Have a question? +971 56 404 0503
Tech Features
New Security Brief: Millions of Messages Distribute LockBit Black Ransomware
By Sarah Sabotka, Bryan Campbell, And The Proofpoint Threat Research Team
What happened
Beginning April 24, 2024, and continuing daily for about a week, Proofpoint observed high-volume campaigns with millions of messages facilitated by the Phorpiex botnet and delivering LockBit Black ransomware. This is the first time Proofpoint researchers have observed samples of LockBit Black ransomware (aka LockBit 3.0) being delivered via Phorpiex in such high volumes. The LockBit Black sample from this campaign was likely built from the LockBit builder that was leaked during the summer of 2023.
Messages were from “Jenny Green” with the email address of Jenny@gsd[.]com. The emails contained an attached ZIP file with an executable (.exe). This executable was observed downloading the LockBit Black payload from Phorpiex botnet infrastructure.
The emails targeted organizations in multiple verticals across the globe and appeared to be opportunistic versus specifically targeted. While the attack chain for this campaign was not necessarily complex in comparison to what has been observed on the cybercrime landscape so far in 2024, the high-volume nature of the messages and use of ransomware as a first-stage payload is notable.
The attack chain requires user interaction and starts when an end user executes the compressed executable in the attached ZIP file. The .exe binary will initiate a network callout to Phorpiex botnet infrastructure. If successful, the LockBit Black sample is downloaded and detonated on the end user’s system, where it exhibits data theft behavior and seizes the system, encrypting files and terminating services. In an earlier campaign, the ransomware was directly executed, and no network activity was observed, preventing network detections or blocks.
Attribution
Proofpoint Threat Research has not attributed this campaign to a known threat actor. Phorpiex is a basic botnet designed to deliver malware via high-volume email campaigns. It operates as a Malware-as-a-Service and has garnered a large portfolio of threat actor customers over more than a decade of operation (earlier versions were first observed on the threat landscape circa 2011). Since 2018, the botnet has been observed conducting data exfiltration and ransomware delivery activities. Despite disruption efforts throughout the years, the botnet persists.
Proofpoint has observed a cluster of activity using the same “Jenny Green” alias with lures related to “Your Document” delivering Phorpiex malware in email campaigns since at least January 2023.
LockBit Black (aka LockBit 3.0) is a version of LockBit ransomware that was officially released with upgraded capabilities by the ransomware affiliates in June 2022. In September 2022, the confidential ransomware builder was leaked via Twitter. At the time, multiple parties claimed attribution, but LockBit affiliates claimed the builder was leaked by a disgruntled developer. The leak allows anyone to adopt the configuration for customized versions.
Why it matters
Ransomware as a first-stage payload attached to email threat campaigns is not something Proofpoint has observed in high volumes since before 2020, so the observation of a LockBit Black sample in email threat data on this global scale is highly unusual. Additionally, this campaign has been particularly notable due to the high volume of messages in the millions per day, volumes not commonly observed on the landscape. The number of messages and cadence associated with recently observed LockBit Black campaigns are at a volume not seen in malspam since Emotet campaigns.
The LockBit Black builder has provided threat actors with access to proprietary and sophisticated ransomware. The combination of this with the longstanding Phorpiex botnet amplifies the scale of such threat campaigns and increases chances of successful ransomware attacks. This campaign is another good example of how the threat landscape continues to change, underscored by recurring and significant shifts and pivots in the tactics, techniques, and procedures (TTPs) used by threat actors.
By Naser Taher, Chairman of MultiBank Group
The Middle East and North Africa (MENA) region has become the leading laboratory for financial innovation, where artificial intelligence (AI), central bank digital currencies (CBDCs), and sovereign wealth fund (SWF) strategies converge to reshape global cash flows. According to the World Economic Forum, venture capital investments in MENA grew by about 33% a year from 2015 to 2023, with funding reaching $644 million in 2024. This surge reflects deliberate efforts to position the region as a fintech powerhouse for the new economy.
One of the most significant developments is the strategic collaboration between the Abu Dhabi Investment Office (ADIO) and the Trump Organization to establish an AI and Web3 Free Zone. The $6.6 billion initiative aims to attract global tech firms, AI researchers, and fintech ventures to the UAE, further cementing MENA’s leadership in next-generation digital infrastructure.
