Group-IB, an international company that specializes in preventing cyberattacks, and NGN International, a global system integrator, analyzed cybersecurity landscape in Gulf countries in 2018. Group-IB Threat Intelligence team identified compromised credentials of 7 306 users from the Gulf countries in 2018 and detected the total of 138 978 compromised cards issued by the Gulf countries’ banks.
Number of compromised cards ramps up in GCC
In 2018, Gulf countries including Bahrain, Kuwait, Oman, Qatar, Saudi Arabia and the United Arab Emirates (UAE) came under the spotlight of cybercriminals increasingly often. Group-IB Threat Intelligence experts detected a total of 138 978 compromised cards issued by the Gulf countries’ banks. This data comes not only from the analysis of underground forums and phishing websites, but also from the analysis of cybercriminals’ infrastructure (including but not limited to C&Cs) and malware disassembling.

Aleksandr Kalinin
Head of Group-IB’s Computer Emergency Response Team (CERT-GIB)
CEO of NGN International, Yaqoob AlAwadhi stated that, from 2017 to 2018, cybercrimes aimed at financial thefts increased significantly with cyber-criminals largely exploiting software vulnerabilities through phishing mailings and hacked legal resources.

Yaqoob AlAwadhi
CEO at NGN International
With the advent of IoT technologies, big data and machine learning, attack tools become more advanced and encompass several information systems and resources.

Yaqoob AlAwadhi
CEO at NGN International
Compromised credentials
Group-IB Threat Intelligence team also identified leaked credentials of 7,306 users from the Gulf countries in 2018, among which the company experts discovered 1 227 compromised credentials from government resources in GCC. Upon identification of this information, CERT-GIB reached out to region’s government CERTs to inform about the threat.

Aleksandr Kalinin
Head of Group-IB’s Computer Emergency Response Team (CERT-GIB)
According to Group-IB experts, cybercriminals might have used special spyware to steal user credentials — formgrabbers, keyloggers, such as Pony Formgrabber and AZORult. According to Group-IB data, the two Trojans mentioned above were amongst the most popular for credentials stealing in 2018 in GCC.
Regularly updated Group-IB Threat Intelligence system allows to get actionable information about data leaks, compromised accounts, information about malware, infected IPs, and existing vulnerabilities across the world. Group-IB collects and analyses large amounts of unique and proprietary information to deliver tailored, trusted and actionable intelligence to predict risks, while preventing and mitigating any targeted attacks.