The company's June 2026 Global Threat Intelligence report found organisations worldwide experienced an average of 2,270 cyber attacks per week during the month, up 10% from May and 17% higher than June 2025.
Among the African countries analysed, Angola recorded the highest attack rate with 4,890 attacks per organisation per week, followed by Nigeria (4,361), Kenya (2,646) and South Africa (2,065).
Africa remained one of the world's most targeted regions, with organisations experiencing an average of 3,008 weekly attacks. Government, energy and utilities, and financial services were the sectors most frequently targeted across the continent.
Ian van Rensburg, head of security engineering for Africa at Check Point Software Technologies, said the data pointed to a broader escalation in cyber activity rather than isolated incidents.
He said attackers were expanding their reach across industries and countries, while ransomware groups continued to reorganise and scale rapidly. The emergence of The Gentlemen as the most active ransomware group highlighted how quickly new operators could become significant global threats.
Globally, education remained the most targeted sector, with organisations facing an average of 4,816 weekly attacks. Government ranked second, followed by telecommunications.
The report also highlighted growing risks linked to enterprise use of generative AI tools. According to Check Point, one in every 26 prompts submitted through enterprise networks carried a high risk of exposing sensitive information, while 85% of organisations using GenAI experienced high-risk prompt activity.
Healthcare recorded the highest rate of GenAI-related data exposure, followed by telecommunications and business services.
Ransomware attacks totalled 646 during June, representing a 33% increase compared with the same month last year. Business services accounted for nearly one-third of reported ransomware victims, followed by consumer goods and services, and industrial manufacturing.
The report also found a shift among ransomware operators, with The Gentlemen replacing Qilin as the most active ransomware group during June. LockBit also recorded a resurgence, increasing its share of published attacks from 1% in May to 7% in June.
Check Point said the findings reflected the ability of emerging ransomware-as-a-service groups to rapidly expand operations through affiliate networks and evolving attack techniques.
