Threats grow in Saudi Arabia’s cyber sector

Saudi Arabia is an attractive country for investors and criminals alike. As the world’s largest producer of oil, it has a robust economy with some of the biggest organisations in the region, a large population, strategic geographical location and strong consumer spending power.

But most recently, it is cyber criminals that have taken a particular interest in the country, prompting the government to establish the Saudi National Cyber Security Centre (SNCSC), which was launched officially in February this year.

Saleh Ibrahim Al-Motairi, director-general of the SNCSC, told local news outlets that Saudi Arabia had suffered almost 1,000 cyber attacks in 2016, with targets including infrastructure and intellectual property.

Ransomware is the most common type of cyber attack used in the country and across the Middle East.

According to Symantec’s Internet security threat report, Saudi Arabia is the most “impacted” country in the Middle East and Africa (MEA) region in terms of ransomware and ranks 31st globally.

“We have seen that organisations in Saudi Arabia faced a significant amount of malware attacks, ranking fourth within MEA,” said Eyas Hawari, country manager for Saudi Arabia at Symantec.

Perhaps the country’s most worrying vulnerability is in the field of cyber espionage. “More recently, we have seen notable cases of organisations in the country targeted by spear phishing campaigns, including Shamoon and Greenbug, which are carefully crafted and targeted attacks designed to steal data, spy or sabotage an organisation,” said Hawari.

These attacks have not just caused large financial losses, they have also undermined and damaged the country’s reputation. “Criminals tend to target organisations that are huge in scale and are state-owned,” said Arthur Dell, director of technology and services, Middle East, at Citrix. The energy sector is especially at risk, he said.

Shamoon is the most notorious attack to have hit Saudi Arabia. The malware first made headlines in 2012 when it was used against energy companies in Saudi Arabia, wiping the master boot records and replacing them with an image of a burning US flag. It destroyed 35,000 computers at state-owned oil company Saudi Aramco in the space of a few hours and compromised strategic information, forcing the company to invest heavily to update its IT infrastructure.

The malware was unleashed when a computer technician unwittingly opened an email containing a suspicious link.

Shamoon resurfaced in November 2016, disrupting operations at about 15 Saudi state bodies and corporations, including Sadara Chemical Co – a joint venture between Saudi Aramco and the US’s Dow Chemical – and the country’s General Authority of Civil Aviation. The difference this time was that the attackers used a photograph of the body of Syrian-Kurdish refugee Alan Kurdi, who drowned in the Mediterranean in 2015.

Stonedrill, another cyber espionage attack linked to Shamoon, was discovered in Saudi Arabia in March 2017, according to Kaspersky Lab, which did not identify the specific target. This is a similar wiper malware that destroys everything on the infected computer and is intended to cause maximum damage.

Most observers believe Iran is behind these attacks, highlighting the longstanding political tensions between the two oil producers, who are currently fighting a proxy war against each other in Yemen.

Saudi Arabia has also recently fallen victim to Greenbug, a cyber espionage group that has targeted a range of organisations in the region in the aviation, energy, government, investment and education sectors.

“It was a simple type of attack, but effective in causing the damage it intended,” said Symantec’s Hawari. The security software maker believes Greenbug could be linked to Shamoon.