South Africa's internet infrastructure is under threat from a series of large-scale DDoS attacks, with three hosting and network providers disrupted in a matter of days. The attacks have raised fears of an extortion campaign, as one provider, Network Platforms, received ransom demands and did not engage with them. The attacks have disrupted web hosting, email, and customer control-panel access, with inbound traffic peaking at over 300Gbit/s. The attacks are a recurring tactic globally, but a cluster of attacks on this scale against South African infrastructure is unusual. The hosting industry is attractive to attackers because a single successful attack can ripple across hundreds or thousands of downstream customers, amplifying both the disruption and the pressure to pay. The situation is still under investigation, and it is not yet clear whether the three incidents are the work of the same attackers. However, the clustering of large-scale attacks on local hosting providers inside roughly 24 hours, alongside a confirmed ransom demand, fits the pattern of a ransom DDoS campaign. South Africa's hosting industry may be facing a continued threat, and the disruption appears to be easing at two of the three providers. The article concludes by highlighting the importance of cybersecurity and the need for hosting providers to take proactive measures to protect their infrastructure and customers.
