Nairobi, Kenya, November 2025. Ghana received strong recognition at the high-level Third African Forum on Cybercrime and Electronic Evidence when Mr Dunstan Guba, a lead digital forensic expert from the Wisconsin International University College, Ghana Digital Forensic Lab, shared advanced technical perspectives on how Africa can strengthen its ability to fight ransomware attacks and what has worked for Ghana so far.
The forum brought together investigators, prosecutors, judges, policymakers and cybersecurity professionals from across the African continent. It remains the largest high-level gathering on cybercrime in the African region. The Council of Europe organised the meeting through its Cybercrime Programme Office, the European Union and the Government of Kenya.
Understanding What Ransomware Is
Ransomware is a form of malicious software that infiltrates computer systems, blocks access to files and demands payment for restoration. Modern variants go further. They first steal sensitive data, threaten to leak it publicly and then demand a ransom. This technique is known as double extortion. It has become one of the most damaging forms of cybercrime because it disrupts operations, damages trust and weakens institutional stability.
During his intervention, Dunstan Guba explained that ransomware actors no longer rely on locking systems alone. The new strategy is to quietly steal valuable information and weaponise it for pressure.
Guba stated that this evolution should concern African governments and organisations because stolen data carries enormous psychological and political value. Once taken, it can be used to discredit, embarrass or destabilise an institution.
The New Model of Ransomware Attacks
Guba described how ransomware groups now operate. They enter a network through phishing, compromised credentials or vulnerabilities. They then spend weeks moving through the system without detection. During this time, they copy sensitive data and analyse internal structures, governance weaknesses or political risks.
Only after gathering enough leverage do they issue threats of public release. Encryption, in many cases, becomes optional.
According to Guba, this shift means that even institutions that successfully restore backups remain vulnerable. Once data is stolen, recovery of systems does not equal recovery from the attack. Leaks, media exposure, or direct pressure on leadership can still follow.
Why African Institutions Are High Value Targets
Guba explained that attackers choose African organisations not only for financial gain but for the power of social and political leverage.
Common targets include:
• Government registries
• Hospital and health information systems
• Telecom subscriber databases
• Education records
• Law enforcement data systems
These systems hold sensitive information that influences public identity, national service delivery and public trust. When such data is leaked, the damage extends far beyond financial loss. It affects governance, public confidence and national security.
Guba also noted that ransomware actors use media pressure during their attacks. They create countdown sites, email journalists and contact board members to force negotiation even when victims have regained access to their systems.
Wisconsin International University College: A National and African Model Asset in the Fight Against Cybercrime
During the forum, Guba highlighted the growing role of Wisconsin International University College (WIUC) in Ghana’s national cybersecurity ecosystem. The university hosts one of the top state-of-the-art Digital Forensic Laboratories in Africa, equipped to handle complex forensic investigations involving malware, ransomware, mobile devices and advanced digital evidence examinations.
WIUC-Ghana’s Digital Forensic Lab is set to support law enforcement agencies and all institutions in digital investigations and all forms of cybersecurity/cybercrime investigations. It also contributes to Ghana’s leading cybersecurity research, hands-on cybersecurity technical training and national readiness for modern cyber threats.
Guba emphasised that Wisconsin’s Digital Forensic Lab is not only an academic resource. It is an international capability that:
• Supports Africans in critical digital forensic examinations
• Leads practical cybersecurity research
• Trains the next generation of cybersecurity experts
• Provides technical capacity for investigating ransomware and advanced malware
• Supports audio and video forensic examination, cloud forensics, bypassing any form of encryption, vulnerability assessment and penetration testing, mobile and computer forensics, IOT forensics, etc
• Serves as a trusted partner to all institutions and agencies.
Wisconsin’s contribution has positioned the university as a central pillar in Ghana’s cybersecurity advancement.
Ghana’s Growing Influence in Cybercrime Response
In his remarks, Guba highlighted Ghana’s strong commitment to building capacity in digital forensics and cybercrime investigations. Ghana has invested in advanced skills such as memory forensics, malware reverse engineering, blockchain tracing and darknet intelligence. These competencies support both national and regional investigations.
He urged African organisations to report ransomware incidents early and preserve evidence. Wiping systems destroys valuable forensic indicators. Preserving logs, memory images and compromised devices gives investigators the information needed to trace attackers and understand their methods.
A Call for Stronger Regional Collaboration
The Ghana delegation stressed that ransomware investigations require coordinated international response. Attack servers and stolen data storage are often located in foreign jurisdictions. Cryptocurrency payments are routed through several countries. African states must therefore strengthen legal cooperation, evidence sharing and technical capacity.
Guba encouraged African governments to modernise their electronic evidence laws, accelerate cross-border collaboration and support continuous training for investigators, prosecutors and judges.
Ransomware is now a direct threat to national stability. Africa must upgrade its investigative systems, legal frameworks and technical partnerships. Ghana remains committed to this mission, with Wisconsin International University College playing a central role through its world-class digital forensic laboratory and expert training programs.
About Dunstan GUBA
Mr Dunstan Guba is a Digital Forensic Expert with the state-of-the-art Wisconsin International University College, Ghana Digital Forensic Laboratory. He serves as a lead forensic analyst, penetration testing instructor, and malware reverse engineering specialist.
He plays a central role in Ghana’s national cybersecurity ecosystem, supporting high-impact forensic investigations, cyber intelligence operations and inter-agency collaborations with partners including Meta Platforms, INTERPOL and the FBI.
He also hosts Cybercrime Alert on Ghana Police TV, a national program dedicated to cybersecurity awareness and public protection.
