{
  "name": "Silent Smishing: The Hidden Abuse of Cellular Router APIs",
  "slug": "silent-smishing-the-hidden-abuse-of-cellular-router-apis",
  "description": "This report analyzes a smishing campaign exploiting vulnerabilities in Milesight Industrial Cellular Routers to send malicious SMS messages. The attackers targeted primarily Belgian users by impersonating government services like CSAM and eBox. Over 18,000 vulnerable routers were identified globally, with at least 572 potentially exploitable. The campaign has been active since February 2022, affecting multiple European countries. The attackers used NameSilo for domain registration and Podaon SIA for hosting. The phishing infrastructure was linked to a threat actor cluster known as 'GroozaV2'. The report highlights the ongoing threat of smishing and the need for increased vigilance against unsolicited messages.",
  "published": "2025-10-01T06:00:39+00:00",
  "created_at": "2025-10-01T06:00:39+00:00",
  "modified_at": "2025-10-01T07:33:25+00:00",
  "created_at_opencti": "2025-10-01T06:00:39+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-10-01",
    "CVE-2023-43261",
    "api exploitation",
    "belgium",
    "cellular routers",
    "csam",
    "ebox",
    "phishing",
    "smishing",
    "vulnerability"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "212.162.155.45"
      },
      {
        "id": "",
        "name": "212.162.155.38"
      },
      {
        "id": "",
        "name": "212.162.155.202"
      },
      {
        "id": "",
        "name": "185.219.81.173"
      },
      {
        "id": "",
        "name": "103.246.144.60"
      },
      {
        "id": "",
        "name": "www.stassa.pt"
      },
      {
        "id": "",
        "name": "www.post-israel-online-service-8327328982392.opensuc.com"
      },
      {
        "id": "",
        "name": "www.netflix-online-service-n26382932.duckdns.org"
      },
      {
        "id": "",
        "name": "www.mail.klentbeposting.duckdns.org"
      },
      {
        "id": "",
        "name": "www.autentifuturo.pt"
      },
      {
        "id": "",
        "name": "www.aeoj.org"
      },
      {
        "id": "",
        "name": "www.afpsat.pt"
      },
      {
        "id": "",
        "name": "https://yuhz.confeciona.com/"
      },
      {
        "id": "",
        "name": "https://www.stassa.pt/wp-mail/"
      },
      {
        "id": "",
        "name": "https://www.afpsat.pt/cbb/index.php"
      },
      {
        "id": "",
        "name": "https://www.afpsat.pt/cbb/"
      },
      {
        "id": "",
        "name": "https://www.aeoj.org/mail/"
      },
      {
        "id": "",
        "name": "https://weaving.pt/data/"
      },
      {
        "id": "",
        "name": "https://vortica.net/mail/"
      },
      {
        "id": "",
        "name": "https://vmaxmagazin.hu/wp-mail/"
      },
      {
        "id": "",
        "name": "https://valeriatari.com/mytv/"
      },
      {
        "id": "",
        "name": "https://urls.fr/rUbDjo"
      },
      {
        "id": "",
        "name": "https://urlocalartist.pt/mit/"
      },
      {
        "id": "",
        "name": "https://thewondersmx.com/mail/"
      },
      {
        "id": "",
        "name": "https://torvi.pt/Backup/"
      },
      {
        "id": "",
        "name": "https://sv-weebly-manage.solarflevoland.nl/app/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.solarflevoland.nl/wix/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.olekgs.nl/en/home/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.ogveranda.com/wix/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.jetperformance.nl/wix/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.hospackfarma.nl/wix/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.firstresponder.nl/wix/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.eco-fin-service.it/wix/verification.php"
