Morocco emerges as new cybercrime hotspot

Morocco has unexpectedly emerged as a new contender in the cybercrime space and took center stage at Sleuthcon, a cybersecurity conference focused on cybercrime.

Traditionally, cybercrime has been associated with sophisticated actors backed by nation-states. However, Sleuthcon revealed that regular cybercriminals, including smaller countries like Morocco, can operate from anywhere.

While cybercrime operates globally and most financially driven attackers hail from well-known countries, Morocco has started attracting attention as a cybercrime hub. 

Microsoft researchers exposed a discreet and successful group named Storm-0539, also known as Atlas Lion, originating from Morocco. 

This group specializes in a unique brand of payment and gift card fraud. Unlike traditional point-of-sale scams involving malware, Storm-0539 exploits cloud identities to manipulate retailers into printing significant quantities of gift cards for themselves.

The group achieves this by targeting retail employees through smishing and phishing tactics, leveraging employee directories, schedules, and email inboxes. 

After gaining access, they manipulate the gift card system to print cards, which are then redeemed, sold on black markets, or cashed out using mules.

According to Waymon Ho, a senior security researcher at Microsoft, their persistence is alarming. “They relentlessly pursue access, and even after being ejected from a system multiple times, they keep gathering information until they succeed.” 

Storm-0539 even creates custom phishing domains resembling legitimate platforms to trick employees into providing access to gift card generation systems.

Emiel Haeghebaert, a senior analyst with Microsoft Threat Intelligence, explained how the group manipulates cloud companies into creating accounts under these fake domains, often disguised as charities. 

The value of the stolen gift cards can reach up to $100,000 each, indicating substantial profits for Storm-0539. “We don’t know how much they steal from each retailer over time. What we do know is that they’ve been observed stealing up to $100,000 in a single day,” said Haeghebaert.

Another potential Moroccan threat actor identified at Sleuthcon was Mr0x01, the admin behind OB Hacking, linked to Gray Hat Hackers and other Telegram hacking groups. 

Alex Delamotte, a senior threat researcher at SentinelOne, pointed out that Mr0x01 listed Meknes, Morocco, as his location in a HackerOne bug bounty application, and his social media posts are consistently in Arabic. 

“There’s a Python class in Predator for translation, with the first listed language being Darija, the Moroccan Arabic dialect,” she said. “It’s safe to assume we have at least one member in Morocco.”

The reasons behind Morocco’s emergence as a cybercrime hub remain unclear. Delamotte suggests the low cost of living might be a factor, along with the influx of Western money due to tourism in Casablanca and Marrakech. 

This, she speculates, might also lead to an improved information and technology infrastructure that cybercriminals can exploit.

Haeghebaert finds Morocco’s involvement in cybercrime unusual, highlighting the global reach of digital theft. 

“North Africa isn’t typically associated with cybercrime,” he said. “This is a new development, and it shows that cybercriminals can be anywhere due to the increasingly accessible nature of the cybercrime ecosystem.”