Vulnerabilities / Threats

11/28/2018
03:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Middle East, North Africa Cybercrime Ups Its Game

Ransomware, DDoS extortion, and encrypted communications abound as cybercriminals in the region refine their tradecraft.

Ransomware infections increased by 233% this past year in the Middle East and North Africa as part of a shift toward more savvy and aggressive cybercrime operations in a region where criminals just last year mostly were sharing malware tools, phony documents, and services for free or on the cheap.

Researchers at Trend Micro found that cybercrime in the region has matured rapidly in the past year, with hackers employing the Telegram messaging app for encrypted communications and money-laundering services to replace rudimentary cash-out transaction methods that in many cases converted stolen physical items into cash. "The increase in money-laundering services also shows the demand for monetizing ill-gotten gains has increased over time," says Jon Clay, global threat communications director at Trend Micro. "This all shows an increase in money-motivated cybercrimes within this region."

The shift from email, Skype, and Facebook Messenger to Telegram as well as WhatsApp for encrypted communications and money-laundering schemes is about flying under the radar as the cybercrime gangs in the region have evolved into more experienced and lucrative operations. They now offer so-called broker services or "contracts" for moving money, using European banks, PayPal, Western Union, and banks in the region. They offer commissions between 10% to upward of 50% to convert stolen funds into a different currency, preferring to cash out in stronger currencies, such as the US dollar via US banks.

SQL injection tools, keyloggers, port numbers for Internet-connected SCADA equipment, and hacking instruction manuals all had been offered for free in the region's underground in 2017, according to previous Trend Micro research. The WannaCry ransomware sample was sold for $50. Freely shared tools still exist there today, according to Clay, but the criminals are moving to more stealthy and secure infrastructures to hide their activities.

One of the biggest changes Trend Micro saw was the move from a tool that was "open source (and likely insecure) to a private communications tool," he says. "This tool encrypts all communications between the members and can ensure law enforcement cannot access. This has provided the underground community with a much more secure and private means of communications."

Aside from ransomware, distributed denial-of-service (DDoS) attacks and website defacements remain a popular attack by hackers in the region. What was once the domain of hacktivists has become yet another money-making opportunity for cybercriminals to extort their victims with destructive attacks on their websites, for example.

The oil and gas industry remains one of the biggest targets in the region – half of all cyberattacks  hit that sector – due to its pervasiveness and financially lucrative status. These organizations can't afford a ransomware or DDoS attack to disrupt sensitive operations. "These factors make it more likely that a compromised victim may pay an extortion or ransom fee," Clay says.

Law enforcement, too, has matured in its fight against cybercrime, which, in turn, has forced attackers to better hide their tracks. So far, Trend Micro hasn't detected any links between the cybercrime world there and nation-state operations. "In our analysis of the actors themselves, we're seeing predominately young males with either a high school or college education. As such, they are likely very good with technology, aggressive in their work, but still need more time to build their skillsets," Clay says.

Going Global
All of this means yet another international cybercrime region is emerging as a threat to nations such as the US. "This is a region that is increasing in their cybercriminal operations and will likely target organizations within the US," Clay says. "With an increase in the US oil and gas industry, these actors are learning what works within their own region and can take that knowledge and apply it into attacks within the US region."  

They already are selling tools in both Arabic and English-speaking underground forums, notes Mayra Rosario Fuentes, senior threat researcher at Trend Micro. "They are no longer just targeting their own region."

The Middle East and North Africa will become a bigger player in global cybercrime. "This should be a call for the regional law enforcement and government to improve their laws and ability to arrest and convict these criminals," Clay says. "It is also a call for organizations to recognize this region as a threat to their operations and improve their security capabilities to thwart attacks from this region."

Related Content: 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ChristopherJames
50%
50%
ChristopherJames,
User Rank: Apprentice
12/18/2018 | 4:57:04 AM
Surely there'll be exploitation
As technology evolves, so does crime. If there's money to be made and people to be exploited, are you truly surprised that someone there is some criminal trying to get his fingers into all the pies so that he doesn't have to work hard for it on his own? It's no surprise to me at all!
Ritu_G
50%
50%
Ritu_G,
User Rank: Apprentice
12/14/2018 | 1:23:22 AM
The same faces
Why are these areas always the focus when the topic of cybercrime is being discussed? The same culprits are just there improving their techniques whilst we are out here falling victims to their clever scamming. More users need to be educated about what to expect and to prevent themselves from being new or repeated victims. This is the only way for us to reduce the number of victims if we are not yet able to eradicate the problem fully.
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19790
PUBLISHED: 2018-12-18
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restricti...
CVE-2018-19829
PUBLISHED: 2018-12-18
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVE-2018-16884
PUBLISHED: 2018-12-18
A flaw was found in the Linux kernel in the NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel id and cause a use-after-free. Thus a malicious container user can cause a host kernel memory corruption and a system ...
CVE-2018-17777
PUBLISHED: 2018-12-18
An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is possible to bypass the login form by editing the path of the cookie "sid" generated by the page. The attacker will have acc...
CVE-2018-18921
PUBLISHED: 2018-12-18
PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.