Critical Infrastructure Cybersecurity Solutions & Training

Between mid-2016 and 2017, a state-linked espionage group that FireEye tracked as APT33 sent spear-phishing emails to people whose work related to aviation, including at a Saudi conglomerate with aviation holdings. The emails were built around recruitment. They linked to files that displayed believable job descriptions, with links to genuine postings on employment websites, while carrying malicious code.

The group registered domains that imitated Saudi aviation companies and Western firms that support Saudi Arabia's military and commercial fleets. In May 2017 it used a lure advertising vacancies at a Saudi petrochemical company. FireEye also found links between the group and destructive wiper malware.

Most warnings about phishing describe pressure: an urgent invoice, a locked account, a demand from the boss. A recruitment approach works in the opposite register. It flatters. It arrives addressed to the person's expertise, references a role they are qualified for, and asks for nothing more than curiosity. The defenses people build against urgency simply do not engage.

It also reaches people in a private moment. An engineer weighing a job description is thinking about their career, not about their employer's security posture, and is likely to open the file on a personal device or outside working hours, away from the colleagues they might otherwise have asked. The most valuable staff in critical infrastructure are also the most courted, and the attack was dressed as exactly that.

Attackers start with reconnaissance, and Blackbait does the same. It runs OSINT reconnaissance on the engineers and operators you select, builds an exposure profile showing what an outsider can learn about each of them, and generates scenarios from that material instead of fixed templates.

The lookalike domains and themed lures used here can be rehearsed safely. Whitebait's Delivery Fabric provides a curated pool of simulation domains, and campaigns can run in Arabic and English with difficulty raised as resilience grows. Codex covers the pressure and reward cues that make a job offer or an urgent partner request persuasive.

Odin scores people with access to operational systems by role criticality and escalates automatically when their risk crosses a critical threshold. For operators that must keep data under national jurisdiction, Fraus runs fully on-premise with native Arabic, and it is UAE IA compliant.