#Flights #botnet #GDP

Smishing botnet spreading phishing SMS

In the midst of major cyber-attacks targeting the general population of Iran, Check Point Research sees ongoing malicious campaigns using socially engineered SMS messages to infect tens of thousands of devices of Iran's citizens. The SMS messages, designed to impersonate the Iranian government, lure victims into downloading malicious Android applications that steal credit card credentials, personal SMS messages and two-factor authentication codes. The threat actors then proceed to make unauthorized money withdrawals and turn each infected device into a bot, spreading the malware to others. Check Point Research attributes attacks to threat actors, likely in Iran, who are financially motivated. The threat actors involved leverage a technique known as 'smishing' botnets, where compromised devices are used as bots to spread similar phishing SMS messages to other potential victims. The threat actors use multiple Telegram channels to promote and sell their tools. For $50-$150, the threat actors provide a full “Android Campaign Kit”, including the malicious application and underlying infrastructure, with a control panel that can be easily managed by any unskilled attacker via a simple Telegram bot interface.

The report further states that, in the midst of major cyber attacks targeting the general population of Iran, including cyber attacks on the railways, gas stations and more. Check Point Research attributes these latest cyber attacks to threat actors who are motivated purely by financial gain. Check Point Research estimates that the threat actors behind these attacks compromised and installed malware on tens of thousands of Android devices, resulting in the theft of billions of Iranian Rials from victims, with estimates of $1,000 to $2,000 per victims. Furthermore, the investigation reveals that the data stolen from victims' devices is freely accessible to third p.