'Dubai Police' Lures Anchor Wave of UAE Mobile Attacks

Source: Rastislav Sedlak via Alamy Stock Photo

The Dubai Police are the latest victims of impersonation by fraudsters in the United Arab Emirates (UAE), who are sending thousands of text messages out to unwitting mobile users while purporting to represent the law enforcement agency.

Researchers at BforeAI observed a recent surge in phishing attacks leveraging alleged police communications, which encourage text recipients to click on a malicious URL to respond to supposed legal trouble or to register with an “official” online portal. The included links redirect victims to fake websites designed to harvest sensitive information, including bank details or personal identification details.

The campaign uses well-crafted lures with official branding, suggesting a moderate level of sophistication, according to BforeAI. But while the lures are tailored to UAE citizens, the phishing methodology resembles a ‘spray-and-pray’ model in its broad reach.

“The campaign targets individuals likely to respond to law enforcement-related communications, of which legitimate comms of this nature are not uncommon in the UAE — targeting particularly those with a limited understanding of digital threats,” Abu Qureshi, lead for threat intelligence and mitigation at BforeAI, tells Dark Reading.

“The most striking aspect of this campaign is the calculated misuse of Dubai Police branding to establish credibility and deceive victims,” he adds. “This demonstrates a sophisticated understanding of social engineering techniques and reliance on psychological manipulation, exploiting fear and trust in law enforcement — which for citizens of the UAE is of utmost importance.”

Related:Governments, Telcos Ward Off China’s Hacking Typhoons

Cybercriminals Increasingly Target UAE, Middle East

Cybercrime campaigns targeting organizations and individuals in Dubai and other parts of the UAE are noticeably on the rise. According to research from Kaspersky earlier this year, 87% of companies in UAE have faced some form of cyber incident in the past two years.

“The UAE is a high-value target due to its affluent population, high Internet penetration, and reliance on digital services,” Qureshi says. “Cybercriminals exploit these factors alongside vulnerabilities in newly adopted technologies.”

The cybercrime spree is part of a larger trend in the targeting of individuals and organizations in some areas of the Middle East in general, he notes.

“There’s a focus on wealthy regions and individuals to maximize financial gain,” he says. “There are also regional geopolitical interests and an increased focus on Middle Eastern entities due to economic and political dynamics.”

Related:African Law Enforcement Nabs 1,000+ Cybercrime Suspects

To boot, because the area has embraced digital transformation and IT modernization with gusto, cybercriminals are targeting digital adoption vulnerabilities that come from the rapid implementation of advanced technologies without adequate protections, according to Qureshi.

Anchoring a UAE Cybercrime Campaign in Singapore

The cyberattackers behind the Dubai Police offensive appear to have used an automated domain generation algorithm (DGA) or bulk registration to quickly cycle through different domains to host malicious Web pages bent on financial fraud. Each domain is short-lived, in order to better avoid detection.

Most of those domains originated from Tencent servers based in Singapore, according to BforeAI researchers, who noted the company’s servers have hosted malicious activity before, including spam, phishing, and botnets.

“Tencent, a Chinese-based technology giant, maintains a significant hub in Singapore, leveraging the city-state’s strategic location and robust digital infrastructure,” says Qureshi. “Despite Singapore’s strong cyber-resilience and rigorous policies to address malicious activity, its status as a global tech hub makes it a prime location for abuse of legitimate platforms by cybercriminals.”

Related:Yakuza Victim Data Leaked in Japanese Agency Attack

Qureshi adds that the presence of malicious activity on Tencent servers could be due to the exploitation of legitimate services.

“High-traffic servers can be abused to host or relay malicious content without the company’s direct knowledge,” he explains, adding that jurisdictional complexity could also be at play: “Singapore’s law enforcement may face challenges in coordinating with foreign entities and differentiating criminal use from legitimate operations. While Tencent is based in Singapore — they are a Chinese firm.”

Two of the registrants were found to be from India and Dubai itself, with suspicious names suggesting that they originate from a legitimate company, according to the research. For the most part though, the cyberattackers have managed to keep their identity anonymous.

Tencent did not immediately return a request for comment.

How Organizations in the Middle East Can Protect Against Cyber Fraud

For organizations in the region, campaigns like this should prompt changes in risk management, Qureshi advises. Although the phishing messages are broad-based, in the age of the mobile office, even campaigns designed to hit individuals can end up affecting companies.

Common-sense security hygiene includes the basics, like double-checking the official domain of the Dubai government and the payment portal before proceeding with any payment, as well as looking for red flags like missing HTTPs protocol, broken links, out-of-place Web designs, or suspicious phrasing or grammar.

Qureshi advises organizations to take several additional steps to mitigate their risk, including:

• Enhanced monitoring: Implement robust predictive phishing detection systems and actively monitor for misuse of branding;

• Awareness programs: Train employees on phishing recognition and reporting;

• Collaboration: Work with CERTs and law enforcement to address identified threats;

• Incident response: Develop and test response plans to address phishing-related breaches;

• Reporting: Alert phishing reporting websites such as Etisalat and DU when employees receive phishing messages;

• And continuous vigilance: Adopt a proactive cybersecurity stance to protect brand reputation and customer trust.

And finally, “this Dubai Police campaign highlights the globalized nature of cybercrime, where local targets are exploited using international infrastructure,” Qureshi warns. “The importance of cross-border cooperation and leveraging threat intelligence to stay ahead of evolving tactics cannot be overstated.”

About the Author

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.