Smishing Triad Is Targeting Pakistan To Defraud Banking Customers At Scale

Resecurity researchers warn of a new activity of Smishing Triad, which has expanded its operations to Pakistan.

Estimating the global scale of threat actors’ activities, our analysts believe they send between 50,000–100,000 messages daily. To achieve this, they leverage stolen databases acquired from the Dark Web, which contain sensitive personal data of citizens including phone numbers. Pakistan, with a population of over 235.8 million, has experienced multiple data breaches in the first half of 2024, compromising the personal identifiable information (PII) of citizens. These records are then processed at scale using automation tools to distribute SMS spam for malicious and fraudulent purposes.

Resecurity observed multiple hosts used by attackers operating smishing kits targeting Pakistan’s postal providers, along with Correos, a state-owned postal provider in Spain, observed in previous episodes of Smishing Triad activity from July 2023. There were identified multiple domain names mapped to the same IP address 23[.]231[.]48[.]129:

• ep-gov-pkw[.]cfd
• ep-gov-ppk[.]cyou
• ep-gov-ppk[.]icu
• correosytelegrafos-civ[.]icu
• correos-es[.]cn

Smishing (SMS phishing) attacks can be deceptive and aim to trick individuals into revealing personal information or clicking on malicious links through text messages to compromise digital identity and steal payment data.

The full report is available here:

https://www.resecurity.com/blog/article/smishing-triad-is-targeting-pakistan-to-defraud-banking-customers-at-scale

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Smishing Triad)