A sophisticated phishing operation targeting Kuwait’s key industries has come to light, thanks to a unique flaw in its operational security: the repeated use of SSH authentication keys across multiple attack servers.
Active as of May 2025, this campaign has set up over 100 deceptive domains designed to steal login credentials by mimicking trusted Kuwaiti companies in sectors like fisheries, telecommunications, and insurance.
In contrast to conventional methods like typosquatting, the attackers have created domain names inspired by local brands, using transliterations and broad terms to evade detection by traditional monitoring systems.
The phishing setup operates on multiple servers linked to the following IP addresses: 78.153.136[.]29, 134.124.92[.]70, and 138.124.78[.]35, all hosted within the network of Aeza International Ltd (AS210644).
These servers are highly versatile, running numerous domains targeting various industries simultaneously to increase their impact.
A large number of these domains are specifically designed to impersonate the National Fishing Company of Kuwait, with examples including alwattnya[.]com, wtanaya[.]com, elwattanya1[.]com, and alwattnia[.]com.
The fraudulent websites are expertly crafted to mirror the look of real company pages, complete with product listings and shopping cart functionalities.
Hunt.io researchers uncovered the operation after receiving reports of ongoing phishing efforts aimed at Kuwaiti businesses. Their investigation confirmed that over 50% of the 230+ domains were focused on impersonating the National Fishing Company of Kuwait.
Deceptive Webpages Replicating the National Fishing Company (Source – Hunt.io)
The fraudulent websites closely imitated the layout and design of authentic pages, with one such page posing as the National Fishing Company’s online store.
Phishing Infrastructure and Key Discovery
A pivotal discovery that unraveled the scope of this operation was the repeated use of SSH authentication keys throughout the phishing network.
Two specific SSH key fingerprints were deployed across a series of servers, generating a unique signature that helped researchers connect various phishing domains that initially seemed unrelated.
This flaw in operational security provided a clear avenue for cybersecurity teams to track the full extent of the attack, even as the campaign used diverse domain names and hosted content across different platforms.
The reuse of these SSH keys highlights how even sophisticated attackers can inadvertently leave detectable patterns in their infrastructure by cutting corners on security practices.
Rather than creating unique keys for each new server, the attackers reused the same authentication keys across multiple systems, providing a critical weak point that was exploited by researchers.
SSH Key Pivot on 138.124.92[.]70 (Source – Hunt.io)
Hunt.io researchers leveraged a unique method to map out the phishing network by pivoting across the infrastructure, with a key focus on the server at 138.124.92[.]70.
By utilizing SSH key fingerprinting, security experts can trace and link associated infrastructures, scanning for these distinctive key fingerprints within their network environments.
The recurring pattern of SSH key usage across Aeza International Ltd’s ASN offers valuable insight for threat detection teams.
To aid in identifying potential malware activity within this ASN, security teams can run the following query:
sql
SELECT ip, hostname, malware.name
FROM malware
WHERE asn.number == ‘210644’
GROUP BY ip, hostname, malware.name
The scope of the campaign extended beyond the fisheries sector, also including domains designed to impersonate Zain, a leading Kuwaiti telecommunications company.
One such domain, zain-kw[.]pro, hosted a deceptive mobile payment portal intended to capture users’ phone numbers and payment information.
Impersonated Zain Account Page (Source – Hunt.io)
The fraudulent Zain account page was expertly designed to replicate the legitimate service, making it especially challenging to detect on mobile platforms where phishing clues are less visible.
This campaign illustrates the evolving tactics of cybercriminals, who adapt their methods while sometimes leaving behind vital operational footprints.
The use of varied domain strategies, multi-sector targeting, and mobile payment traps reveals a highly advanced social engineering strategy. At the same time, the repeated SSH key usage offers cybersecurity professionals a critical lead for identifying and countering the attack.