Machine learning algorithms now process trades worth billions on Saudi Arabia’s Tadawul exchange daily, while automated risk assessment systems evaluate loan applications in real time from Dubai to Riyadh. Saudi Arabia’s Financial Sector Development Program has embedded AI throughout its capital markets ecosystem as part of Vision 2030’s broader economic transformation. PwC analysis projects this technological integration will generate almost $135 billion for the country’s economy by 2030, fundamentally altering how banks manage liquidity, assess credit risk, and compete regionally.
Central banks across the Gulf have moved beyond theoretical frameworks into live testing of digital currencies. The UAE’s Digital Dirham is set to enter retail circulation through licensed banks and fintech companies by late 2025, enabling near-instant cross-border payments where traditional banking requires days and charges hefty fees. Meanwhile, Saudi Arabia and the UAE have jointly piloted Project Aber, issuing a single wholesale CBDC.
Gulf SWFs are reshaping the region’s infrastructure landscape, no longer content with simple portfolio plays. These institutions now control $4.9 trillion in assets, with projections reaching $7.3 trillion by 2030. In the first nine months of 2024, they accounted for 40% of all international SWF transactions, deploying $55 billion across 126 deals. Notably, Abu Dhabi’s Investment Authority and Saudi Arabia’s Public Investment Fund (PIF) are increasing allocations to blockchain and digital projects. In Qatar, the Qatar Investment Authority is working through the Qatar Financial Centre’s new Digital Asset Regulations 2024 to trial real-world asset tokenization.
Alongside these public sector moves; private institutions are also innovating on a scale. MultiBank’s new Electronic Communication Network (ECN) will introduce the Gulf’s first interbank trading and prime brokerage ecosystem, linking BRICS and GCC jurisdictions. Designed to compete with Western counterparts such as Bloomberg and Reuters, it connects conventional trading desks to machine-driven order routing and the MultiBank Chain’s tokenization layer. Cross-border deals become faster, safer, and more transparent, with settlements possible in gold or a mix of currencies instead of U.S. dollars alone. By opening the door to tokenized real-world assets and other decentralized products, the network sharpens the Gulf’s bid to serve as a global finance hub.
However, important challenges remain. Fintech ventures still need to navigate a maze of rules that shift from one border to the next; a single, region-wide framework would let ideas—and capital—move faster. As more money flows online, hackers gain fresh openings, and cybersecurity becomes even more critical. And while Gulf youth embrace tech with ease, the GCC needs far more specialists who can work with blockchains, train risk models, and secure CBDC payment rails. That calls for a push on everything from university courses to mid-career reskilling.
The next breakthrough won’t come from technology alone but from how well policymakers, entrepreneurs, and the sovereign heavyweights backing them work in sync. CBDC pilots are live, AI already guides trading desks, and deep pools of patient capital sit ready to fund new ideas. If the region’s key players keep pulling in the same direction, the Gulf won’t just join the digital finance conversation—it could end up leading it.
Sophos, a global leader in innovative security solutions for defeating cyberattacks, recently announced an update to its Sophos Firewall. Now, Sophos Firewall includes Sophos NDR Essential—free for all customers with an XStream Protection license.
With this integration, Sophos Firewall leverages two dedicated artificial intelligence engines to detect malware communications and algorithmically generated domain names. This new capability, powered by the Sophos Network Detection and Response probe, identifies previously unknown threats and complements the Active Threat Response features already in place.
According to Chris McCormack, Senior Product Marketing Manager at Sophos, “NDR traffic analysis requires substantial processing power. That’s why we’ve adopted a new approach by deploying an NDR solution in Sophos Cloud to offload the heaviest tasks from the firewall.”
Sophos Connect Integrates EntraID for SSO
The VPN client bundled with Sophos Firewall now supports EntraID (Azure AD) for single sign-on. This enhancement secures SSL and IPsec VPN connections and improves user experience by adding multi-factor authentication for both Sophos Connect and the user portal.
Other VPN-related improvements include:
- –Intuitive interface updates: “Site-to-site” is now “policy-based,” and “route-based” tunnel interfaces are renamed for clarity.
- –Dynamic IP pool validation: Prevents address conflicts across SSL VPN, IPsec, L2TP, and PPTP.
- –Strict profile enforcement: Excludes default IPsec profile values to ensure algorithm synchronization and eliminate session negotiation issues.
- –Enhanced scalability: Supports up to 3,000 route-based VPN tunnels, 1,000 SD-RED site-to-site tunnels, and 650 concurrent SD-RED devices.
Additional Management Enhancements
Furthermore, Sophos has rolled out several management improvements to streamline daily operations:
–Flexible IPv6 DHCP-PD: Supports /48 to /64 prefixes for better ISP compatibility.
