Group-IB x Fawry Success Story

Introduction

Electronic payments surely bring convenient, time-saving, and seamless transactions, but what one might see as a three-click simple process involves a whole other level of complex infrastructure to make one transaction happen. It is a multi-component process involving website/ application interfaces, payment gateways, processors, and networks behind the scenes – each can have exposures that cybercriminals could exploit, putting your businesses’ and your customers’ faith in the entire system to the test.

This emphasizes the importance of maintaining robust security measures across all e-payment and financial services, starting from the first line of infrastructure code, especially when cyber adversaries are increasingly motivated to exploit any vulnerabilities for potential intrusions and attacks.

It is standard practice to segregate development and testing environments from production ones. In the case of Fawry, this isolation was even physical due to its high-security, high-reliability systems. However, despite that, cybercriminals might still find ways to intrude into your testing environment, potentially causing disruptions.

Such was an impasse experienced by Egypt’s largest e-payment service provider – Fawry. LockBit (2023’s most prominent ransomware-as-a- service group with 1,079 posts on its DLS (24% of the annual total as per Hi-Tech Crime Trends Report 23/24) tapped into their data inventory to exfiltrate information, encrypt files, and demand ransom.

Beyond mitigating the crisis, there were associated situational challenges. As a $2 billion company, Fawry was extra cautious in ensuring unhindered and continued operations. Group-IB not only assisted Fawry in navigating through this difficult period but also provided tangible support in helping the company gauge the crisis deeply and share credible communication about its impact on its extensive user base.

Comprehensive investigation and analysis of Fawry’s cybersecurity infrastructure

The investigation and threat interdiction began after a post was published on the Lockbit threat cluster on their Data Leak Site (hereinafter – DLS) on November 8th, 2023.

LockBit claimed a successful ransomware attack on Fawry, encrypting Fawry’s testing environment infrastructure and exfiltrating some portion of the data. These claims weren’t made without substance and were supported by screenshot proof of several Personal Identifiable Information (PII) entries of Fawry’s customers.

Figure 1.
Lockbit DLS post about attack on fawry

Fawry was given a 20-day ultimatum to pay the ransom, with the deadline being November 28th, 2023. To prevent the situation from escalating
into a full-blown crisis, Fawry sought the help of Group-IB experts. Group- IB quickly initiated the process of collecting evidence of the attack and conducting an in-depth technical analysis, including the scale and scope of the attack.

Figure 2. Ashraf Sabry – Chief Executive Officer at Fawry talking about collaboration with Group-IB to help mitigate the cyber threat.

Group-IB Digital Forensics and Incident Response Team’s (DFIR) Findings

Offering Fawry An Official Clean Bill of Cyber Health

When the report was written in November 2023, the following conclusions were made and submitted by Group-IB.

• Group-IB confirmed that Fawry’s Production environment was not affected by the Lockbit ransomware attack.
• Group-IB confirmed that there was no current presence of Lockbit’s threat cluster in Fawry’s Production, UAT, and Testing systems.
• Group-IB finalized the technical analysis of the Lockbit ransomware attack.
• Group-IB continued to provide post-incident services through ongoing coverage with our Extended Detection and Response (XDR) tool and threat-hunting services, ensuring no further risk persistence or disruptions occur in Fawry’s network.

Fawry, with Group-IB’s comprehensive support and technical expertise, evidenced the optimum level of cybersecurity maintained for their testing and live operational environments. To maintain transparency and long- standing trust in the brand, this was officially communicated to the stakeholders and the public through a press release.

Conclusion

This collaboration study showcases a strong partnership that resulted in timely and thorough ransomware attack analysis and complete network cleanup, solidifying security for the e-payment giant. Group-IB experts utilized the patented advanced monitoring, intelligence, and detection technologies and investigative expertise to provide comprehensive insights into the infrastructure of the leading e-payment business, identifying potential attack vectors exploited by the ransomware authors.

Group-IB will continue to actively monitor Fawry’s systems and assess the necessity for any additional security measures as needed. Furthermore, Fawry maintains a proactive approach to ensure robust cybersecurity across its entire infrastructure. The company engages with global consultancy firms to review its governance and risk assessment policies, enhancing existing frameworks to align with the utmost standards.