Loading story…
Threat actors have systematically exploited Milesight industrial cellular routers to conduct widespread smishing attacks targeting users in several European countries. Security researchers from Sekoia identified that the attackers leveraged a feature in these routers designed to send SMS alerts to administrators, which is commonly used in industrial settings to monitor remote equipment. The campaign has been ongoing undetected since at least February 2022, with a significant focus on Belgium between November 2022 and July 2025. Attackers exploited CVE-2023-43261, a vulnerability that allows leakage of system logs from Milesight routers. By accessing these logs, the attackers could extract and crack encrypted administrator passwords, enabling them to connect to the routers and abuse the SMS API to send phishing messages. In some cases, attackers did not even need to exploit the vulnerability, as at least 572 routers were found to have their SMS APIs exposed to the internet without authentication. The smishing messages impersonated a variety of trusted entities, including government platforms such as Belgium's CSAM and eBox, French banking and postal services, and Swedish and Danish telecommunications providers. The phishing messages typically contained links to malicious domains, some of which were registered through NameSilo and hosted by Podaon, a Lithuanian provider. The majority of the spam was sent to users in Sweden, Italy, and Belgium, with the intent to harvest credentials or sensitive information by luring victims to fake websites. Researchers noted that there was no evidence of further exploitation or installation of backdoors on the compromised routers, indicating a focused campaign aimed specifically at smishing. The campaign's covert nature allowed it to persist for an extended period before detection. Internet scans revealed that over 19,000 Milesight routers have SMS sending APIs, highlighting the scale of potential exposure. Security experts recommend heightened vigilance, advising users to be wary of unsolicited SMS messages, especially those containing suspicious URLs, urgent requests, or grammatical errors. The incident underscores the risks associated with exposed industrial IoT devices and the importance of securing remote management interfaces. Organizations are urged to audit their router configurations, apply available patches, and restrict API access to trusted networks. The use of industrial routers as a platform for mass smishing represents a novel attack vector that could be replicated in other regions or with other device types. The campaign demonstrates the evolving tactics of threat actors in leveraging IoT infrastructure for social engineering attacks. Ongoing monitoring and awareness are essential to mitigate the risks posed by such sophisticated smishing operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On October 1, 2025, public reports disclosed the long-running abuse of Milesight industrial cellular routers for covert SMS phishing campaigns across Europe. Milesight had not responded to media inquiries at the time of publication.
Researchers said that while CVE-2023-43261 is a known vulnerability affecting Milesight routers, not all compromised devices were vulnerable to it, indicating attackers likely used more than one intrusion method. This finding complicated efforts to fully explain and contain the abuse.
Analysis connected the campaign to phishing domains registered through NameSilo and infrastructure associated with Lithuanian hosting provider Podaon. Some phishing sites also used JavaScript evasion and Telegram bots to log victim interactions.
Researchers identified sustained smishing activity targeting users in Belgium, Sweden, Italy, Denmark, and France, with lures spoofing government services, banks, postal organizations, and telecom providers. The SMS messages directed victims to credential-harvesting phishing sites.
Researchers found that unsecured Milesight UR35 industrial cellular routers had been used since at least October 2023 to send large-scale smishing messages. The compromised devices were commonly exposed industrial IoT routers with outdated firmware and accessible APIs.
Threat actors began abusing APIs on compromised Milesight industrial cellular routers to send malicious SMS messages in Europe. Reporting indicates Belgium was targeted from November 2022, including messages impersonating Belgian government platforms such as CSAM and eBox.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcenews.risky.biz
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent research highlighted systemic security and privacy risks created by **sign-in/authentication links delivered over SMS**, showing how easily such links and embedded personal data can be exposed and abused at scale. By observing public SMS gateway services (temporary numbers used to receive texts), researchers collected **332,000 unique SMS-delivered URLs** extracted from **33 million texts** sent to **30,000+ phone numbers**, and reported that messages from **701 endpoints** on behalf of **177 services** exposed *critical PII*. The work underscores that SMS is unencrypted and that authentication links and sensitive details can persist in accessible stores or be captured through weakly protected SMS delivery ecosystems. Greek police separately dismantled a criminal operation in the Athens area that used a **rogue mobile base station** (an “**SMS blaster**”) concealed in a car to push phishing texts to nearby phones. Authorities said the device coerced phones to connect and **downgraded them from 4G to 2G**, enabling collection of identifiers (e.g., phone numbers) and delivery of scam messages impersonating banks and courier firms with **phishing links** used to steal payment card data and conduct unauthorized transactions; investigators have tied the group to at least three fraud cases and indicated the suspects may be Chinese nationals. Together, the reporting and research illustrate how SMS-delivered links can be exploited both through passive exposure of messages/URLs and through active, proximity-based telecom impersonation to distribute credential- and payment-theft lures.
Jun 29, 2026
Multiple reports describe **social-engineering campaigns** that use trusted-looking lures (meeting invites, public-safety alerts, and official-looking documents) to drive victims to install malware or disclose credentials. Microsoft researchers reported a wave of **fake Zoom/Teams/Adobe update sites** reached via meeting-invite and document lures; the downloaded executables were signed with a **compromised EV code-signing certificate** (issued to *TrustConnect Software PTY LTD*) and acted as droppers for **remote monitoring and management (RMM) tools**, enabling persistent access. Separately, ClearSky described a suspected **Russian espionage** phishing operation targeting Ukraine that delivers a ZIP containing a Ukrainian-language border-crossing “permit” document, installing a loader (**BadPaw**) and a backdoor (**MeowMeow**) with file manipulation capabilities and sandbox/VM evasion; attribution was assessed as high confidence to a Russian state-aligned actor and low confidence to **APT28**. Mobile-focused lures were also reported: CloudSEK detailed **SMS phishing** targeting Israeli civilians with a trojanized **Red Alert** rocket-warning app, using a multi-stage loader chain to deploy spyware with **banking trojan** capabilities and exfiltrate **SMS, contacts, and location** to attacker infrastructure—raising concerns about surveillance and erosion of trust in official alerting. Other items in the set are either broader research or consumer-oriented scam advisories: a Zimperium write-up on the Android **“Massiv”** IPTV-app disguise highlights overlay-based banking fraud techniques, while Kaspersky’s mobile threat landscape report provides 2025 ecosystem statistics; two OnlineThreatAlerts posts describe generic **smishing** patterns (Amazon “refund” and flood-warning texts) without tying to a specific, evidenced campaign or new technical findings.
Jun 29, 2026
Infoblox reported a large malspam operation that used about **13,000 compromised MikroTik routers** to send malicious email and relay traffic through open `SOCKS4` proxies, helping the activity blend in with legitimate network traffic. The campaign impersonated **DHL** with freight-invoice lures and delivered ZIP archives containing obfuscated JavaScript that launched PowerShell and contacted a malware command-and-control server at `62.133.60[.]137`. Researchers said the infrastructure could support not only spam and malware delivery, but also phishing, DDoS, and other covert operations. A major factor in the campaign’s success was widespread **SPF misconfiguration** across roughly **20,000 sender domains**, especially records that allowed `+all`, enabling attackers to spoof trusted domains and evade normal email checks. Separate research on **MikroTik RouterOS** showed that exposed devices remained vulnerable to `CVE-2023-30799`, a privilege-escalation flaw that can lead to root access on affected hardware, while weak default credentials, username enumeration, and limited brute-force protections reduced the practical value of the authentication barrier. Together, the findings show how insecure router management and weak email authentication created durable infrastructure for a Russian-linked botnet.
Aug 15, 2026