{ "Event": { "analysis": "1", "date": "2026-06-03", "extends_uuid": "", "info": "[Threat Intel] Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages", "protected": false, "publish_timestamp": "1780629667", "published": true, "threat_level_id": "3", "timestamp": "1780629667", "uuid": "bc9ff843-b5ce-4827-8e58-fc9196922e34", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Group-IB\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Client Configurations - T1592.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#82eae0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"", "relationship_type": "" }, { "colour": "#f798db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal from Tools - T1027.005\"", "relationship_type": "" }, { "colour": "#db2044", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1598.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#b990dd", "local": false, "name": "misp-galaxy:target-information=\"Australia\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Chile\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Colombia\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#d52b43", "local": false, "name": "misp-galaxy:target-information=\"Mexico\"", "relationship_type": "" }, { "colour": "#48df7e", "local": false, "name": "misp-galaxy:target-information=\"Netherlands\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#170059", "local": false, "name": "rectifyq:topic=\"mobile-attack\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Content Injection - T1659\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570834", "to_ids": false, "type": "link", "uuid": "8115e6ce-c32c-4db9-821e-a77312ecde4f", "value": "https://www.group-ib.com/blog/error-524-decoy-smishing/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780570834", "to_ids": false, "type": "text", "uuid": "5740a259-5dee-45eb-9391-9b9cc05b150b", "value": "A sophisticated smishing and phishing operation active since the second half of 2025 has impersonated over 267 brands across 72 countries, with particular concentration in Latin America. The campaign generated 4,389 phishing domain instances, with Mexico accounting for 1,851 cases. Telecommunications is the most targeted sector with 1,754 instances, followed by financial services and consumer rewards programs. The operation employs fake Cloudflare error pages as decoys, revealing malicious content only to victims matching specific geofencing and mobile device criteria. Data exfiltration occurs through encrypted WebSocket channels using binary encoded payloads. Approximately 30% of infrastructure is hosted on Tencent Cloud and Alibaba US servers, fronted by Cloudflare to mask hosting IPs. The attack chain progresses from SMS lures through progressive credential harvesting, ultimately capturing complete credit card details including CVV codes." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780570834", "to_ids": false, "type": "text", "uuid": "5c4ee628-d9a7-4558-8188-5f49bdf1acea", "value": "Name: Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages\nAuthor: AlienVault\nAdversary: \nTags: [\"brand impersonation\", \"credit card theft\", \"smishing\", \"phishing-as-a-service\", \"mobile targeting\"]\nTgtd countries: [\"Australia\", \"Chile\", \"Colombia\", \"Germany\", \"Mexico\", \"Netherlands\"]\nMlwr families: []\nAttack_ids: [\"T1592.004\", \"T1071.001\", \"T1583.001\", \"T1027.005\", \"T1598.003\", \"T1090.003\", \"T1036.005\", \"T1041\", \"T1027\", \"T1566.002\"]\nIndustries: [\"Telecommunications\", \"Finance\", \"Retail\", \"Government\", \"Transportation\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626676", "to_ids": true, "type": "ip-dst", "uuid": "10010738-7e0a-430b-9b77-6880804e7f2b", "value": "154.81.166.17", "Tag": [ { "colour": "#3146a1", "local": false, "name": "asn:asn=\"54801\"", "relationship_type": "" }, { "colour": "#17b1d0", "local": false, "name": "asn:as-owner=\"ZILLION-NETWORK\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS132203 tencent building kejizhongyi avenue", "deleted": false, "disable_correlation": false, "timestamp": "1780626697", "to_ids": true, "type": "ip-dst", "uuid": "4200913e-2b15-4278-be97-9d953cb1bd4e", "value": "43.159.168.186", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=IN ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1780626718", "to_ids": true, "type": "ip-dst", "uuid": "d5f494a0-6c67-4907-871a-27672b2494d8", "value": "43.162.84.202", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=SG ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1780626739", "to_ids": true, "type": "ip-dst", "uuid": "71fa6e7b-808b-4a6a-bebb-577c72703567", "value": "43.165.6.36", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46562 performive llc", "deleted": false, "disable_correlation": false, "timestamp": "1780626761", "to_ids": true, "type": "ip-dst", "uuid": "67cbe6df-b3e0-47a0-971e-68f75b3c6f1a", "value": "45.135.162.90", "Tag": [ { "colour": "#81ef33", "local": false, "name": "asn:asn=\"142036\"", "relationship_type": "" }, { "colour": "#7287a6", "local": false, "name": "asn:as-owner=\"HOSTEONS-AS-AP Hosteons Pte. Ltd.\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1780626782", "to_ids": true, "type": "ip-dst", "uuid": "7b7c59ec-40d0-41b2-a3d1-bd9f07ea2000", "value": "47.82.154.2", "Tag": [ { "colour": "#836891", "local": false, "name": "asn:asn=\"45102\"", "relationship_type": "" }, { "colour": "#692b04", "local": false, "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=SG ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1780626803", "to_ids": true, "type": "ip-dst", "uuid": "84880d11-1708-47b2-8205-f5f84e4405a3", "value": "8.222.134.149", "Tag": [ { "colour": "#836891", "local": false, "name": "asn:asn=\"45102\"", "relationship_type": "" }, { "colour": "#692b04", "local": false, "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ] } }