Connect with us

Cyber Security

Group-IB Uncovers Wide-Scale Phishing Campaign that Sees Scammers Mimic KSA Manpower Provider



Group-IB has today published its research into a wide-scale phishing scheme that sees scammers impersonate one of the leading manpower agencies in the Kingdom of Saudi Arabia (KSA). In total, analysts from the Group-IB Computer Emergency Response Team (CERT-GIBand Digital Risk Protection Team based at the company’s Threat Intelligence and Research Center in Dubai, UAE analyzed more than 1,000 rogue domains created to impersonate the manpower provider in question as part of a long-term scam campaign.

Group-IB analysts uncovered how one individual claimed to be offering more than 100 domain names that contained a logical connection to, or a variation of, the brand name in question. In line with Group-IB’s zero-tolerance policy towards cybercrime, Group-IB analysts notified the Saudi Computer Emergency Response Team (CERT-SA), a fellow OIC-CERT member, of their findings to assist their regional partners in taking any relevant action to combat this scheme.

Scam in Action
In 2021, more than $55 billion was stolen from victims as a result of scams, according to a Global State of Scam Report that Group-IB contributed to. The need to combat scammers is all the more pertinent given that recent Group-IB research found that scams accounted for 57% of all financially motivated cybercrime, and, according to the Global Anti Scam Alliance, the number of scams is growing more than 10% year on year. The same report also revealed that users in Saudi Arabia are targeted by the most phishing scams in the Middle East.

Domain spoofing, known as the faking of a website or email domain to make malicious sites or emails look credible, has long been a tactic of cybercriminals across the globe, and we are seeing new schemes appearing with alarming regularity. This past July, Group-IB uncovered more than 270 domain names that mimicked over a dozen postal and logistics brands across the Middle East in a separate scam campaign.

However, the postage scam scheme identified by Group-IB has been dwarfed in size by a new wide-scale domain and website spoofing campaign targeting users in Saudi Arabia. Over the past 16 months, Group-IB analysts analyzed more than 1,000 rogue domains linked to a single Saudi company – a leading manpower agency that offers businesses assistance in hiring employees for the construction and services sector, and individuals can also procure the services of domestic workers through the agency. The latter of these two groups is the target of this scam campaign.

The campaign, which was launched in April 2021, appeared to peak in March 2022, when more than 200 new domains spoofing the agency in question were registered with hosting providers. Group-IB analysts believe that the surge in new domains registered in early 2022 could be a sign that a growing number of internet users had fallen victim to this scheme. As seen in other examples around the world, scammers often double down on a certain tactic once it starts to generate money.

A breakdown of the scheme’s timeline can be found below:

In April 2022, when the phishing campaign surged, financial bodies in Saudi Arabia warned of a sharp increase in financial fraud in the country in the preceding year. Group-IB analysts assume that the subsequent reduction in the number of new domains registered per month imitating the manpower provider has followed in the wake of warnings to users by financial authorities in Saudi Arabia, government institutions, and the brand itself. However, the creation of 32 new spoof domains in September 2022 alone shows that scammers are still attempting to impersonate the company.

According to Group-IB’s findings, the driving factor for this scam scheme is an unholy alliance between scammers and spoof domain brokers. This alliance sees the brokers purchase the rights to dozens of domain names containing a typographical or phonetic variation of the attacked brand, and offer them for sale at a low price to scammers.

Imitation – the Sincerest Form of Flattery
The URLs and the design of the scam pages created as part of this campaign are intended to convincingly imitate the manpower provider in question and trick users into entering their credentials for banking services and online government portals. The scammers can harvest both login information and two-factor authentication (2FA) codes to gain access and complete fraudulent transactions.

The scam campaign, which rests on multiple layers of social engineering, starts with the scammers placing advertisements on social media sites such as Facebook and Twitter, and the Google search engine. Group-IB analysts discovered more than 40 individual advertisements for this scheme on Facebook alone. 

From there, the victims begin interacting with the scammers via SMS or WhatsApp communication, and a full breakdown of an average victim journey can be found below:

The phishing pages created by the scammers contain the official logo of the targeted brand as a means of building legitimacy in the eyes of the victims.

Figure 2: Phishing page containing the logo of the brand (blurred) to make it look legitimate.

Upon landing on the homepage of the phishing site, the victim is directed to click the large green button that has “apply” written on it. Once they do this, they are transferred to a second page where they are requested to enter their personal information.

