In a comprehensive report released by IBM in 2024, the multinational technology firm has identified a significant surge in cyberattacks targeting user identities and corporate databases across the Middle East and Africa (MEA). This emerging trend underscores a pivotal shift in cybercriminal strategies, as they increasingly exploit legitimate user credentials to gain unauthorized access to corporate networks.
The IBM X-Force Threat Intelligence Index, which draws on data from over 150 billion security events daily across more than 130 countries, reveals that cybercriminals are pivoting from traditional hacking methods to more sophisticated means of infiltration. By leveraging valid local and cloud accounts, attackers are finding a path of least resistance, posing a considerable challenge to enterprises in the MEA region. This method was noted as the primary vector in cyberattacks, especially prevalent in countries like Saudi Arabia and the United Arab Emirates, which accounted for 40% and 30% of the incidents respectively.
The finance and insurance sectors, followed by transportation and energy, are the most impacted, bearing the brunt of these identity-based attacks. This trend is facilitated by the abundance of compromised credentials available on the dark web, making it easier for attackers to impersonate legitimate users. The scale of these breaches has significantly complicated the security landscape, making detection and response increasingly difficult for enterprises.
In 2023, IBM’s findings also highlighted a dramatic 266% increase in info-stealing malware, designed to harvest personally identifiable information such as email, social media credentials, banking details, and cryptocurrency wallet data. This indicates a global escalation in identity theft, which is now being replicated at an alarming rate within the MEA region. Malware remains the top tool for attackers in MEA, with other prevalent tactics including Distributed Denial of Service (DDoS) attacks, email threats, and the misuse of legitimate tools for malicious purposes.
The consequences of these attacks are profound, with breaches involving stolen or compromised credentials taking approximately 11 months to detect and recover from—markedly longer than any other type of cyber incident. This extended response time not only heightens the potential damage but also increases the cost associated with breach recovery. IBM’s report suggests that incidents involving legitimate credentials require up to 200% more complex security measures compared to average incidents, as security teams must differentiate between legitimate and malicious activities within their networks.
Moreover, the report anticipates that identity-based threats will continue to escalate as cybercriminals begin to employ generative AI to enhance their attack strategies. Over 800,000 posts related to AI and GPT were observed across dark web forums in 2023, indicating a keen interest among cybercriminals to integrate advanced technologies in their operations.
Babacar Kane, General Manager and Technology Leader for IBM Africa Growth Markets emphasized the critical nature of these threats. He advocated for a proactive approach to cybersecurity, stressing the necessity of AI-powered solutions to safeguard sensitive information in the digital era. As cyber threats evolve, Kane asserts that leveraging AI is no longer an option but a requirement to ensure organizational resilience and maintain trust.
In response to these evolving threats, IBM’s X-Force has outlined several strategies for organizations to enhance their cybersecurity posture:
- Reducing the Blast Radius: Implement measures to limit the potential impact of a breach by protecting critical user accounts, devices, and data.
- Stress Testing Environments: Employ ethical hackers to identify vulnerabilities in networks that could be exploited by cybercriminals.
- Incident Response Planning: Develop customized incident response strategies tailored to specific organizational environments. Regular drills should be conducted to ensure readiness, involving cross-organizational teams to facilitate rapid communication and decision-making during a crisis.
By adopting these strategies, companies can not only mitigate the risks associated with these sophisticated cyberattacks but also enhance their overall security infrastructure, positioning themselves to better navigate the increasingly complex cyber threat landscape. This proactive approach will be crucial as businesses in the MEA region strive to protect their operations and contribute to the broader economic stability of the area.