      },
      {
        "id": "",
        "name": "https://sv-management.aaltink.com/wix/verification.php"
      },
      {
        "id": "",
        "name": "https://superluckbet.com/bonus/"
      },
      {
        "id": "",
        "name": "https://sites-leiria.pt/financas/data/"
      },
      {
        "id": "",
        "name": "https://sites-leiria.pt/es/"
      },
      {
        "id": "",
        "name": "https://shf.com.pt/mail/"
      },
      {
        "id": "",
        "name": "https://service-interbancaire.page.dev"
      },
      {
        "id": "",
        "name": "https://shaliyah.co.za/backup/"
      },
      {
        "id": "",
        "name": "https://sercicio.paypl.studiolegaleflm.it/ppl-it/mark.php"
      },
      {
        "id": "",
        "name": "https://sanremomotors.co.za/wp-mail/"
      },
      {
        "id": "",
        "name": "https://scvidros.com.br/mail/"
      },
      {
        "id": "",
        "name": "https://scmalmodovar.pt/mail/"
      },
      {
        "id": "",
        "name": "https://restaurantefialho.pt/mail/"
      },
      {
        "id": "",
        "name": "https://raiugarts.com/mail/"
      },
      {
        "id": "",
        "name": "https://paixaobaptista.pt/data/"
      },
      {
        "id": "",
        "name": "https://nookbees.com/mail/"
      },
      {
        "id": "",
        "name": "https://naprakeszingatlan.hu/wp-mail/"
      },
      {
        "id": "",
        "name": "https://nwminingindaba.co.za/Kunden/"
      },
      {
        "id": "",
        "name": "https://mr-bitcoin.ch/mail/"
      },
      {
        "id": "",
        "name": "https://moqvk9zc.dreamwp.com/cr.php"
      },
      {
        "id": "",
        "name": "https://moqvk9zc.dreamwp.com/lo_gin/"
      },
      {
        "id": "",
        "name": "https://mikro.pt/kund/"
      },
      {
        "id": "",
        "name": "https://metodorsame.sinistraperisraele.com/ppl-it/mark.php"
      },
      {
        "id": "",
        "name": "https://mcaluminios.pt/refresh/"
      },
      {
        "id": "",
        "name": "https://marcioimoveis.pt/mit/"
      },
      {
        "id": "",
        "name": "https://marketexpresso.site/admin/"
      },
      {
        "id": "",
        "name": "https://luis.com.ve/mail/"
      },
      {
        "id": "",
        "name": "https://lp.washrocks.com/static/auth/en/verification.php"
      },
      {
        "id": "",
        "name": "https://jnsi.xyz/IT/"
      },
      {
        "id": "",
        "name": "https://jnsi.xyz"
      },
      {
        "id": "",
        "name": "https://ilustremotivo.com/data/"
      },
      {
        "id": "",
        "name": "https://ilustremotivo.com/mail/"
      },
      {
        "id": "",
        "name": "https://ilkeevingencel.com/app/"
      },
      {
        "id": "",
        "name": "https://hotm.art/HUDL28128"
      },
      {
        "id": "",
        "name": "https://guvenisi.com/js/cform/"
      },
      {
        "id": "",
        "name": "https://grupo-sk.com/mail/"
      },
      {
        "id": "",
        "name": "https://gfc-angola.com/mail/"
      },
      {
        "id": "",
        "name": "https://graficateke.com.br/mail/"
      },
      {
        "id": "",
        "name": "https://gelalentejo.com/mail/"
      },
      {
        "id": "",
        "name": "https://fixus.co.ao/mail/"
      },
      {
        "id": "",
        "name": "https://faberkit.pt/Backup/"
      },
      {
        "id": "",
        "name": "https://edizhoca.com/wp-backup/"
      },
      {
        "id": "",
        "name": "https://ekademies.com/wp-mail/"
      },
