Daiping Liu

Executive Summary We are attributing an ongoing smishing (phishing via text message) campaign of fraudulent toll violation and package misdelivery notices to a group widely known as the Smishing Triad. Our analysis indicates this campaign is a significantly more extensive and complex threat than previously reported. Attackers have impersonated international services across a wide array of critical sectors. The attackers have targeted U.S. residents in this campaign since April 2024.

Executive Summary Many illicit network services, including phishing campaigns and online gambling platforms, exploit traffic distribution systems (TDS) to redirect network traffic. A TDS acts as a central hub, redirecting victims through an often complex network of servers to obfuscate the final destination and hinder detection of these operations. This infrastructure also facilitates the management of multiple malicious endpoints simultaneously.

Executive Summary In this article, we explain our process of detecting domain name service (DNS) hijacking and provide some notable examples of this detection from the first half of 2024. DNS hijacking allows cybercriminals to modify DNS records of domain names and redirect users to malicious servers. Threat actors compromise domains for a variety of different types of attacks, including meddler in the middle (MitM) attacks, drive-by downloads, phishing and scams.