Smishing TriadThreat actor
The Smishing Triad is a Chinese-speaking threat group known for targeting postal services and their customers globally through smishing campaigns. They leverage compromised Apple iMessage accounts to send fraudulent messages warning of undeliverable packages, aiming to collect personally identifying information and payment credentials.From MISP Galaxy
Last reported 1 month ago, by Group-IB2 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1027.013Encrypted/Encoded File
“T1027.013 Encrypted/Encoded File”
- T1041Exfiltration Over C2 Channel
“T1041 Exfiltration Over C2 Channel”
- T1056Input Capture
“T1056.003 Input Capture: Web Portal Capture”
- T1056.003Web Portal Capture
“T1056.003 Input Capture: Web Portal Capture”
- T1071.001Web Protocols
“T1071.001 Web Protocols”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“Drained: Inside the Smishing Triad’s Phishing Cockpit”
-
The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action“Inside the Smishing Triad’s Phishing Cockpit ”.”
Indicators in its reports
named in the reports above- obfuscator[.]ioin 2 reports
- javascript-obfuscator[.]ioin 2 reports
- httpbin[.]orgin 1 report
- window[.]topin 1 report
- trsb[.]topin 1 report
- date[.]nowin 1 report
- workercrypto[.]postin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.