Bot Swarm: Attacks From Middle East & Africa Are Notably Up

The number of reported bot attacks originating from the Middle East and Africa increased over the past year, totaling 34% of all attacks reported in a survey of US and UK businesses.

According to research by Netacea, 21% of reported bot attacks originated from the Middle East and 13% from Africa over the past 12 months.

Cyril Noel Tagoe, principal security researcher at Netacea, says the aim of a bot attack is most commonly to get access to accounts for streaming services; to steal and sell gift cards at a reduced rate; or to purchase limited or high-demand goods, such as event tickets (or sneakers).

The attacks can often be conducted using open source software such as OpenBullet and require only a configuration file to determine the target, Tagoe says.

The research showed that e-commerce was the most-attacked sector, with 28% of online retailers reporting bot attacks originating from Middle East last year. After e-commerce, telecommunications (22%), financial services (20%), and travel and online gaming (both 18%) were the other verticals, most notably reporting attacks from the Middle East.

For attacks originating from Africa, e-commerce (16%) was the highest, followed by online gaming (15%) and financial services (13%).

Where Actually Are the Attackers?

In the research, statistics showed the percentage of bot attacks originating from the Middle East has gradually increased over the last three years, from 2% in 2020 to 13% in 2021 and 21% last year. In Africa, the number in 2022 slightly declined from a high of 16% in 2021, and 5% in 2020.

Tagoe admits that bots attacks may not always be genuinely from the country they seem to originate from, as whoever is conducing an attack will try and disguise where they are coming from using proxies and the like. But this is a takeaway for the region too. “There is infrastructure in the Middle East and Africa that has been compromised," he says, "and attackers elsewhere are rooting their attacks through that infrastructure, which is causing it to look like there's more attacks coming from there.“