"Don't feed the toll troll": New threat actor (IMP-1G) engaging in SMS phishing activities, targeting US and Canadian public services. 100+ IOFA domains discovered, with only 10% known to authorities.
Essential information
- Published
- 11/10/2024 07:58
- Modified
- 11/10/2024 08:13
- Tags
- 2024-10-11 government services identity theft iofa domains public utilities smishing sms phishing toll fraud
- Related entities
- 84 observables, 1 intrusion sets (apt), 9 techniques (mitre), 6 others
Description
A new threat actor, designated as IMP-1G, has been discovered engaging in SMS phishing activities targeting US and Canadian public services. The campaign focuses on toll roads, mass transit systems, postal services, court payments, municipal payments, and state-owned utility companies across multiple states and provinces. Over 100 Indicator of Future Attack (IOFA) domains have been identified, with only 10% known to authorities. The phishing domains impersonate government payment portals to steal credit card information and personal data. The threat actor also targets financial institutions and cryptocurrency users with similar tactics. Law enforcement agencies have seized some domains, but the majority remain active.