Panel: Observed Malicious Cyber Criminality During COVID in the African and Arab Regions

## Overview

This panel discusses observed malicious cyber criminality in African and Arab regions during the COVID-19 pandemic, featuring experts from Nigeria, Tunisia, Oman/Sultanate, and ICANN sharing threat observations, attack trends, and regional responses.

## Regional Observations

**Nigeria and East Africa:** Abdul Hakeem reported that the Kenyan CERT detected 35.2 million cyber threat events between July and September 2020, representing a 152.9% increase from the previous quarter. In Nigeria, the Central Bank warned of spikes in phishing, malicious spam, and ransomware attacks. Attackers impersonated organizations like the Nigerian Center for Disease Control and WHO, using COVID-19 as bait for relief aid fraud. On September 2, 2020, the Nigerian Economic and Financial Crimes Commission arrested 13 suspects in an organized criminal syndicate. Criminals also impersonated bank staff, advising victims to download malicious mobile apps claiming to offer loans during the pandemic. South Africa, Kenya, and Nigeria were identified as the most affected countries in Africa.

**Tunisia:** Bernard (head of TNSERT's Watch Alert and Warning Division) reported that incident handling tripled in 2020 compared to 2019. Attackers targeted ISPs with DDoS threats demanding ransom, and phishing operations exploited employees unfamiliar with VPN or video conferencing (citing Zoom's April 2020 vulnerabilities). Telecom operators' customers were targeted with fake competition entries via Facebook. The Tunisian government's financial aid organization constantly faced attacks to steal credentials. Multiple incidents were documented with increasing victim counts; one attack affected 120 victims in less than 24 hours. Malware deployed included ransomware, web shells, botnets, and APTs, particularly following exploitation of Microsoft Exchange vulnerabilities.

**Sultanate (Oman) and Arab Region:** Dr. Haytham described malicious apps impersonating WHO and CDC infection maps with root access seeking financial credentials. Small-to-medium enterprises suffered most due to weak infrastructure and unpreparedness for remote work. Remote workers became particularly vulnerable when working from home with inadequate personal network security, family members' infected devices, or free Wi-Fi. Ransomware and social engineering were the most impactful threats. Attackers later shifted to vaccine registration schemes and financial aid scams, exploiting unemployment and economic hardship.

## Attack Methods and Threat Landscape

Common attack vectors across regions included: - Phishing impersonating health organizations (WHO, CDC, national health agencies) - Malicious mobile apps claiming to provide COVID tracking or government services with non-intuitive names - Social engineering exploiting relief aid and government financial assistance programs - Ransomware targeting remote workers and organizations - DDoS attacks on internet service providers for extortion - Web shells, botnets, and advanced persistent threats via vulnerability exploitation - Identity theft and credential harvesting - Fake news and fraudulent websites promoting counterfeit goods or financial schemes

Attackers exploited multiple factors: the pandemic created urgency, remote work infrastructure was hastily deployed without security, legitimate government agency branding was spoofed, and populations were economically vulnerable.

## ICANN's DNS Threat Intelligence Project

Carlos Alvarez presented DNSTIR (Domain Name Security Threat Information Collection and Reporting), begun in March 2020. The project analyzed all generic top-level domains for pandemic-related terms in multiple scripts. Results: 360,000 total pandemic-related domains identified since January 2020; 247,000 pandemic domains from May 2020 to August 2021. Only 6.1% returned reports from VirusTotal, Google Safe Browsing, or AlienVault OTX. Of those, 4,400 received high-confidence reports, but only 370 were flagged as malicious within ICANN's scope (malware and phishing only, excluding fraud/scams). Alvarez emphasized that ICANN's narrower scope explains lower numbers compared to other organizations like Interpol, which legitimately include fraud domains outside ICANN's mandate.

## Key Recommendations

Panelists emphasized: - Public-private partnerships and joint task forces to build confidence and address cyber crime - Multi-stakeholder ecosystems involving government, private sector, and civil society - Adoption of cloud-based solutions including Extended Detection and Response (EDR) - Mobile device management with two-factor authentication as default - Separate networks and antivirus activation for home workers - Awareness campaigns tailored to literacy levels and delivered via multiple channels (TV, radio, social media) - Guideline development for secure remote work - Endpoint protection prioritization - Investment in incident response capacity and managed service providers - Emphasis that legitimate recipients must verify information sources independently

## Conclusion

The pandemic exposed infrastructure and preparedness gaps in African and Arab regions, with attackers exploiting rapid digital transformation, economic desperation, and security-consciousness gaps. Effective response requires sustained collaboration, cultural awareness, and balanced protection of both privacy and enforcement capabilities.