Full Report
Group-IB researchers expose a large-scale smishing and phishing operation impersonating 260+ brands across 72 countries, using fake Cloudflare error pages, geofencing, and encrypted WebSocket channels for real-time credit card theft.
Analysis Summary
# Incident Report: Large-Scale Smishing & Phishing Operation via Encrypted WebSockets
## Executive Summary
Group-IB researchers identified a sophisticated, global smishing and phishing campaign targeting over 260 brands across 72 countries. The operation utilized advanced evasion techniques, including geofencing and fake Cloudflare error pages, to harvest credit card data in real-time. By leveraging encrypted WebSocket channels for data exfiltration, the attackers successfully bypassed traditional signature-based detection systems.
## Incident Details
- **Discovery Date:** Late 2023/Early 2024 (Based on campaign reporting)
- **Incident Date:** Ongoing (Reported 2024)
- **Affected Organization:** 260+ international brands (Finance, Logistics, E-commerce)
- **Sector:** Multisectoral (primarily Banking and Retail)
- **Geography:** 72 Countries (Global)
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing campaign
- **Vector:** SMS Phishing (Smishing)
- **Details:** Attackers sent SMS messages to victims containing shortened or brand-impersonating URLs, often regarding "failed deliveries" or "account verification."
### Lateral Movement
- **N/A:** As this is a phishing operation against external customers rather than an internal network breach, traditional lateral movement was not observed. However, attackers moved vertically from initial link clicks to harvesting secondary authentication data (OTP).
### Data Exfiltration/Impact
- **Details:** Real-time theft of Credit Card Numbers (PAN), Expiry Dates, CVV codes, and potentially One-Time Passwords (OTPs) through interactive phishing panels.
### Detection & Response
- **Discovery:** Detected by Group-IB’s Digital Risk Protection and Threat Intelligence systems through infrastructure monitoring.
- **Response actions taken:** Threat intelligence shared with global partners; identification of command-and-control (C2) infrastructure; mapping of over 260 targeted brands.
## Attack Methodology
- **Initial Access:** Smishing (T1566.002) using malicious URLs sent via SMS.
- **Persistence:** Not applicable for the end-user, but infrastructure persistence was maintained via bulk-registered domains.
- **Privilege Escalation:** N/A.
- **Defense Evasion:** Use of geofencing (filtering by IP/User-Agent) and fake Cloudflare "504 Gateway Timeout" or "404 Not Found" pages to hide malicious content from researchers and automated scanners.
- **Credential Access:** Real-time phishing forms designed to steal payment card data and OTPs.
- **Discovery:** Client-side fingerprinting (T1659) to ensure the victim is using a mobile device and is located in the target country.
- **Lateral Movement:** N/A.
- **Collection:** Automated scripts to capture data entered into web forms.
- **Exfiltration:** Encrypted WebSocket protocol (T1071.001) over TLS, making the traffic appear as legitimate web activity.
- **Impact:** Financial fraud and unauthorized transactions against victims’ bank accounts.
## Impact Assessment
- **Financial:** High potential for direct financial loss to consumers and increased fraud reimbursement costs for banks.
- **Data Breach:** Massive volume of PII and PCI-DSS data (credit card details) across 72 countries.
- **Operational:** High volume of fraudulent transactions requiring manual intervention by bank fraud departments.
- **Reputational:** Damage to the 260+ impersonated brands whose customers were targeted.
## Indicators of Compromise
- **Network Indicators:**
- 47.82.154[.]2
- 43.165.6[.]36
- 43.159.168[.]186
- 154.81.166[.]17
- 43.162.84[.]202
- 8.222.134[.]149
- 45.135.162[.]90
- **Behavioral Indicators:**
- Inbound connections to WebSocket endpoints (`/socket.io/`) from unusual domains.
- Redirect loops based on geographic IP location.
- Pages displaying Cloudflare error messages that do not originate from Cloudflare IP space.
## Response Actions
- **Containment:** Domain takedowns requested for identified phishing URLs.
- **Eradication:** Identification and blacklisting of backend C2 servers hosted on Tencent/Alibaba infrastructure.
- **Recovery:** Public awareness campaigns by affected brands to warn customers of smishing tactics.
## Lessons Learned
- **Evasion Evolution:** Attackers are increasingly using "legitimate" error page templates to hide from automated crawlers.
- **Protocol Shifts:** The shift from standard POST requests to WebSockets for exfiltration effectively bypasses many legacy WAFs (Web Application Firewalls).
- **Geographic Precision:** Geofencing is becoming a standard requirement for high-conversion phishing campaigns to filter out security analysts.
## Recommendations
- **For Organizations:** Monitor for unauthorized use of brand logos and domains using Digital Risk Protection (DRP) services.
- **For Network Defense:** Implement inspection for WebSocket traffic and monitor for high-frequency connections to suspicious TLDs (.ink, .bond, .top).
- **For Consumers:** Educate users never to provide payment details via links received through SMS; use official mobile applications or direct website entry instead.