The ransomware groups targeting West Africa most
Not a single cartel, but about fifteen different groups, one country heavily over-represented, and a silence in some countries that should definitely not be read as good news. What 53 real claims recorded in the ECOWAS zone show.
October 18, 2026 · SunuCyberSecurity team
ransomware claims recorded in the ECOWAS zone since January 2023
of ECOWAS cases concentrated in a single country — Nigeria (23 of 53)
different ransomware groups active in the region — none exceeds 5 cases
ECOWAS countries with no recorded claim to date
Source: SunuCyberSecurity claims database (aggregated from ransomware.live), ECOWAS zone (15 countries), data as of October 17, 2026
Ransomware coverage often frames the threat as a handful of "big groups" dominating the global landscape. In the ECOWAS zone, our own claims data — fed by the same live stream as our ransomware claims page — tells a different story: a fragmented landscape, concentrated in few countries, where the blind spots matter as much as the visible numbers.
A fragmented landscape, not a cartel
Of the 53 ECOWAS claims recorded since January 2023, no fewer than 15 different groups appear — and none exceeds 5 cases. KillSec leads with 5 claims, followed by TheGentlemen and Qilin with 4 each. The rest spreads across well-known names from the global ransomware scene (LockBit3, BlackSuit, ALPHV, Hunters) and more obscure or recent groups (Krybit, AuditTeam, 0day Syndicate). In 2026 alone, TheGentlemen is the most active with 4 claimed attacks in the region.
In practice: there is no single adversary to watch, but an open market where any group, new or established, can hit an under-protected West African organization.
Nigeria accounts for nearly half of detected cases
23 of the 53 ECOWAS claims target Nigeria — more than every other country in the region combined. Ghana (10), Senegal (8) and Côte d'Ivoire (6) follow well behind.
Claims by country, ECOWAS zone (since 2023)
Source: SunuCyberSecurity claims database, aggregated from ransomware.live
This concentration largely reflects the size of Nigeria's economy — the region's largest and most digitized, hence the largest attack surface — rather than a security weakness specific to the country. But it's also a signal: the more an economy digitizes, the more visible a target it becomes for these groups.
Sectors hit without much surprise — but none spared either
Four sectors share the top spot at 7 cases each: government & defense, energy & utilities, financial services, and professional services. Retail/e-commerce and technology follow with 6 cases each. No sector clearly dominates — it's a broad spread, not a handful of favored targets.
What the silence from other countries doesn't mean
Togo, Benin, Guinea-Bissau, Liberia, Sierra Leone and Cape Verde don't appear in any recorded claim to date. That is not the same as "these countries are spared," and presenting it that way would be dishonest — for three concrete reasons:
Disclosure bias
Our data comes from leak sites where ransomware groups publish their own victims (via ransomware.live, a public aggregator — we don't scrape anything ourselves). An attack paid quietly, or targeting a small organization with no press coverage, never shows up there.
Geotagging reliability
Those same leak sites sometimes attach the wrong country to a victim. We've already corrected a case where a claim tagged Senegal actually concerned an organization in French Guiana — the source itself isn't 100% reliable on this field.
Market size, not absence of risk
A less digitized economy attracts these groups less today — but that's a closing window, not lasting protection, as mobile money and digital services grow there.
Live data
These numbers change daily. Browse the full, up-to-date list of claims, by country and by group.
Sources & methodology
Data aggregated from ransomware.live (a public aggregator of ransomware groups' leak sites), refreshed continuously by SunuCyberSecurity — see sunucybersecurity.com/en/ransomware-claims. ECOWAS scope: 15 countries (Benin, Burkina Faso, Cape Verde, Côte d'Ivoire, Gambia, Ghana, Guinea, Guinea-Bissau, Liberia, Mali, Niger, Nigeria, Senegal, Sierra Leone, Togo). Data as of October 17, 2026, history since January 2023. Country-level geotagging depends on the primary source and carries a known margin of error (see text above). External figures not published by SunuCyberSecurity unless stated otherwise.
Put this into practice
A free scan, in a few minutes, no credit card.
Free scan