Figure 3: Phishing page where users are asked to fill in their name, phone number, address and national ID number. After filling in the requested data, the user has to click on apply.

After entering their personal information and clicking “apply”, the victims are redirected to a page that asks them to select the nationality of the domestic worker they wish to hire.

Figure 4: After clicking apply, the victims are transferred to the next phishing page, where they are asked to choose the nationality of the domestic worker they want to request.

The next stage of the scam sees victims choose the type of domestic service they require (e.g., hourly, in-house).

Figure 5: Phishing site containing the range of domestic worker services the scammers purport to be offering to users.

Once they have completed these steps, the victim is transferred to a page on which they are asked to pay a small processing fee of 50 or 100 SAR (approximately $13 or $27). In fact, this transaction will not take place, as it is merely a ploy for the scammers to harvest credentials, but the victims are presented with the choice of making this fake transaction either via bank payment or a Saudi government portal.

Figure 6: Users are presented a choice, either via bank payment or card transaction, to pay what they believe to be a 50 or 100 SAR processing fee, although this transaction, which isn’t credited, is a ploy to steal users’ login details.

Irrespective of how the victim chooses to make the fake payment, they are sent either to a page emulating 11 regional banks or a website impersonating a Saudi government portal. The likelihood of the victim of being directed to the fake bank page or the fake portal page appeared to be random. In both cases, the victim’s login credentials and two-factor authentication (2FA) code are harvested by the scammers.




Figure 7: Phishing page on which the victim is prompted to make the fake processing payment via one of 11 leading regional banks.


Figure 8: After clicking on the image of the bank of their choice, the victim is asked to enter their login and password.


Figure 9: Phishing page mimicking a Saudi governmental portal asking for the two-factor authentication code, which the user receives once the scammers attempt to log in to the real governmental portal using the credentials harvested in the previous step.

Once the victim enters their data, the threat actors harvest the victim’s login credentials and 2FA code, which can be used to gain access to the victim’s bank or governmental portal account and begin making fraudulent transactions until the account is emptied.

Interestingly, the domain names identified by Group-IB in this scam campaign are registered with the same popular and affordable hosting providers as seen in many other phishing schemes. This underlines how fraudsters worldwide are utilizing similar tactics, such as launching domains with cheap, easy-to-register, and stable hosting providers, to target victims across the globe.

The primary goal of this research is to raise public awareness in the Middle East of the latest phishing attacks, and to call for internet users to remain vigilant as threat actors continue to convincingly, and with increased regularity, impersonate some of the region’s largest organizations. Scammers are becoming increasingly resourceful and collaborative, and spoof domain brokers are coming to the assistance of cyber criminals. We encourage companies and organizations to monitor for signs of brand abuse, and we also urge internet users to remain vigilant so that they do not become victims of scams such as this,” Mark Alpatskiy, CERT-GIB Senior Analyst, said.

In order to prevent further phishing attacks using spoof domains, companies and organizations should monitor for signs of brand abuse across the internet, including on social media which is often used by scammers to advertise their phishing pages. There are solutions that help firms and organizations secure their digital assets by continuously and automatically monitoring millions of online resources where the brand or intellectual property may be present.

Internet users are urged to show caution and always check the URL domain of the page they are accessing and verify it to see if it is the official website before entering any personal or payment details. Another recommendation is to maintain communication with online chat services or call centers of the official company or organization.

Cyber Security

Databases Are the Black Boxes for Most Organisations



Nik Koutsoukos, the Vice President of SolarWinds, says databases represent the most difficult ecosystems to observe, tune, manage, and scale

Tell us about the SolarWinds database observability platform.
Nearly everything a modern business does from a digital perspective requires data. Thus, databases are among the enterprise’s most valuable IT assets. This makes it critical for organisations to ensure their databases are optimised for performance and cost.

That said, databases represent the most difficult ecosystems to observe, tune, manage, and scale. Not only are there different types of databases that serve different purposes, but they are also populated by different types of data, adding to their complexity. The implications of not having visibility into your databases can be anywhere from a costly annoyance to a significant issue that causes business service disruption. For example, most application performance issues, between 70% and 88%, are rooted in the database.

For this reason, databases have largely been seen as a black box for most organisations. You know what goes into it. And you know what comes out and how long that took. However, the complexities that occur within the black box of the database are harder to discern.

