Breaking News
Investing Pro 0
💎 Access the Market Tools Trusted by Thousands of Investors Get Started

Chinese hackers attacked Kenyan government as debt strains grew

Published May 24, 2023 01:06AM ET Updated May 24, 2023 01:46AM ET
Saved. See Saved Items.
This article has already been saved in your Saved Items
© Reuters. FILE PHOTO: Kenya's Parliament Building is seen from observation point on the top of the Kenyatta International Convention Centre in Nairobi, Kenya, June 21, 2019. REUTERS/Baz Ratner/File Photo
Add to/Remove from Watchlist
Add to Watchlist
Add Position

Position added successfully to:

Please name your holdings portfolio

By Aaron Ross, James Pearson and Christopher Bing

NAIROBI (Reuters) -Chinese hackers targeted Kenya's government in a widespread, years-long series of digital intrusions against key ministries and state institutions, according to three sources, cybersecurity research reports and Reuters' own analysis of technical data related to the hackings.

Two of the sources assessed the hacks to be aimed, at least in part, at gaining information on debt owed to Beijing by the East African nation: Kenya is a strategic link in the Belt and Road Initiative - President Xi Jinping's plan for a global infrastructure network.

"Further compromises may occur as the requirement for understanding upcoming repayment strategies becomes needed," a July 2021 research report written by a defence contractor for private clients stated.

China's foreign ministry said it was "not aware" of any such hacking, while China's embassy in Britain called the accusations "baseless", adding that Beijing opposes and combats "cyberattacks and theft in all their forms." 

China's influence in Africa has grown rapidly over the past two decades. But, like several African nations, Kenya's finances are being strained by the growing cost of servicing external debt - much of it owed to China.

The hacking campaign demonstrates China's willingness to leverage its espionage capabilities to monitor and protect economic and strategic interests abroad, two of the sources said.

The hacks constitute a three-year campaign that targeted eight of Kenya's ministries and government departments, including the presidential office, according to an intelligence analyst in the region. The analyst also shared with Reuters research documents that included the timeline of attacks, the targets, and provided some technical data relating to the compromise of a server used exclusively by Kenya's main spy agency.

A Kenyan cybersecurity expert described similar hacking activity against the foreign and finance ministries. All three of the sources asked not to be named due to the sensitive nature of their work.

"Your allegation of hacking attempts by Chinese Government entities is not unique," Kenya's presidential office said, adding the government had been targeted by "frequent infiltration attempts" from Chinese, American and European hackers.

"As far as we are concerned, none of the attempts were successful," it said.

It did not provide further details nor respond to follow-up questions.

A spokesperson for the Chinese embassy in Britain said China is against "irresponsible moves that use topics like cybersecurity to sow discord in the relations between China and other developing countries".

"China attaches great importance to Africa's debt issue and works intensively to help Africa cope with it," the spokesperson added.


Between 2000 and 2020, China committed nearly $160 billion in loans to African countries, according to a comprehensive database on Chinese lending hosted by Boston University, much of it for large-scale infrastructure projects.

Kenya used over $9 billion in Chinese loans to fund an aggressive push to build or upgrade railways, ports and highways.

Beijing became the country's largest bilateral creditor and gained a firm foothold in the most important East African consumer market and a vital logistical hub on Africa's Indian Ocean coast.

By late 2019, however, when the Kenyan cybersecurity expert told Reuters he was brought in by Kenyan authorities to assess a hack of a government-wide network, Chinese lending was drying up. And Kenya's financial strains were showing.

The breach reviewed by the Kenyan cybersecurity expert and attributed to China began with a "spearphishing" attack at the end of that same year, when a Kenyan government employee unknowingly downloaded an infected document, allowing hackers to infiltrate the network and access other agencies.

"A lot of documents from the ministry of foreign affairs were stolen and from the finance department as well. The attacks appeared focused on the debt situation," the Kenyan cybersecurity expert said.

Another source - the intelligence analyst working in the region - said Chinese hackers carried out a far-reaching campaign against Kenya that began in late 2019 and continued until at least 2022.

According to documents provided by the analyst, Chinese cyber spies subjected the office of Kenya's president, its defence, information, health, land and interior ministries, its counter-terrorism centre and other institutions to persistent and prolonged hacking activity.

The affected government departments did not respond to requests for comment, declined to be interviewed or were unreachable.

By 2021, global economic fallout from the COVID-19 pandemic had already helped push one major Chinese borrower - Zambia - to default on its external debt. Kenya managed to secure a temporary debt repayment moratorium from China.

In early July 2021, the cybersecurity research reports shared by the intelligence analyst in the region detailed how the hackers secretly accessed an email server used by Kenya's National Intelligence Service (NIS).

Reuters was able to confirm that the victim's IP address belonged to the NIS. The incident was also covered in a report from the private defence contractor reviewed by Reuters.