      {
        "id": "",
        "name": "https://edificiomallorca.com/data/"
      },
      {
        "id": "",
        "name": "https://ebox.terugbetaling.online/index.html.code="
      },
      {
        "id": "",
        "name": "https://ebox.dlogin.info"
      },
      {
        "id": "",
        "name": "https://ebox.csam-trust.xyz/?code="
      },
      {
        "id": "",
        "name": "https://ebox.amltrust.cash/?code="
      },
      {
        "id": "",
        "name": "https://dynpyads.com/backup/"
      },
      {
        "id": "",
        "name": "https://dpd-de.eyo-copter.com/pdpde/verification.php"
      },
      {
        "id": "",
        "name": "https://dewa-ae.mandegroupeinternational.org/gov/verification.php"
      },
      {
        "id": "",
        "name": "https://devwrapi.washrocks.com/home/verification.php"
      },
      {
        "id": "",
        "name": "https://devwrapi.washrocks.com/auth/en/verification.php"
      },
      {
        "id": "",
        "name": "https://criamoda.com/mail/"
      },
      {
        "id": "",
        "name": "https://crediadvisor.pt/inicio/"
      },
      {
        "id": "",
        "name": "https://creativetrendwatcher.be/mail/"
      },
      {
        "id": "",
        "name": "https://crazybubble.pt/mail/"
      },
      {
        "id": "",
        "name": "https://crazybubble.pt/data/"
      },
      {
        "id": "",
        "name": "https://coureladozambujeiro.com/wp-mail/"
      },
      {
        "id": "",
        "name": "https://chissema.com/backup/"
      },
      {
        "id": "",
        "name": "https://ccjc.pt/info/"
      },
      {
        "id": "",
        "name": "https://carloscunhayoga.com/Backup/index.php"
      },
      {
        "id": "",
        "name": "https://carloscunhayoga.com/Backup/"
      },
      {
        "id": "",
        "name": "https://canreisgroup.com.tr/backup/"
      },
      {
        "id": "",
        "name": "https://candperdizes.com/mail/"
      },
      {
        "id": "",
        "name": "https://bzss.pt/mail/"
      },
      {
        "id": "",
        "name": "https://bzss.pt/cbb/"
      },
      {
        "id": "",
        "name": "https://bluesign.pt/mail/"
      },
      {
        "id": "",
        "name": "https://bluesign.pt/kund/"
      },
      {
        "id": "",
        "name": "https://blackcargo.pt/Backup/"
      },
      {
        "id": "",
        "name": "https://awladlktoccyat.ortomanalessia.com/ppl-it/mark.php"
      },
      {
        "id": "",
        "name": "https://avrasyaproje.com.tr/backup/"
      },
      {
        "id": "",
        "name": "https://auth-simply.grupositel.com/simply/mark.php"
      },
      {
        "id": "",
        "name": "https://auth-billing-smp.grupositel.com/simply/mark.php"
      },
      {
        "id": "",
        "name": "https://ateci.pt/Backup/"
      },
      {
        "id": "",
        "name": "https://assurancemaladie-renouvellement.info"
      },
      {
        "id": "",
        "name": "https://api.solarflevoland.nl/system_web/verification.php"
      },
      {
        "id": "",
        "name": "https://aojdy5ex.dreamwp.com/wp-admin/css/colors/HOooo.php"
      },
      {
        "id": "",
        "name": "https://alojagora.com/mail/"
      },
      {
        "id": "",
        "name": "https://alpyateknoloji.com/wp-backup/"
      },
      {
        "id": "",
        "name": "https://alkodieshop.gr/up//"
      },
      {
        "id": "",
        "name": "https://alkodieshop.gr/up/"
      },
      {
        "id": "",
        "name": "https://alkodi.gr/kund/"
      },
      {
        "id": "",
        "name": "https://alkodi.gr/backup/"
      },
      {
        "id": "",
        "name": "https://alexismaidana.com.ar/padron/"