–RA and DHCPv6 server enabled by default: Simplifies IPv6 deployments.
–Resizable table columns: Improves the admin interface on ultra-wide screens.
–Advanced search: SD-WAN routing and local ACL rules now support name, ID, and content-based searches.
–Default configuration updates: Only the default network and MTA rules are provided; custom gateway probes and rule groups default to “None.”
Secure by Design
Moreover, Sophos continues to harden its firewall platform with a secure-by-design approach. Specifically, features are containerized, and integrity checks on critical OS files use mathematical checksums—any mismatch triggers an alert. Consequently, monitoring teams can swiftly identify potential compromises and react accordingly.
Availability
Customers can download and deploy this update manually on any Sophos Firewall with a valid license.
For more on Sophos’s Middle East strategy, check out our previous coverage:
Sophos Announces Intent to Expand Middle East Operations with New Data Center in the UAE
Logical data management is revolutionizing EV production in the UAE by replacing slow, siloed systems with a virtualized data layer. Consequently, manufacturers like Seres report an 88% reduction in data delivery time, empowering on-shop-floor decision-making and accelerating Industry 4.0 initiatives.
The Rise of Logical Data Management in EV Manufacturing
Under the UAE’s Operation 300bn strategy, EV production faces surging data volumes. Traditional ETL pipelines buckle under real-time demands. By contrast, logical data management—often called data virtualization—creates a semantic layer that unifies multiple stores without replication. This approach slashes latency, reduces storage overhead, and accelerates analytics across design, production, and operations.
Limitations of Traditional Data Systems for EV Production
Legacy batch-driven data warehouses delay critical actions. In a high-stakes assembly line, even millisecond lags can compromise quality or safety. Moreover, centralized silos inflate storage and governance costs, especially under strict UAE data-sovereignty laws. Static architectures simply cannot keep pace with AI-driven analytics or digital twin simulations.
Adopting Logical Data Management for Real-Time Insights
Firstly, Logical data management platforms (Denodo) let shop-floor teams query live data instantly. For example, EV manufacturer Seres cut data delivery time by 88% and built 600+ self-service analytics apps. Furthermore, virtualized data services simplify compliance with role-based security, ensuring governed access to sensitive vehicle-PII under UAE regulations.
Implementation Strategy for Logical Data Management
1-Identify critical data sources affecting safety, cost, and sustainability
2-Pilot virtualization on latency-sensitive processes such as battery-pack assembly
3-Enforce governance policies to maintain data integrity and security
4-Train non-technical staff on user-friendly analytics tools
5-Monitor production metrics improvements to scale across the factory
Additionally, regular reviews help refine and scale each phase effectively.
Future Outlook for Logical Data Management in the UAE EV Market
Looking ahead, as the EV sector grows beyond the current US$1.8 billion market, data becomes as vital as any physical component. Therefore, by valuing data on par with hardware, UAE factories can slash defects, boost efficiency, and maintain a competitive advantage. Consequently, early adopters of logical data management will lead the next wave of automotive innovation.
For more on cutting-edge EV innovations in the region, check out our feature:
NIO’s Industry-Leading Innovations Set New Benchmarks for Intelligent Premium Electric Mobility
Metadome.ai Partners with VinFast to Redefine Automotive Retail, Design and Training with Groundbreaking AI and XR Solutions
Designing Hospitality Around the Modern Traveler’s Needs
Seasonal Staffing in UAE Hospitality: The Future is Flexible
-
Tech News12 months agoDenodo Bolsters Executive Team by Hiring Christophe Culine as its Chief Revenue Officer
-
Tech Interviews1 year agoNavigating the Cybersecurity Landscape in Hybrid Work Environments
-
VAR3 months agoMicrosoft Launches New Surface Copilot+ PCs for Business
-
Tech News1 year agoBrighton College Abu Dhabi and Brighton College Al Ain Donate 954 IT Devices in Support of ‘Donate Your Own Device’ Campaign
-
VAR11 months agoSamsung Galaxy Z Fold6 vs Google Pixel 9 Pro Fold: Clash Of The Folding Phenoms
-
Tech Features1 year agoThe Middle East to Lead with Next-generation Mission Critical Communication Advancement
-
Features1 year agoSecurity in the Cloud Age: Combating Risks with Hybrid Cloud Solutions
-
Editorial8 months agoCelebrating UAE National Day: A Legacy of Leadership and Technological Innovation