Kenya's National Highways Authority (KeNHA), the state agency responsible for developing, maintaining and managing the country's national road network, has been named as a victim of the Deadlock ransomware operation. The incident was reported on 26 July 2026 by UNDERCODE NEWS, citing cybersecurity reporting circulating in open sources. KeNHA has not published a public statement confirming the scope of the intrusion, and Deadlock's operators have not released a public sample of allegedly stolen data at the time of writing. What is established is the targeting itself: a national transport infrastructure agency in East Africa now sits on a ransomware group's victim list, and the technical impact remains undisclosed.
What Happened
Deadlock ransomware operators are reported to have compromised KeNHA's internal environment and disrupted agency operations. KeNHA administers Kenya's classified national trunk roads, manages road construction and maintenance contracts, oversees tolling and axle load control programs, and coordinates with county governments and international financing partners on infrastructure delivery.
Public information on the intrusion is thin. Reporting does not specify the initial access date, dwell time, the number of systems encrypted, whether backups were affected, or whether the agency has entered negotiation. There is no confirmed ransom figure. There is no confirmed data leak site posting with published proof-of-compromise files.
That gap matters for how defenders should read this. Treat the targeting as credible and the operational detail as unverified. Public sector victims in the region frequently go weeks without formal disclosure, and the absence of an official statement should not be read as either confirmation or denial. Analysts tracking this should watch for a follow-on leak site posting, which is typically where the first hard evidence of data volume and file types appears.
What Was Taken
No confirmed data set has been published. Deadlock, in line with the broader double-extortion model, would be expected to exfiltrate before encrypting, and a highway authority holds several categories of material that carry real value to an extortion operation:
Procurement and contract records. Road construction tenders, bid evaluations, contractor pricing, and award documentation. This is the highest-sensitivity category. Leaked tender data can expose bid rigging, trigger legal challenges to awarded contracts, and create political fallout independent of any technical damage.
Financial and donor records. Kenyan road projects draw funding from the World Bank, the African Development Bank and bilateral partners. Financial reporting tied to those instruments is commercially and diplomatically sensitive.
Engineering and infrastructure documentation. Bridge and highway design files, structural assessments, survey data, GIS road inventories and maintenance backlogs. This category has a physical security dimension that ordinary corporate data does not.
Personnel and identity data. Staff records, national ID numbers, payroll, and contractor personnel files.
Operational technology touchpoints. Weighbridge and axle load control systems, tolling infrastructure, and traffic management platforms, where those connect to the corporate network.
Until a leak site listing appears with a file tree or sample archive, all of the above is exposure modeling, not confirmed loss. Stated plainly: we do not yet know what Deadlock took.
Why It Matters
Ransomware crews target government infrastructure because the pressure math favors them. A road authority cannot credibly say the outage does not matter. Contractor payments stall, project approvals queue up, and the political cost of a visible standstill accumulates daily. That urgency is the leverage, and it exists whether or not a single kilometer of tarmac is affected.
Three points make this incident worth tracking beyond the immediate victim.
Government agencies in fast-digitizing economies carry structural exposure. Service delivery has moved online faster than security budgets, monitoring coverage and incident response retainers have followed. The attack surface expanded first; the defenses arrive later.
Transport authorities are a converged IT and OT environment. Tolling, weighbridges, traffic control and variable message signage are operational systems reachable from business networks in many deployments. An intrusion that starts in email and file shares does not necessarily stop there.
Third-party and contractor exposure compounds the blast radius. Highway agencies operate through dense networks of engineering firms, surveyors and construction contractors with varying levels of access. Data lost at the agency is data lost about every counterparty in that chain, and access held by a contractor is a path into the agency.
For defenders elsewhere in the sector, the actionable read is that critical infrastructure operators in emerging markets are now inside the standard ransomware targeting set, not an exception to it.
The Attack Technique
Deadlock's initial access vector in this specific case has not been disclosed. No CVE, phishing lure, or compromised credential has been publicly tied to the intrusion.
What can be said is what the broader ransomware ecosystem does against public sector targets, and what defenders should therefore hunt for:
Internet-facing edge device exploitation remains the dominant entry path. VPN concentrators, firewalls, and remote access gateways running unpatched or end-of-life firmware are the most common front door into government networks.
Valid account abuse follows closely. Credentials sourced from infostealer logs and criminal marketplaces, used against remote access services lacking multi-factor authentication, produce access that looks entirely legitimate in logs.
Exposed remote desktop services, still reachable directly from the internet in many public sector estates, remain a persistent weak point.
Post-access, the pattern is consistent: credential harvesting, Active Directory reconnaissance, privilege escalation to domain administrator, lateral movement using native administrative tooling, deliberate destruction or encryption of backups, bulk exfiltration to cloud storage, then encryption deployed at scale as the final step.
The backup destruction stage is the one defenders most often discover too late. By the time encryption fires, the recovery path has usually already been dismantled.
What Organizations Should Do
Audit and harden every internet-facing entry point. Inventory VPN gateways, firewalls, remote access appliances and exposed RDP. Patch to current firmware, remove end-of-life hardware from the perimeter, and confirm that nothing is reachable from the internet that does not need to be.
Enforce phishing-resistant MFA on all remote access and privileged accounts. SMS and push-based factors are routinely defeated. Hardware tokens or FIDO2 for administrators, VPN users and anyone touching finance or procurement systems.
Make backups genuinely recoverable, then prove it. Offline or immutable copies, credentials for the backup system isolated from the production domain, and a documented restore test with a measured recovery time. An untested backup is an assumption, not a control.
Segment IT from operational technology. Tolling, weighbridge, traffic management and signage systems should not be reachable from the general corporate network. Enforce the boundary at the network layer, not by policy alone, and verify it with a real path test.
Monitor for the pre-encryption sequence. Alert on mass credential access, unusual Active Directory enumeration, new domain admin accounts, shadow copy deletion, backup job tampering, and large outbound transfers to cloud storage. The window between exfiltration and encryption is where an intrusion is still stoppable.
Extend controls to contractors and suppliers. Engineering firms, surveyors and construction partners with network access need enforced MFA, time-bounded and least-privilege accounts, and contractual breach notification obligations. Review who currently holds access and revoke what is dormant.
Have the incident response plan ready before you need it. Named decision makers, legal and regulatory notification paths, pre-arranged forensics support, and an out-of-band communications channel that survives the loss of the primary domain.