Full Report
This blog documents Group-IB’s research into an SMS phishing campaign targeting Serbian road users through the impersonation of Serbia's state road authority, and how it can be linked to both Darcula and Phoenix PhaaS platforms with victims across the globe.
Analysis Summary
# Tool/Technique: Darcula & Phoenix PhaaS Platforms
## Overview
This entry covers an SMS phishing (Smishing) campaign targeting Serbian road users. The campaign utilizes "Phishing-as-a-Service" (PhaaS) platforms, specifically **Darcula** and **Phoenix**, to impersonate the state road authority of Serbia (*Putevi Srbije*). The goal is to deceive victims into paying fraudulent traffic fines, thereby harvesting their sensitive banking and payment card information.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Phishing Frameworks
- **Platform:** Cross-platform (Web-based; targeting mobile users via SMS/iMessage)
- **Capabilities:** High-fidelity brand impersonation, automated SMS distribution, credential harvesting, payment card skimming, and Telegram-based data exfiltration.
- **First Seen:** Darcula (detected mid-2023); Phoenix (active 2024).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Service]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery] (Browser/Device fingerprinting)
- **[TA0010 - Exfiltration]**
- [T1567 - Exfiltration Over Web Service] (Telegram API exfiltration)
- **[TA0001 - Reconnaissance]**
- [T1589 - Gather Victim Identity Information]
## Functionality
### Core Capabilities
- **Brand Impersonation:** Sophisticated templates that mimic official government portals (Putevi Srbije) using high-quality logos and local language.
- **Credential & PII Harvesting:** Web forms designed to capture full names, addresses, phone numbers, and CC/CVV data.
- **Geographic Targeting:** Specifically tailored to Serbian regional users, though the frameworks are used globally for various brands.
### Advanced Features
- **Sophisticated PhaaS Infrastructure:** Use of Docker containers (in Darcula's case) to deploy phishing sites rapidly.
- **Bypassing Filters:** Use of iMessage and RCS instead of traditional SMS to bypass carrier-based spam filters.
- **Telegram Bot Integration:** Real-time exfiltration of stolen data to threat actor-controlled Telegram channels.
## Indicators of Compromise
### Network Indicators (Defanged)
**Darcula-linked Domains:**
- putevs[.]cc
- putevie-srbije[.]help
- putevti-srbije[.]help
- putevii-srbije[.]help
- putevi-srbile[.]help
- putevi-srbijezt[.]homes
- puteva[.]cc
**Phoenix-linked Domains:**
- putevis-srbbije[.]top
- putevisteetc[.]cc
- putevi-srbije[.]icu
- putevismetc[.]cc
- putevi-srbijebc[.]homes
- putevi-srbijeba[.]homes
- putevi-srbijeah[.]homes
- putevi-srbijeaf[.]help
- putevissdeoetc[.]top
- putevi-srbtrfije[.]com
- putevi-srbbqfije[.]com
- putevi-srbijeag[.]help
- putevi-srbijeah[.]help
- putevi-srbije.gbgwsq[.]homes
- putevi-srbije.xkuckx[.]homes
- putevis-srbiiossje[.]top
## Associated Threat Actors
- **Darcula:** A large-scale PhaaS provider first documented by security researchers in early 2024, known for using modern web technologies like React and Vite.
- **Phoenix:** A competing or related PhaaS platform specializing in international brand impersonation.
## Detection Methods
- **Behavioral Detection:** Monitoring for high volumes of SMS/iMessage traffic containing shortened URLs or suspicious TLDs (.top, .homes, .cc).
- **Network Telemetry:** Identifying outbound traffic to known Telegram Bot API endpoints originating from web servers hosting phishing kits.
- **Brand Monitoring:** Proactive scanning for newly registered domains containing keywords like "putevi" (roads) or "srbije" (Serbia).
## Mitigation Strategies
- **User Awareness:** Educating citizens that government authorities typically do not solicit fine payments via SMS links.
- **MFA:** Encouraging the use of hardware keys or app-based TOTP, as these are more resilient to basic phishing than SMS codes.
- **Domain Blocking:** Implementing DNS filtering to block access to the identified malicious TLDs and specific IOCs.
- **Browser Protection:** Utilizing web browsers with built-in anti-phishing protections (Safe Browsing).
## Related Tools/Techniques
- **LabHost:** Another major PhaaS platform recently disrupted by law enforcement.
- **RCS/iMessage Phishing:** The shift from traditional SMS to encrypted messaging protocols to avoid detection.
- **Adversary-in-the-Middle (AiTM):** While this campaign focuses on direct theft, these platforms are evolving toward AiTM to bypass 2FA.