Chinese hackers targeted Kenya’s government in a widespread, years-long series of digital intrusions against key ministries and state institutions, according to three sources, cybersecurity research reports and Reuters’ own analysis of technical data related to the hackings.
Two of the sources assessed the hacks to be aimed, at least in part, at gaining information on debt owed to Beijing by the East African nation: Kenya is a strategic link in the Belt and Road Initiative – President Xi Jinping’s plan for a global infrastructure network.
“Further compromises may occur as the requirement for understanding upcoming repayment strategies becomes needed,” a July 2021 research report written by a defence contractor for private clients stated.
China’s foreign ministry said it was “not aware” of any such hacking, while China’s embassy in Britain called the accusations “baseless”, adding that Beijing opposes and combats “cyberattacks and theft in all their forms.”
China’s influence in Africa has grown rapidly over the past two decades. But, like several African nations, Kenya’s finances are being strained by the growing cost of servicing external debt – much of it owed to China.
The hacking campaign demonstrates China’s willingness to leverage its espionage capabilities to monitor and protect economic and strategic interests abroad, two of the sources said.
The hacks constitute a three-year campaign that targeted eight of Kenya’s ministries and government departments, including the presidential office, according to an intelligence analyst in the region. The analyst also shared with Reuters research documents that included the timeline of attacks, and the targets, and provided some technical data relating to the compromise of a server used exclusively by Kenya’s main spy agency.
A Kenyan cybersecurity expert described similar hacking activity against the foreign and finance ministries. All three of the sources asked not to be named due to the sensitive nature of their work.
Read Also: Kenyan President Ruto Rallies Humanitarian Support for Sudan
“Your allegation of hacking attempts by Chinese Government entities is not unique,” Kenya’s presidential office said, adding the government had been targeted by “frequent infiltration attempts” from Chinese, American and European hackers.
“As far as we are concerned, none of the attempts were successful,” it said.
It did not provide further details nor respond to follow-up questions.
A spokesperson for the Chinese embassy in Britain said China is against “irresponsible moves that use topics like cybersecurity to sow discord in the relations between China and other developing countries”.
“China attaches great importance to Africa’s debt issue and works intensively to help Africa cope with it,” the spokesperson added.
Between 2000 and 2020, China committed nearly $160 billion in loans to African countries, according to a comprehensive database on Chinese lending hosted by Boston University, much of it for large-scale infrastructure projects.
Kenya used over $9 billion in Chinese loans to fund an aggressive push to build or upgrade railways, ports and highways.
Beijing became the country’s largest bilateral creditor and gained a firm foothold in the most important East African consumer market and a vital logistical hub on Africa’s Indian Ocean coast.
Read Also: Kenya, Israel To Collaborate To Eliminate Trade Barriers
By late 2019, however, when the Kenyan cybersecurity expert told Reuters he was brought in by Kenyan authorities to assess a hack of a government-wide network, Chinese lending was drying up. And Kenya’s financial strains were showing.
The breach reviewed by the Kenyan cybersecurity expert and attributed to China began with a “spearphishing” attack at the end of that same year, when a Kenyan government employee unknowingly downloaded an infected document, allowing hackers to infiltrate the network and access other agencies.
“A lot of documents from the ministry of foreign affairs were stolen and from the finance department as well. The attacks appeared focused on the debt situation,” the Kenyan cybersecurity expert said.
Another source – the intelligence analyst working in the region – said Chinese hackers carried out a far-reaching campaign against Kenya that began in late 2019 and continued until at least 2022.
According to documents provided by the analyst, Chinese cyber spies subjected the office of Kenya’s president, its defence, information, health, land and interior ministries, its counter-terrorism centre and other institutions to persistent and prolonged hacking activity.
The affected government departments did not respond to requests for comment, declined to be interviewed or were unreachable.
Read Also: AfDB debars Kenyan firm for tender fraud
By 2021, global economic fallout from the COVID-19 pandemic had already helped push one major Chinese borrower – Zambia – to default on its external debt. Kenya managed to secure a temporary debt repayment moratorium from China.
In early July 2021, the cybersecurity research reports shared by the intelligence analyst in the region detailed how the hackers secretly accessed an email server used by Kenya’s National Intelligence Service (NIS).
Reuters was able to confirm that the victim’s IP address belonged to the NIS. The incident was also covered in a report from the private defence contractor reviewed by Reuters.
Reuters could not determine what information was taken during the hacks or conclusively establish the motive for the attacks. But the defence contractor’s report said the NIS breach was possibly aimed at gleaning information on how Kenya planned to manage its debt payments.
“Kenya is currently feeling the pressure of these debt burdens…as many of the projects financed by Chinese loans are not generating enough income to pay for themselves yet,” the report stated.
A Reuters review of internet logs delineating the Chinese digital espionage activity showed that a server controlled by the Chinese hackers also accessed a shared Kenyan government webmail service more recently from December 2022 until February this year.