Navigation Services is dealing with two matters. Preliminary findings indicate a ransomware incident in an operational-technology environment supporting weather-related air-traffic services. Network monitoring reportedly indicated possible exfiltration to IP addresses located in China.

The real question: crime or strategy?

These incidents are not evidence of a campaign. They are a test of whether South Africa could tell a campaign from an ordinary run of cybercrime. What is publicly visible does not answer that question.

Cyberwar is the wrong framework

The reflex is to ask whether this is cyberwarfare. That is the wrong question. The consequential activity sits between crime and war, in espionage, subversion and sabotage. Violation of sovereignty, coercive intervention, use of force and armed attack are different thresholds.

States and criminals blur together

States delegate operations to proxies, orchestrate them through looser support, or sanction them by knowingly tolerating activity they could stop. Criminals carry political motives. States buy criminal access. It's ransomware does not end the inquiry.

South Africa has seen political hacking before

In May, Operation South Africa, a campaign by Nigerian-linked hacktivist groups including Nullsec Nigeria, claimed attacks on Sita, the Civil Aviation Authority, the SA Social Security Agency and Correctional Services in retaliation for xenophobic violence.

South Africa's geopolitical position creates risk

South Africa is the applicant against Israel at the International Court of Justice, a prominent BRICS member, and a self-described non-aligned state with public positions on Ukraine and the Middle East. But interest is not evidence of targeting.

Attribution requires five separate questions

What happened technically? Who ran the operation? What is their relationship to any state? Is their conduct legally attributable to that state? Should the government say so publicly? Tolerance and sympathy do not suffice for attribution.

How to spot a campaign versus crime

Clean monetisation, interest only in saleable data, and apparent links that dissolve into shared suppliers point towards crime. Selective collection with intelligence value but no resale value, persistence without visible return, and re-entry after eviction point weakly the other way.

South Africa lacks institutional capacity

The public architecture does not establish that any single institution receives a compulsory, sufficiently detailed cross-sector technical feed capable of campaign-level correlation. Section fifty-four of the Cybercrimes Act would oblige reporting to police. It is still not in force.

What South Africa needs to do

A lawful mechanism is needed for sharing minimised technical indicators with privacy and confidentiality controls built in. Section fifty-four should be commenced. An institution needs clear national responsibility for cross-sector correlation and escalating suspicious patterns into intelligence assessment.