VERY IMPORTANT

In January 2019, researchers from Anomali Labs and Saudi Telecom Company (STC) observed a spike in phishing websites impersonating the Saudi Arabian Ministry of Interior’s e-Service portal known as “Absher”. Further analysis uncovered a broader phishing campaign targeting four different Kingdom of Saudi Arabia government agencies and a single Saudi-based financial institution. The campaign dates back to least late-November 2016 in which over 90 confirmed phishing hostnames (46 unique domains) were created to target at least five KSA entities. Given the attackers targeting affinity for the Saudi Ministry of Interior’s Absher portal, which represents close to 60 percent of the KSA-related phishing sites, Anomali has named the campaign “Bad Tidings” after the English language translation “Good Tidings” of the Arabic language word “Absher”.