Skip to main content
Mallory
Back to threat actors
🇨🇳 CN

Outsider Enterprise

Also known asoutsider_enterprise

Outsider Enterprise is an alleged China-based cybercrime network that Google says operates on Telegram and supplies phishing tools and infrastructure to other fraudsters. According to the provided reporting, Google sued the group, alleging it used AI tools, including Gemini, to help generate code for phishing websites and related scam infrastructure and to accelerate phishing content creation at scale. Google linked the operation to more than 9,000 fake or fraudulent websites and more than 1 million fraudulent or malicious URLs, and said it was associated with millions of scam text messages, including roughly 2.5 million messages sent during a two-week period in May. Android users reportedly flagged 55,000 spam texts tied to the operation in that same period. The phishing kits supported large-scale smishing campaigns and fake websites designed to steal passwords, login credentials, payment card data, and other sensitive information. Reported lures included fake package delivery alerts, banking notifications, and account security warnings, and the campaigns impersonated technology companies, mobile carriers, financial institutions, package delivery services, Google, and other trusted brands. Google said the operation affected hundreds of thousands of victims and caused losses in the millions of dollars. No additional aliases or sub-groups are identified in the provided content.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Banks
  • Software & Services
  • Telecommunication Services
  • Transportation

Where they're from

Attributed origin per open-source reporting.

  • CN
MITRE ATT&CK

Tradecraft

6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

6 of 15 tactics7 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1598
Phishing for Information
TA0042
Resource Development
1 technique
T1583
Acquire Infrastructure
TA0001
Initial Access
1 technique
T1566×2
Phishing
T1566.003×2
Spearphishing via Service
TA0005
Stealth
1 technique
T1036×2
Masquerading
TA0006
Credential Access
1 technique
T1056
Input Capture
TA0009
Collection
1 technique
T1056
Input Capture
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping6

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.