      },
      {
        "id": "",
        "name": "https://airprint.gr/kund/"
      },
      {
        "id": "",
        "name": "https://acountinteruption.diprimiocostruzioni.it/ppl-it/mark.php"
      },
      {
        "id": "",
        "name": "https://af-itsolutions.pt/mail/"
      },
      {
        "id": "",
        "name": "https://aefpceup.pt/mail/"
      },
      {
        "id": "",
        "name": "https://wheelmedia.hu/wheelmediahu/"
      },
      {
        "id": "",
        "name": "https://www.autentifuturo.pt/mail/"
      },
      {
        "id": "",
        "name": "https://outprint.pt/dk/"
      },
      {
        "id": "",
        "name": "https://afpsat.pt/cbb/"
      },
      {
        "id": "",
        "name": "https://luiscarmocx.com/Back/"
      },
      {
        "id": "",
        "name": "yuhz.confeciona.com"
      },
      {
        "id": "",
        "name": "telianorge.onthewifi.com"
      },
      {
        "id": "",
        "name": "telianorge.duckdns.org"
      },
      {
        "id": "",
        "name": "telia-online-service-n382322323.ydns.eu"
      },
      {
        "id": "",
        "name": "sv-weebly-manage.solarflevoland.nl"
      },
      {
        "id": "",
        "name": "sv-management.solarflevoland.nl"
      },
      {
        "id": "",
        "name": "sv-management.ogveranda.com"
      },
      {
        "id": "",
        "name": "sv-management.olekgs.nl"
      },
      {
        "id": "",
        "name": "sv-management.jetperformance.nl"
      },
      {
        "id": "",
        "name": "sv-management.hospackfarma.nl"
      },
      {
        "id": "",
        "name": "sv-management.firstresponder.nl"
      },
      {
        "id": "",
        "name": "sv-management.eco-fin-service.it"
      },
      {
        "id": "",
        "name": "sv-management.aaltink.com"
      },
      {
        "id": "",
        "name": "spotify-online-s.ydns.eu"
      },
      {
        "id": "",
        "name": "service-interbancaire.page.dev"
      },
      {
        "id": "",
        "name": "sercicio.paypl.studiolegaleflm.it"
      },
      {
        "id": "",
        "name": "qynyuonline-telias-n2689829292.jnsi.xyz"
      },
      {
        "id": "",
        "name": "postcanada.booking-review-n32789283.duckdns.org"
      },
      {
        "id": "",
        "name": "online-mobilepey-n2637832h23.beju.info"
      },
      {
        "id": "",
        "name": "online-telias-n2689829292.jnsi.xyz"
      },
      {
        "id": "",
        "name": "my.ebox.help"
      },
      {
        "id": "",
        "name": "moqvk9zc.dreamwp.com"
      },
      {
        "id": "",
        "name": "metodorsame.sinistraperisraele.com"
      },
      {
        "id": "",
        "name": "lp.washrocks.com"
      },
      {
        "id": "",
        "name": "login.csam-terugbetaling.work"
      },
      {
        "id": "",
        "name": "kundlingpostbe.bounceme.net"
      },
      {
        "id": "",
        "name": "ebox.terugbetaling.online"
      },
      {
        "id": "",
        "name": "ebox.e-login.xyz"
      },
      {
        "id": "",
        "name": "ebox.plus-billing.sbs"
      },
      {
        "id": "",
        "name": "ebox.dlogin.info"
      },
      {
        "id": "",
        "name": "ebox.csam-trust.xyz"
      },
      {
        "id": "",
        "name": "ebox.c-sam.xyz"
      },
      {
        "id": "",
        "name": "ebox.amltrust.cash"
      },
      {
        "id": "",
        "name": "dpd-de.eyo-copter.com"
      },
      {
        "id": "",
        "name": "disney.plus-billings.sbs"
      },
      {
        "id": "",
        "name": "disney.plus-billing.sbs"
      },
      {
        "id": "",
        "name": "dewa-ae.mandegroupeinternational.org"
      },
