Afghanistan — Cyber Threat Profile

Afghanistan is absent from the FIRST.org directory of incident response teams and has no constituted data protection authority, so incident response and privacy oversight have no identifiable national point of contact. That gap sits under unusually broad espionage pressure: IntelFusions tracks groups attributed to five separate states targeting Afghan institutions, with documented intrusions against the Ministry of Finance, the National Security Council and diplomatic entities, several of them continuing after 2021. Afghanistan ranks 56th on the World Cybercrime Index 2024, and with 16.1 per cent of its population online in 2024 it carries a small attack surface and little capacity to defend it.

World Cybercrime Index 2024 (origin significance): 0.35 / 100, #56 worldwide
Secure Internet servers per 1M people (2024): 41.1 (source: World Bank)
Internet users (2024): 16.1% of population (source: World Bank)

Threat actors targeting Afghanistan

Donot Team APT
Mirage Kitten APT
SideCopy APT
Sidewinder APT
Turla APT
RansomHub Ransomware · 2 incident(s)
LockBit Ransomware · 1 incident(s)
GALLIUM APT
IndigoZebra APT
ToddyCat APT
Transparent Tribe APT

Most targeted sectors

Government & Public Sector 2 incident(s)
Technology 1 incident(s)

Recent claimed incidents

salaam.af 2024-09-15 · Technology
nepa.gov.af&dfr.gov.af 2024-06-04 · Government
The Islamic Emirat of Afghanistan National Environmental Protection Agency 2024-05-04 · Government

Read the full analysis on IntelFusions