Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Phone Number Generator : Takes arguments for the Country Code and Area Code, as well as the length of the phone number. Uses the Python random module to generate a phone number of the given length. Phone Checker : This method checks a given phone number against the APILayer.com Number Verification API to check if the number is valid.
Attackers can use Xeon to send messages through multiple software-as-a-service (SaaS) providers using valid credentials for the service providers. There are no weaknesses on the service provider side that are leveraged for these attacks; rather, the tool uses legitimate APIs to enable bulk SMS spam attacks.
Due to federal regulations and related fees imposed by bulk SMS providers, threat actors are more likely to target accounts belonging to organizations that have already gone through this process than to make accounts independently, not to mention costs for message delivery as a separate financial burden.
Attackers can use Xeon to send messages through multiple software-as-a-service (SaaS) providers using valid credentials for the service providers. There are no weaknesses on the service provider side that are leveraged for these attacks; rather, the tool uses legitimate APIs to enable bulk SMS spam attacks.
Due to federal regulations and related fees imposed by bulk SMS providers, threat actors are more likely to target accounts belonging to organizations that have already gone through this process than to make accounts independently, not to mention costs for message delivery as a separate financial burden.
Attackers can use Xeon to send messages through multiple software-as-a-service (SaaS) providers using valid credentials for the service providers. There are no weaknesses on the service provider side that are leveraged for these attacks; rather, the tool uses legitimate APIs to enable bulk SMS spam attacks.
Due to federal regulations and related fees imposed by bulk SMS providers, threat actors are more likely to target accounts belonging to organizations that have already gone through this process than to make accounts independently, not to mention costs for message delivery as a separate financial burden.
Attackers can use Xeon to send messages through multiple software-as-a-service (SaaS) providers using valid credentials for the service providers. There are no weaknesses on the service provider side that are leveraged for these attacks; rather, the tool uses legitimate APIs to enable bulk SMS spam attacks.
Due to federal regulations and related fees imposed by bulk SMS providers, threat actors are more likely to target accounts belonging to organizations that have already gone through this process than to make accounts independently, not to mention costs for message delivery as a separate financial burden.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.