Full Report
Group-IB exposes a Mexican PhaaS operation targeting over 20 financial institutions with live phishing, AI vishing, and mobile RAT capabilities.
Analysis Summary
# Threat Actor: Balonx (PhaaS Operator)
## Attribution & Identity
* **Actor Identification:** Balonx is a sophisticated Mexican-based Phishing-as-a-Service (PhaaS) operator.
* **Aliases:** Associated with the "CallFlow AI" vishing platform.
* **Known Associations:** The group operates as a provider for other cybercriminals, offering a comprehensive suite of tools for financial fraud. It is linked to Spanish-speaking underground communities.
## Activity Summary
Balonx has been active since at least 2019, but recent 2024 campaigns show a significant evolution in technical sophistication. The group provides a "live" phishing infrastructure that facilitates real-time interaction with victims to bypass Multi-Factor Authentication (MFA). Their latest operations involve a hybrid approach combining traditional phishing, AI-driven vishing (voice phishing), and the distribution of a custom Android Remote Access Trojan (RAT).
## Tactics, Techniques & Procedures
* **Live Phishing Panels:** Real-time interception of credentials and 2FA codes, allowing attackers to log in to victim accounts while the session is active.
* **AI Vishing (CallFlow):** Utilization of Large Language Models (LLMs) and synthetic voice generation (ElevenLabs) to automate fraudulent calls that sound like legitimate bank representatives.
* **Social Engineering:** Scaring victims with "unauthorized transaction" alerts to pressure them into downloading "security" apps.
* **Malware Distribution:** Deploying a custom Android RAT disguised as a "Bank Protection" app to intercept SMS and control devices.
* **Infrastructure Abuse:** Leveraging legitimate services like Telegram for C2 exfiltration, and Replit/OpenAI for script hosting and AI logic.
* **MITRE ATT&CK Mapping:**
* **T1566.002:** Phishing: Spearphishing Link
* **T1539:** Steal Web Session Cookie
* **T1041:** Exfiltration Over C2 Channel
* **T1633:** Mobile Adware/Spyware (Android RAT)
* **T1465:** Automated Communication (AI Vishing)
## Targeting
* **Sectors:** Primarily Financial Services and Banking.
* **Geography:** Mexico (Primary focus), with expanding reach into LATAM and Spanish-speaking regions.
* **Victims:** Over 20 financial institutions have been targeted. Specific victims are not named but include major retail banks in the Mexican region.
## Tools & Infrastructure
* **Malware Families:** A custom Android RAT (Package: `sacred.explosion`).
* **Vishing Platform:** "CallFlow AI" using FreePBX backend and SIP protocols.
* **C2 Infrastructure:**
* `196.251.84[.]11` (Android RAT C2)
* `85.31.235[.]109` (SIP Server)
* **Domains (Defanged):**
* `aclaraciones-digital[.]online`
* `soporte-aclaracion[.]xyz`
* `balonx[.]online`
* `callbalonx[.]info`
* `panelbalonxfs[.]xyz`
## Implications
Balonx represents a growing trend of "localized" PhaaS operators who customize their lures for specific regional cultures and languages. The integration of AI for vishing lowers the barrier to entry for low-skilled attackers, allowing for high-volume, highly convincing social engineering attacks that can bypass traditional voice-based security checks. Their transition from simple credential harvesting to full device compromise via Android RATs indicates a shift toward total account takeover and persistence.
## Mitigations
* **User Education:** Train customers to recognize that banks will never ask for the installation of "protection apps" via SMS or phone calls.
* **MFA Hardening:** Shift from SMS-based 2FA to hardware tokens or FIDO2-compliant security keys, as Balonx specifically targets SMS interception.
* **Device Security:** Implement Mobile Device Management (MDM) or Mobile Threat Defense (MTD) to detect the installation of side-loaded APKs.
* **Network Monitoring:** Block known C2 IPs and monitor for unusual SIP traffic patterns originating from user endpoints.
* **AI Detection:** Implement voice biometrics and "liveness" detection to identify synthetically generated voices in call centers.