Reuters could not determine what information was taken during the hacks or conclusively establish the motive for the attacks. But the defence contractor's report said the NIS breach was possibly aimed at gleaning information on how Kenya planned to manage its debt payments.

"Kenya is currently feeling the pressure of these debt many of the projects financed by Chinese loans are not generating enough income to pay for themselves yet," the report stated.

A Reuters review of internet logs delineating the Chinese digital espionage activity showed that a server controlled by the Chinese hackers also accessed a shared Kenyan government webmail service more recently from December 2022 until February this year.

Chinese officials declined to comment on this recent breach, and the Kenyan authorities did not respond to a question about it.


The defence contractor, pointing to identical tools and techniques used in other hacking campaigns, identified a Chinese state-linked hacking team as having carried out the attack on Kenya's intelligence agency.

The group is known as "BackdoorDiplomacy" in the cybersecurity research community, because of its record of trying to further the objectives of Chinese diplomatic strategy.

According to Slovakia-based cybersecurity firm ESET, BackdoorDiplomacy re-uses malicious software against its victims to gain access to their networks, making it possible to track their activities.

Provided by Reuters with the IP address of the NIS hackers, Palo Alto Networks (NASDAQ:PANW), a U.S. cybersecurity firm that tracks BackdoorDiplomacy's activities, confirmed that it belongs to the group, adding that its prior analysis shows the group is sponsored by the Chinese state.

Cybersecurity researchers have documented BackdoorDiplomacy hacks targeting governments and institutions in a number of countries in Asia and Europe.

Incursions into the Middle East and Africa appear less common, making the focus and scale of its hacking activities in Kenya particularly noteworthy, the defence contractor's report said.

"This angle is clearly a priority for the group."

China's embassy in Britain rejected any involvement in the Kenya hackings, and did not directly address questions about the government's relationship with BackdoorDiplomacy.

"China is a main victim of cyber theft and attacks and a staunch defender of cybersecurity," a spokesperson said.

Chinese hackers attacked Kenyan government as debt strains grew

Related Articles

Add a Comment

Comment Guidelines

We encourage you to use comments to engage with other users, share your perspective and ask questions of authors and each other. However, in order to maintain the high level of discourse we’ve all come to value and expect, please keep the following criteria in mind:  

  •            Enrich the conversation, don’t trash it.

  •           Stay focused and on track. Only post material that’s relevant to the topic being discussed. 

  •           Be respectful. Even negative opinions can be framed positively and diplomatically. Avoid profanity, slander or personal attacks directed at an author or another user. Racism, sexism and other forms of discrimination will not be tolerated.

  • Use standard writing style. Include punctuation and upper and lower cases. Comments that are written in all caps and contain excessive use of symbols will be removed.
  • NOTE: Spam and/or promotional messages and comments containing links will be removed. Phone numbers, email addresses, links to personal or business websites, Skype/Telegram/WhatsApp etc. addresses (including links to groups) will also be removed; self-promotional material or business-related solicitations or PR (ie, contact me for signals/advice etc.), and/or any other comment that contains personal contact specifcs or advertising will be removed as well. In addition, any of the above-mentioned violations may result in suspension of your account.
  • Doxxing. We do not allow any sharing of private or personal contact or other information about any individual or organization. This will result in immediate suspension of the commentor and his or her account.
  • Don’t monopolize the conversation. We appreciate passion and conviction, but we also strongly believe in giving everyone a chance to air their point of view. Therefore, in addition to civil interaction, we expect commenters to offer their opinions succinctly and thoughtfully, but not so repeatedly that others are annoyed or offended. If we receive complaints about individuals who take over a thread or forum, we reserve the right to ban them from the site, without recourse.
  • Only English comments will be allowed.
  • Any comment you publish, together with your profile, will be public on and may be indexed and available through third party search engines, such as Google.

Perpetrators of spam or abuse will be deleted from the site and prohibited from future registration at’s discretion.

Write your thoughts here
Are you sure you want to delete this chart?
Post also to:
Replace the attached chart with a new chart ?
Your ability to comment is currently suspended due to negative user reports. Your status will be reviewed by our moderators.
Please wait a minute before you try to comment again.
Thanks for your comment. Please note that all comments are pending until approved by our moderators. It may therefore take some time before it appears on our website.
Are you sure you want to delete this chart?
Replace the attached chart with a new chart ?
Your ability to comment is currently suspended due to negative user reports. Your status will be reviewed by our moderators.
Please wait a minute before you try to comment again.
Add Chart to Comment
Confirm Block

Are you sure you want to block %USER_NAME%?

By doing so, you and %USER_NAME% will not be able to see any of each other's's posts.

%USER_NAME% was successfully added to your Block List

Since you’ve just unblocked this person, you must wait 48 hours before renewing the block.

Report this comment

I feel that this comment is:

Comment flagged

Thank You!

Your report has been sent to our moderators for review
Continue with Google
Sign up with Email