Oman reports 193K phishing attacks in Q2

Computer and net users in the Sultanate were the target of an estimated 193K phishing attacks during the second quarter of this year – part of over 2.5 million attacks reported across the Gulf and Middle East region during the quarter, according to global cybersecurity company Kaspersky.

According to cybersecurity experts, attackers have been exploiting widespread concerns over the COVID-19 pandemic to prey upon unsuspecting users, while others have added new tactics to their methodologies ranging from HR dismissal emails to attacks disguised as delivery notifications. Using these tactics, they mounted as many as 2,578,501 phishing attacks across Egypt, UAE, Saudi Arabia, Qatar, Kuwait, Bahrain, and Oman, said Kaspersky in its latest spam and phishing report.

“Phishing is one of the oldest and most flexible types of social engineering attacks. They are used in many ways, and for different purposes, to lure unwary users to the site and trick them into entering personal information. The latter often includes financial credentials such as bank account passwords or payment card details, or login details for social media accounts. In the wrong hands, this opens doors to various malicious operations, such as money being stolen or corporate networks being compromised. This makes phishing a popular initial infection method,” said Kaspersky in a statement.

Saudi Arabia with 973,061 phishing attacks was the biggest target in Q2 2020, followed by UAE (617,347), Egypt (492,532), Oman (193,379), Qatar (128,356), Kuwait (106,245) and Bahrain (67,581).

Phishing is a strong attack method because it is done at such a large scale. By sending massive waves of emails under the name of legitimate institutions or promoting fake pages, malicious users increase their chances of success in their hunt for innocent people’s credentials. The first six months of 2020, however, have shown a new aspect to this well-known form of attack.

In Q2 2020, phishers increasingly performed targeted attacks, with most of their focus on small companies. To attract attention, fraudsters forged emails and websites from organizations whose products or services could be purchased by potential victims. In the process of making these fake assets, fraudsters often did not even try to make the site appear authentic.

Such targeted phishing attacks can have serious consequences. Once a fraudster has gained access to an employee’s mailbox, they can use it to carry out further attacks on the company the employee works for, the rest of its staff, or even its contractors.

The news agenda, following the COVID-19 outbreak, has already influenced the “excuses” fraudsters use when asking for personal information. This included disguising their communications with unsuspecting users as:

• Delivery services: At the peak of the pandemic, organizations responsible for delivering letters and parcels were in a hurry to notify recipients of possible delays. These are the types of emails that fraudsters began to fake, with victims asked to open an attachment to find out the address of a warehouse where they could pick up a shipment that did not reach its destination.
• Postal services: Another relatively original move used by fraudsters was a message containing a small image of a postal receipt. The scammers expected that the intrigued recipient would accept the attachment (which, although it contained ‘JPG’ in the name, was an executable archive) as the full version and decide to open it. The Noon spyware was found in mailings such as these examined by Kaspersky researchers.
• Financial services: Bank phishing attacks in the second quarter were often carried out using emails offering various benefits and bonuses to customers of credit institutions due to the pandemic. Emails received by users contained a file with instructions or links to get more details. As a result, depending on the scheme, fraudsters could gain access to users’ computers, personal data, or authentication data for various services.
• HR services: The weakening of the economy during the pandemic in a number of countries caused a wave of unemployment, and fraudsters did not miss this opportunity to strike. Experts encountered various mailings that announced, for example, some amendments to the medical leave procedure, or surprised the recipient with the news about their dismissal. In some attachments, there was a Trojan-Downloader.MSOffice.SLoad.genfile. This Trojan is most often used for downloading and installing encryptors.