This is where the SolarWinds Database Observability comes in. This offering is built for the needs of the modern enterprise environment and helps ensure optimal performance by providing full, unified visibility and query-level workload monitoring across centralised, distributed, cloud-based, and on-premises databases. Organisations armed with SolarWinds Database Observability enhance their ability to understand database implications as new code is deployed, utilise real-time troubleshooting of database performance issues, and isolate unusual behaviour and potential issues within the database.

How does database observability help IT teams track and manage infrastructure, applications, and possible threats?
Database observability collects data about the performance, stability, and overall health of an organisation’s monitored databases to address and prevent issues, and provides deep database performance monitoring to drive speed, efficiency, and savings. With SolarWinds Observability — which supports MongoDB, MySQL, PostgreSQL, and SQL Server database instances — database performance, responsiveness, and error rate are conveniently displayed in dashboards.

Moreover, alerts can be configured to notify admins by email or other methods when user-defined thresholds are crossed. This allows them to identify and remedy issues before they can develop. By gaining insight into the activities taking place inside their database instances, teams can understand user experience as well as ensure systems can scale to meet demand.

What sort of enhancements has your observability platform received recently?
Just this November, we announced major enhancements in the Database Observability capability within our cloud-based SolarWinds Observability platform. SolarWinds Database Observability provides full visibility into open-source, cloud-enabled, and NoSQL databases to identify and address costly and critical threats to their systems and business. It is now possible to navigate across all of the samples collected globally, giving IT teams an empirical distribution of random samples, which resembles the main workload.

What factors according to you will drive the adoption of observability tools in the MEA region?
The Middle East, Türkiye, and Africa (META) are riding a wave of rampant digital transformation as organisations seek to remain competitive. According to IDC, digital transformation spending in the Middle East will accelerate at a compound annual growth rate (CAGR) of 16% over the five-year period, topping US$74 billion in 2026 and accounting for 43.2% of all ICT investments made that year. As organisations continue to shift workloads to multi- and hybrid-cloud environments, the complexity of their IT environments still continues to increase. This raises the potential for visibility and monitoring gaps which ultimately translate to underwhelming or outright frustrating experiences for end users.

Tell us about the top three trends you foresee for 2024.
There are clear signs of the continued adoption of cloud technologies to allow enterprises to become more agile, giving engineering teams the ability to focus on their core competencies and expand and contract on demand.

The adoption of Kubernetes is also increasing as the refocusing introduced by the cloud enables the move to microservices-based architectures which require sophisticated orchestration management.

Finally, we are starting to see an uptick in Vector databases, as applications demand better handling of relationships between data points.

What is going to be your top priority in terms of strategies for 2024?
We will continue to deliver on our vision of making observability easy. OpenTelemetry is driving observability, but data collection is nothing if it can’t provide insights. So, we aim to ensure the data is both collected and curated such that users find it easy to consume and extract valuable insight.

Regionally, through 2024, we will continue to focus on our key markets of the UAE and Saudi Arabia, the ongoing enhancement of our product portfolio, and the strengthening of our channel ecosystem to create more markets for our business and for our partners.

Continue Reading

Cyber Security

ManageEngine Intros Enhanced SIEM with Dual-Layered System for Better Precision in Threat Detection



ManageEngine, the enterprise IT management division of Zoho Corporation, today unveiled the industry’s first dual-layered threat detection system in its security information and event management (SIEM) solution, Log360. The new feature, available in Log360’s threat detection, investigation and response (TDIR) component, Vigil IQ, empowers security operations centre (SOC) teams in organizations with improved accuracy and enhanced precision in threat detection.

A quality SOC ensures people, processes, and cutting-edge technology function well. However, enterprise security is made difficult by staffing shortages and solution orchestration complexities. Following recent upgrades to the security analytics module of Log360 designed to facilitate SOC optimization through key performance metric monitoring, the company has focused on addressing pressing challenges in security operations.

“In a recent ManageEngine study, a majority of respondents revealed that their SOCs are understaffed. These resource-constrained SOCs grapple with significant obstacles, such as process silos and manual investigation of alerts, which are often non-threats, low-priority issues or false positives. These lead to extended detection and response times for actual threats. To overcome these challenges, we recognize the imperative adoption of AI & ML for contextual event enrichment and rewiring threat detection logic,” said Manikandan Thangaraj, vice president at ManageEngine.

