Cash and Communication: New Trends in the Middle East and North Africa Underground

by Mayra Rosario Fuentes and Ahmed Kamal Aly

Cybercriminal activity in underground markets constantly fluctuates in response to different factors, such as real-world market movements or the availability of new tools or technology. In our continued exploration of the Middle East and North Africa (MENA) underground, we noticed several changes since our previous investigation. Cybercriminals started using a new form of communication to transact, and the stolen goods-to-cash ecosystem suddenly made way for money laundering services. This means that cybercriminals are finding new and more discreet ways to move their money, and also experimenting with new ways to stay under the radar.

This was a definite shift from 2017, when cybercrime activities that originated from and targeted the MENA region escalated. A harmful old malware called Shamoon resurfaced, and industry experts found that Middle East organizations were susceptible to serious ransomware attacks. Also, a survey of oil and gas executives revealed that 50 percent of all cybercrime attacks targeted the oil and gas industry within the MENA region. This showed a shift in risk where services and operational technology were being hit instead of information technology. In this threat landscape, MENA underground marketplaces were quite active. A distinct culture set MENA apart from other countries’ markets, and a joint philosophy that encouraged free sharing allowed many types of crimeware to proliferate. In particular, malware and fake documents were readily available, and there were popular cashout services that helped criminals convert stolen merchandise.

However, in 2018 some of the popular goods and services offered in the underground changed. As mentioned above, active sellers evolved to match market need and client demands — mostly in terms of money services. Many MENA cybercriminals also changed from a free service and adopted a more secure end-to-end encrypted messaging used in other underground markets.

New developments in services and communications

Financial Services

Our 2017 paper on the MENA underground covered many different aspects of cybercriminal activity, which includes their operations, wares, clientele and markets. The report noted that cashout services were widespread in the underground. The services were used to convert physical items, usually stolen, into cash. However, these services have developed and evolved. Now, cash services are actually money laundering operations that convert money (instead of goods) into different currencies.

In multiple underground forums, these money laundering operations are now found in new dedicated sections called “broker” services or “contracts.” They advertise money exchanges from European banks, Paypal, Western Union, and MENA-specific banks. Brokers ask for commissions that range from 10% to 50% to help convert the money into a new currency. Often, the requests are to cash out money from American banks.

Figure 3: A user from the Soqor forum is looking for a new business partner for cashout services (translated in bottom image)

Figure 4: An advertisement on X6x offering "Personal loans" (translated in right image)

Figure 5: Hack-Int post advertising cashout services to any American or European bank (translated in bottom)

Discount Travel

Discount travel services were first seen on multiple MENA underground forums in late 2017. As mentioned in our previous research “How Cybercriminals Tour the World on the Cheap,” cybercriminals run this business by offering services paid for using stolen credit cards and hacked loyalty program accounts. This isn’t a unique service — Russian, English, and Chinese cybercriminal forums have been advertising discounts on travel documents as well as airline and hotel loyalty accounts for the past several years. Most of the travel discounts offered are for flights and hotels starting at 30% off the original price.

Figure 6: A user from Hack-int forum requesting assistance with booking BULK discount travel tickets (translated in right image)

Figure 7: Advertisement for discount Airline tickets from the Dev-point forum (translated in bottom image)

Communications

MENA actors are now using Telegram, taking advantage of its secure messaging features to offer live support. Russian and Brazilian underground forums have been using Telegram for several years, and it makes sense for those in the MENA underground to follow the trend. Forum users are listing Telegram channels, along with the usual email address or Whatsapp number in their contact information.

Now, we see advertisements on MENA underground forums promoting dedicated sections for Telegram and topics to educate users on this application. Commonly posted topics include “how-to guides for searching users” and “how to create accounts without the need for a mobile number.” Since many MENA countries require personal identification like a passport or an ID before buying SIM cards or mobile phones, these guides are valuable for neophytes.

Figure 8: The telegram section found on the X6x forum as of October 2018 (translated in bottom image)

Figure 9: Advertisement on how to create a Telegram account without a mobile number on the .easypc.ir forum (translated in bottom image)

Providing sought after goods and services is what keeps an underground market in business, and the sellers have to keep up with the fluctuating needs of users. Cash moves freely online, and users are eager to move to services like PayPal where they can transact without leaving much of a footprint. Switching to stronger currencies is also in demand since markets continue to be quite volatile. Similarly, as the travel industry continues to grow, demand for airfare discounts and perks has increased.

Secure communication is also a significant factor in underground transactions — buyers and sellers need to be able to communicate freely to conduct business. The move to Telegram, with its end-to-end encryption, gives them anonymity and keeps them hidden from law enforcement. Given that underground markets in other countries already use Telegram, it was a shrewd move for those who are active on MENA markets.

The Next Targets of MENA Underground Cybercriminals

The future of cybercrime is with the internet of things (IoT). This isn’t a particularly new angle — threats against IoT have been growing every year. But because of the continuing proliferation of these devices, cybercriminals will have more and better opportunities to abuse them for their own gain.

IoT devices are scattered across homes and businesses — from security cameras, kitchen appliances, and smart door locks to gaming systems, TVs, smart wearables, HVACS, and ICS systems. And more IoT devices will be used in nation-wide programs within MENA: Saudi Arabia and UAE are committed to create smart cities across the country. UAE’s Roads and Transport Authority has already started using autonomous vehicles in certain districts this February. Also, Qatar launched an initiative to develop smart infrastructure in time for the 2022 World Cup.

Figure 10. A Forum user discussing an easy way to hack cameras (translated in right image)

Figure 11. Discussion about Ransomware of Things on Dev-point (translated in right image)

As IoT further develops, we expect to see cybercriminals looking for new ways to exploit these networked devices to gain access to or control over them. In multiple Arabic speaking forums, users have already discussed the inner workings of popular IoT devices such as smart watches, lights, and robots.

And so, given the persistent spread of these devices and the wide-reaching impact of an IoT exploit, it should be a priority for homes and business owners to secure their devices as best they can.