      {
        "id": "",
        "name": "csam.ebox-login.xyz"
      },
      {
        "id": "",
        "name": "devwrapi.washrocks.com"
      },
      {
        "id": "",
        "name": "csam.e-box.help"
      },
      {
        "id": "",
        "name": "booking-confimraition-28732893.duckdns.org"
      },
      {
        "id": "",
        "name": "awladlktoccyat.ortomanalessia.com"
      },
      {
        "id": "",
        "name": "auth-simply.grupositel.com"
      },
      {
        "id": "",
        "name": "auth-billing-smp.grupositel.com"
      },
      {
        "id": "",
        "name": "api.solarflevoland.nl"
      },
      {
        "id": "",
        "name": "aojdy5ex.dreamwp.com"
      },
      {
        "id": "",
        "name": "acountinteruption.diprimiocostruzioni.it"
      },
      {
        "id": "",
        "name": "wheelmedia.hu"
      },
      {
        "id": "",
        "name": "weaving.pt"
      },
      {
        "id": "",
        "name": "vortica.net"
      },
      {
        "id": "",
        "name": "vmaxmagazin.hu"
      },
      {
        "id": "",
        "name": "valeriatari.com"
      },
      {
        "id": "",
        "name": "urlocalartist.pt"
      },
      {
        "id": "",
        "name": "torvi.pt"
      },
      {
        "id": "",
        "name": "thewondersmx.com"
      },
      {
        "id": "",
        "name": "sites-leiria.pt"
      },
      {
        "id": "",
        "name": "superluckbet.com"
      },
      {
        "id": "",
        "name": "shaliyah.co.za"
      },
      {
        "id": "",
        "name": "scvidros.com.br"
      },
      {
        "id": "",
        "name": "scmalmodovar.pt"
      },
      {
        "id": "",
        "name": "sanremomotors.co.za"
      },
      {
        "id": "",
        "name": "raiugarts.com"
      },
      {
        "id": "",
        "name": "restaurantefialho.pt"
      },
      {
        "id": "",
        "name": "paixaobaptista.pt"
      },
      {
        "id": "",
        "name": "opposition.online"
      },
      {
        "id": "",
        "name": "outprint.pt"
      },
      {
        "id": "",
        "name": "nwminingindaba.co.za"
      },
      {
        "id": "",
        "name": "naprakeszingatlan.hu"
      },
      {
        "id": "",
        "name": "nookbees.com"
      },
      {
        "id": "",
        "name": "mr-bitcoin.ch"
      },
      {
        "id": "",
        "name": "mikro.pt"
      },
      {
        "id": "",
        "name": "mcaluminios.pt"
      },
      {
        "id": "",
        "name": "marketexpresso.site"
      },
      {
        "id": "",
        "name": "luiscarmocx.com"
      }
    ],
    "malware": [
      {
        "id": "ded39dd5-e200-4f63-bd07-a38c4bf2116e",
        "name": "Grooza",
        "slug": "grooza"
      }
    ],
    "intrusion_sets": [
      {
        "id": "5499374b-7e06-4815-9f52-508e78e69db9",
        "name": "GroozaV2",
        "slug": "groozav2"
      }
    ],
    "attack_patterns": [
      {
        "id": "21fd9920-9bc7-4ba5-8cdd-3022c0ef4e9d",
        "name": "T1584.001"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2023-43261"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Hungary"
      },
      {
        "id": "",
        "name": "Sweden"
      },
      {
        "id": "",
        "name": "Belgium"
      },
      {
        "id": "",
        "name": "Portugal"
      },
      {
        "id": "",
        "name": "Norway"
      },
      {
        "id": "",
        "name": "Italy"
      },
      {
        "id": "",
        "name": "France"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://blog.sekoia.io/silent-smishing-the-hidden-abuse-of-cellular-router-apis/",
    "https://otx.alienvault.com/pulse/68dcdfa7bc8fcdf1e2eae202"
  ]
}