“We pioneered a dual-layered, ML approach to heighten the precision and consistency of threat detection. First, Vigil IQ ensures genuine threats are discerned from false positives. Second, the system facilitates targeted threat identification and response. This advanced system significantly improves the accuracy of identifying threats, streamlining the detection process and allowing SOC analysts to focus their valuable time on investigating real threats.”

Key Features of the Dual-Layered Threat Detection System of Vigil IQ in Log360:
Smart Alerts: Vigil IQ, the TDIR module of Log360, now combines the power of both accuracy and precision in threat detection. With its dynamic learning capability, Vigil IQ adapts to the changing nature of network behaviour to cover more threat instances accurately. It will spot threats that get overlooked due to manual threshold settings, thereby improving the detection system’s reliability.

Proactive Predictive Analytics: Leveraging predictive analytics based on historical data patterns, Vigil IQ predicts potential security threats, facilitating the implementation of proactive measures before incidents occur. This predictive intelligence drastically reduces the mean time to detect (MTTD) threats.

Contextual Intelligence: Vigil IQ enriches alerts with deep contextual information, providing security analysts with comprehensive threat insights. This enrichment of alerts with non-event context accelerates the mean time to respond (MTTR) by delivering pertinent, precise information.

Continue Reading

Cyber Security

Cybersecurity on a Budget: Affordable Cybersecurity Strategies for Small Businesses



According to a survey by Statista, typically, global enterprises dedicate a minimum of 12% of their IT expenditure to information security measures. While larger companies can afford to spend a lot on building a robust cybersecurity strategy, smaller businesses cannot. So, let’s explore some affordable cybersecurity strategies for small businesses that may cost less but have a greater impact.

Train your employees
An article from Forbes found that, annually, 34% of businesses worldwide encounter incidents involving insider attacks. Whether intentional or unintentional, employees tend to be the reason for most data breaches. Per the same article, phishing emails account for 67% of accidental insider attacks.

Phishing attacks mostly instil a sense of urgency in the victim, making it harder for them to think clearly before making a decision. For example, employees may click an email announcement about a bonus that actually came from a malicious outsider impersonating your company’s CEO.

To avoid such mistakes, it’s imperative to train employees on the types of phishing attacks and the ways to identify them. Even going as far as sending a mock phishing email occasionally to test their instincts and educate them can go a long way.

Assess your vulnerabilities
One of the most important cybersecurity strategies is to assess all your risk points by periodically reviewing all your business processes. Pay more attention to teams that deal with a lot of customer data. For instance, sales and marketing teams may handle customer data on a day-to-day basis, so they are at high risk of leaking or mishandling data. Assess their daily activities, create a record of all the risk points, and find ways to mitigate them.

Encrypt your data
Encrypting your data can be an effective method to protect it in case of data leaks. Let’s say a hacker gets hold of your company’s data, but it’s encrypted. Unless the hacker gets the encryption key from you, they cannot access your company’s data. This adds another layer of protection in addition to the everyday cybersecurity best practices that you should be following in your company. So make it a point to encrypt all your data, especially sensitive and critical data.

Limit access to critical data
Not everyone requires access to all data. Try to limit access to critical and sensitive data to fewer employees by basing access on work duties or requiring approval for access, making it a multi-step process to access it. Additionally, periodically review who has access to what data to ensure there aren’t any misallocations of access.

Secure your Wi-Fi
A secure network will reduce the chances of a hack or unauthorized access to your sensitive data. So switch your Wi-Fi to WPA2 or later, as it offers more security. Your business might already be using it, but it’s best to be sure. Additionally, change the name of your SSID and have a strong pre-shared key to keep your Wi-Fi safe from hackers.

Prevent physical theft
Through April 2023, there were 3,785 robberies in London, and 1,765 were of mobile phones. This highlights how important it is to secure your physical assets, as they might contain critical and sensitive information about your organization.

Here are some ways to protect your physical assets, such as PCs, laptops, scanners, and printers:

  1. Restrict unauthorized access to assets.
  2. Install a physical tracker on all devices to track down lost items.
  3. Enable remote wiping of data to erase information if a device is lost.

Cybersecurity strategies are seldom drafted with affordability in mind. However, it is crucial to consider them from a financial perspective, as small businesses are also increasingly susceptible to cyberattacks. These tips can help you take the first step toward creating a secure IT environment. Learn more about cybersecurity solutions for your business.

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.