Hired hand: Scammers mimic Saudi manpower provider

The need to combat scammers is all the more pertinent given that recent Group-IB research found that scams accounted for 57% of all financially motivated cybercrime, and, according to the Global Anti Scam Alliance, the number of scams is growing by more than 10% year on year. The same report also revealed that users in Saudi Arabia are targeted by the most phishing scams in the Middle East.

Countering such prolific scam activity can be challenging for any organization. Group-IB’s scam detection, response and takedown capabilities are designed to eliminate scams at the source, quickly stopping scam activity for good. Most recently, Group-IB uncovered a wide-scale scam campaign that saw malicious actors imitate a leading manpower provider in the Kingdom of Saudi Arabia. In total, Group-IB identified more than 1,000 rogue domains created by the scammers as part of this scheme.

In line with Group-IB’s zero-tolerance policy to cybercrime, the Group-IB Computer Emergency Response Team (CERT-GIB) notified its fellow OIC-CERT member Saudi CERT (CERT-SA) of its findings to assist with subsequent steps to mitigate this scam campaign.

Domain spoofing, known as the faking of a website or email domain to make malicious sites or emails look credible, is a weapon that has long been in the arsenal of cybercriminals, especially those targeting users in the Middle East. Earlier this year, analysts at Group-IB discovered more than 270 domains mimicking the names of leading postal and logistics firms across the MENA region, and new schemes are appearing with alarming regularity.

However, the postage scam campaign identified by Group-IB has been dwarfed in size by a new domain and website spoofing scheme comprising more than 1,000 rogue domains. The campaign, which Group-IB researchers believe was launched in April 2021, sees scammers impersonate a leading manpower provider in the Kingdom of Saudi Arabia to steal users’ credentials for banking services and online government portals.

The manpower provider offers businesses assistance in hiring employees for the construction and services sector, and individuals can also source domestic workers through the agency. The latter of these two groups is the target of this scam campaign.

Figure 3: Users are presented a choice to pay, either via bank payment or card transaction, what they believe to be a 50 or 100 SAR processing payment, although this transaction, which isn’t credited, is a ploy to steal users’ login details or bank credentials

Interestingly, the domain names identified by Group-IB in this scam campaign are registered with the same popular and affordable hosting providers as seen in many other phishing schemes. This underlines how scammers worldwide are utilizing similar tactics, such as launching domains with cheap, easy-to-register, and stable hosting providers, to target victims across the globe.

The peak of this campaign was observed in March of this year, when more than 200 new domain names were registered or hosted. While the number of victims of this scam campaign is unknown, Group-IB analysts believe that the surge in new domains registered in winter 2021 could be a sign that a growing number of internet users had fallen victim to this scheme. As seen in other examples around the world, scammers often double down on a certain tactic once it starts to generate them money.

Over recent months, this campaign appears to have tapered off, as from March onwards, the number of new spoof domain names created monthly has dropped, and in September, 32 new fake domains were registered. Group-IB assumes that the decrease is related to several warning messages about this scam campaign published in April 2022 by financial bodies in Saudi Arabia.

The infrastructure of all detected phishing domain names was identified by the Threat Intelligence capabilities of Group-IB's Unified Risk Platform (URP). An example of how the scam campaign's resources are interconnected is provided in the below screenshot from Group-IB's Graph Network Analysis Tool, a patented technology across URP's modules.

Every little green dot in this image is either a domain name, SSL certificate, or IP address from this campaign that we have recognized as used for phishing or fraud. This infrastructure is clustered into groups depending on the attribution and services (registrars and hosting providers), represented by the yellow dots in the image, that the scammers used.

Scammers often prepare multiple social media accounts and phishing pages so that they can quickly replace any that are blocked by authorities. By identifying all of the infrastructure, as shown above, the entire scheme can be disrupted in a manner that is not easily circumvented.

Many scammers also rely on others, especially those with specialist skills such as setting up fraudulent domains, to help create their scams. During Group-IB’s analysis, our researchers found a video of a man offering to sell more than 100 domain names containing various typographical or phonetic variations of the name of the manpower agency for just $10.

While monitoring the selling resource, Group-IB analysts saw that the list of domain names impersonating the brand is updated on a weekly basis and included, at the time of writing, at least 11 domain names aimed at imitating the brand in question. Group-IB analysts suspect that a further 75 of the 100 domains are being prepared for use in future scams.

As opposed to blocking individual violations, monitoring and eliminating the entire networks scammers set up is critical, as they try to jump from one domain to another quickly. As a result, monitoring the key players in the creation of phishing scams can help proactively prevent scammers from emulating your brand.

Malicious actors expect organizations to monitor for scams and have phishing pages taken down, so they prepare hundreds of replacements that they keep in reserve and launch whenever required.

Brand protection strategies that focus solely on the visible infrastructure struggle to prevent these persistent scams from taking place. Instead, companies and organizations are recommended to leverage holistic solutions, such as Group-IB’s Digital Risk Protection, which can continuously and automatically monitor millions of online resources, including images, redirect chains, traffic sources, and HTML files to keep your brand safe.

As a world leader in scam prevention, Group-IB has extensive experience protecting organizations’ brands. Our Digital Risk Protection solution is best-in-breed, combining AI-powered technologies with highly trained analysts to detect and respond to scams. Group-IB’s three-phase takedown process ensures the swift removal of any scam you may encounter. To learn more contact one of our experts.