Threat Intel
Saudi Manpower Provider Scam: 1,001 Fake Domains Identified by Group‑IB
Group‑IB uncovered 1,001 domains used in a phishing campaign that impersonated a Saudi manpower provider, targeting users in KSA. Defenders should block these domains, update filtering rules, monitor for new registrations, and educate users to mitigate credential theft and potential malware delivery.
What happened
Group‑IB identified 1,001 domains registered under the name of a Saudi manpower provider. The domains were used in a coordinated phishing campaign aimed at employees and job seekers in KSA.
Impact
Users who clicked on links or entered credentials on these sites risk credential compromise and potential lateral movement. The campaign could also facilitate malware delivery or social engineering attacks.
What to do
- Block the identified domains and any newly registered domains that match the pattern (e.g., *.manpowerksa.com).
- Update email filtering rules to flag messages containing URLs from the compromised domain set.
- Deploy DNS sinkholing or firewall rules to prevent traffic to these domains.
- Conduct user awareness training focused on recognizing spoofed job‑posting emails.
- Monitor domain registration databases for new domains that mimic the legitimate provider.
Recommendations
Integrate threat intelligence feeds that include the list of malicious domains. Consider enabling multi‑factor authentication for all accounts to reduce the impact of credential theft.
Related articles
Fake Celine Dion Ticket Scam Targets Fans via Social Media and Impersonating Sites
Group‑IB uncovered a multi‑layered phishing scheme selling counterfeit Celine Dion concert tickets. The attack uses social‑network messages and spoofed distributor sites to lure buyers. Defenders should block malicious domains, monitor for ticket‑related phishing, and educate users.
Read briefing
Largest Network of Fake Card Shops Discovered – Phishing Sites Mimicking Legitimate Card Retailers
Group‑IB has mapped the biggest ever network of counterfeit card‑shop websites that masquerade as legitimate merchants. The sites harvest card details and personal data from unsuspecting shoppers. Defenders should block the domains, update web‑filtering lists, and educate users on spotting spoofed storefronts.
Read briefing
APT SideWinder Infrastructure Unveiled by Group‑IB and Bridewell
Security researchers Bridewell and Group‑IB have mapped previously unknown command‑and‑control infrastructure used by the APT SideWinder group. The new intelligence reveals a set of IP addresses, domains, and malware hashes that can be leveraged by defenders to harden detection and response. Security teams should ingest these indicators into their SIEM, XDR, and threat‑intel platforms and review network traffic for anomalous outbound connections.
Read briefing
Fraudulent Trading Apps Targeting iOS and Android via UniApp Framework
Group‑IB uncovered a large‑scale fraud campaign that distributed counterfeit trading applications on iOS and Android. The malicious apps were published through official app stores and phishing sites using the UniApp framework. Defenders should verify app authenticity, monitor for duplicate app listings, and block associated domains.
Read briefing