Hackers targeting VPN users to execute crimes
Ms Caroline Kamaitha the general manager of Raxio Data Centre Company, addressing journalists at the Raxio Data Centre in Namanve on Tuesday. PHOTO | STEPHEN OTAGE
What you need to know:
- Hackers are increasingly targeting VPN users to execute cybercrimes, exploiting both technical vulnerabilities and social engineering tactics
Data protection experts have warned of a new type of cybercrime where hackers are taking advantage of users of unsecured Virtual Private Networks (VPN) to access their social media accounts such as Facebook.
Speaking to journalists at the launch of the 2025 Uganda’s data centre landscape report at their headquarters in Namanve, Wakiso District, on Tuesday, Ms Caroline Kamaitha, the general manager of Raxio Data Centre Company, said the new type of cybercrime is part of the global trends since February. “I haven’t seen the underlying data, but according to the World Economic Forum's global trends in February, the global attacks are expected to increase because everyone is connected to the internet. All bank information is on the mobile phone, so is Uber,” she said.
“Because of the increase in attacks, we need to increase awareness, especially for those who have no security systems, to make it difficult for the attacks,” she added. Ms Kamaitha explained that with the demand for cloud computing now growing at the rate of 30 percent annually, the increased use of Artificial Intelligence (AI) and many organisations digitising their data, it is important that citizens’ data is stored locally for easy processing, storage and data security reasons because they are seeing the banking sector, the telecoms and the health sector as the biggest consumers of their services and they expect other government ministries, departments and agencies to follow suit.
Asked to explain how hackers use VPNs to attack systems, Mr Edwin Enabu, the sales manager at Raxio, said cybercrime keeps changing, but what is important is to ensure that you have mechanisms of avoiding being hit. He explained that when the government banned the use of Facebook in the 2021 General Elections, Ugandans opted to use Virtual Private Networks to access Facebook and yet most of them are public.
“Ugandans like exploring available short-term solutions. Facebook got blocked, and people decided to use VPN to access it. VPN is like an open public tunnel. We have technocrats in coding that will hack that tunnel because it is public and not private. “They find that some apps for their network infrastructure have been installed through the phone and they will access that network using the app and also access the infrastructure,” he said.
Solutions
Asked what can be done to reverse this trend, he said it is difficult to manage VPNs because they are many but it is important for government to negotiate with Meta, the owners of Facebook, for terms and conditions under which they can be allowed to operate in the country because even the continued ban on their operations is hurting online businesses which would now be employing many youth. According to Mr David Egweli, the facilities manager, the alternative is for the Uganda Communications Commission to identify secure VPNs which they can recommend Ugandans to use. He said although there could be cartels within organisations who collude with the hackers to cause mayhem, the latest trend of people working from home is also exposing many people and institutions to vulnerabilities.
How hackers get access
Ugandans like exploring available short-term solutions. Facebook got blocked, and people decided to use VPN to access it. VPN is like an open public tunnel. We have technocrats in coding that will hack that tunnel because it is public and not private, once they get a thorough put to that public network they find that some apps for their network infrastructure have been installed through the phone and he will access that network using the app and also access the infrastructure,– Edwin Enabu, the Sales Manager at Raxio.
Cybercrime law in Uganda
The Ugandan law addresses cybercrimes primarily through the Computer Misuse Act of 2011. This act, along with the Copyright and Neighbouring Rights Act of 2006 and the Penal Code Act of 1950, outlines various offences related to computer misuse and electronic activities.
