A coordinated phishing campaign targeting Kuwait’s critical sectors has been exposed through a distinctive operational security lapse: the consistent reuse of SSH authentication keys across multiple attack servers. The campaign, which remains active as of May 2025, has deployed over 100 domains to harvest credentials through meticulously cloned login portals impersonating legitimate Kuwaiti businesses in the fisheries, telecommunications, and insurance sectors. The combination of diverse domain strategies, cross-sector targeting, and mobile payment lures demonstrates a sophisticated approach to social engineering, while the SSH key reuse provides defenders with a valuable detection opportunity. This operational security failure provided security teams with a reliable method to identify the full scope of the campaign despite its use of diverse domain naming conventions and hosting arrangements. Two specific SSH key fingerprints were repeatedly deployed across multiple servers, creating a distinctive signature that allowed researchers to link seemingly unrelated phishing domains. The phishing infrastructure spans multiple servers concentrated on IP addresses 78.153.136[.]29, 134.124.92[.]70, and 138.124.78[.]35, all hosted within Aeza International Ltd’s network (AS210644). The critical technical finding that exposed this operation was the consistent reuse of SSH authentication keys across the phishing infrastructure.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 16 May 2025 15:35:12 +0000