GINC-APT-0947 · Targeted, sponsor unknown

Smishing Triad

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
China(high confidence)
Sources
3 sources carry it
Identifier
GINC-APT-0947 · smishing-triad

What it is

The Smishing Triad is a Chinese-speaking threat group known for targeting postal services and their customers globally through smishing campaigns. They leverage compromised Apple iMessage accounts to send fraudulent messages warning of undeliverable packages, aiming to collect personally identifying information and payment credentials. The group offers smishing kits for sale on platforms like Telegram, enabling other cybercriminals to launch independent attacks. "Smishing Triad" has expanded its operations to target UAE citizens, using geo-filtering to focus on victims in the Emirates.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • Cyber Eye RAT
  • CyberGate

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de