Smishing Triad Impersonates Emirates Post to Target UAE Citizens

Introduction

This month, “Smishing Triad” has vastly expanded its attack footprint in the UAE. Resecurity, a leader in cybersecurity and threat intelligence, has identified domain names that closely resemble those used by the group in their previous campaigns. Threat actors registered the majority of these UAE-focused domains with Gname.com Pte. Ltd., a Singapore-based web registrar.

“Smishing Triad” fraudsters also listed various Chinese entities as registrant organizations, or the owners of the fraudulent domains. Similarities in domain signatures noted by Resecurity indicate a calculated and ongoing threat to the Emirates. The assessment that “Smishing Triad” is hyper-targeting victims in the Emirates is further supported by the group’s geo-filtering of smishing page access to UAE citizens only.

Resecurity specifically observed this geo-fencing of IP addresses in smishing lures cast out to impersonate the Emirates Post, the UAE’s official parcel delivery service. In fact, UAE-focused fraud campaigns imitating official Emirates Post communications were first confirmed in May, according to local news reports.

Resecurity specifically observed this geo-filtering of IP addresses in smishing lures cast out to impersonate the Emirates Post, the UAE’s official parcel delivery service. “Smishing Triad” is also leveraging compromised Apple iCloud accounts and illegally obtained databases that contain the personally identifying information (PII) of UAE citizens to stage their attacks.

Specifically, the threat actor acquires UAE resident databases from the Dark Web and launches their smishing attacks from iCloud accounts they have previously compromised. Resecurity has already alerted and shared relevant information with the national Computer Emergency Response Team for the United Arab Emirates (AeCERT).

Resecurity’s HUNTER (HUMINT) unit also blocked the majority of malicious domains that were flagged this week. But the battle against “Smishing Triad” threat actors continues.

Their Goal: To Defraud the Emirates Citizens

Their Objective

“Smishing Triad” has a singular, malign goal: to defraud Emirati citizens. By employing sophisticated tactics, the group aims to extract sensitive PII and financial data from unsuspecting victims.

Their Modus Operandi

The group typically sends out malicious text messages from iCloud accounts they have previously hijacked, while masquerading as reputable organizations like government agencies, financial institutions (FIs), and shipping firms.

These messages are designed to dupe people into divulging their PII and financial data. “Smishing Triad” then uses this stolen data to defraud individuals and businesses. To target prospective victims, “Smishing Triad” acquires geo-specific PII databases obtained from access brokers on the Dark Web.

Regarding the group’s malicious infrastructure, Resecurity has observed “Smishing Triad” threat actors registering fraudulent domains through Singaporean website registrar Gname.com Pte. Ltd.

Technical Insights

Domain Details - Key Information

• Domain Name: dwu6.top
• Registrar: Gname.com Pte. Ltd.
• Creation Date: 2023-09-13
• Registry Expiry Date: 2024-09-13
• Name Servers: a.share-dns.com, b.share-dns.net

Analysis

The domain, dwu6.top, is a critical asset in “Smishing Triad's” campaign against the UAE. Its structure and registration details closely mirror those of domains used in earlier campaigns, suggesting a consistent and evolving modus operandi.

Tactics, Techniques, and Procedures

iMessage as a Delivery Method

“Smishing Triad” is known to use compromised iCloud accounts to send iMessages, a tactic that makes their SMS scams more credible. The group is targeting UAE-specific users, while masquerading as the Emirates Post and other local organizations.

The victim will be asked to select the payment option, typically a small fee, then on the next page they're asked to enter personal and credit card information.

The next screen, the victim is asked to enter their personal information followed by the request to proceed with the payment (credit card) information.

Fraud-as-a-Service

Beyond proprietary smishing attacks, the group also offers 'smishing kits' for sale on platforms like Telegram. This fraud-as-a-service (FaaS) model enables “Smishing Triad” to scale their operations by empowering other cybercriminals to leverage their tooling and launch independent attacks.

Conclusion

The Need for Vigilance

As “Smishing Triad” expands its FaaS operations to target the Emirates, both cybersecurity agencies and UAE citizens must remain vigilant. Fraud awareness campaigns and educational programs are essential first lines of defense against these rapidly evolving threats.

Proactive Measures

Empowered by Resecurity’s discovery of the domain names and attack patterns associated with “Smishing Triad,” cybersecurity agencies are now capable of engaging in proactive monitoring, intervention, and mitigation. These measures could involve taking down malicious domains, tracking down threat actors behind them, and implementing more robust cybersecurity controls to protect UAE citizens.

Per Article 11 of the 2021 Emirates’ Cybercrime Law, “creating fake websites, email accounts, or impersonating someone else can lead to detention and fines ranging from AED 50,000 to AED 200,000. If these fabricated accounts are used to harm the victim, the perpetrator may face imprisonment for a minimum of two years.”

Penalties for cybercriminal offenses that harm UAE nationals or organizations become even harsher when “state institutions' websites or accounts are involved, leading to imprisonment for up to five years and fines ranging from AED 200,000 to AED 2,000,000.”

To assist victims of cybercrime, the government of the UAE has established multiple “easy reporting” services that include a dedicated ‘e-crime website,’ the Dubai Police website, and the ‘My Safe Society’ application. These user-friendly tools allow UAE residents to easily report cybercrime incidents.

The UAE has also established the ‘Cyber Pulse’ Initiative, an endeavor that “aims to encourage community members in the UAE to play a part in cybersecurity efforts. It seeks to enhance public awareness on suspicious online activities and the necessary steps to be taken from becoming a victim of ePhishing.”

To defend against the growing threat of “Smishing Triad” and other cybercriminal actors, UAE citizens and residents should consider the following best practices:

• Avoid publishing private contact information on unreliable online platforms
• Be cautious of unknown links sent through text messages or emails
• Only download apps from trusted sources
• Keep backup copies of personal data
  
• Regularly update smartphone operating systems
• Watch for signs of electronic fraud, such as abnormal battery consumption or slower processing speeds

IOC (Indicators of compromise)

Domains focusing on Telegram

All Other Domains