www.darkreading.com
Open in
urlscan Pro
2606:4700::6811:7763
Public Scan
URL:
https://www.darkreading.com/dr-global/postalfurious-sms-attacks-target-uae-citizens-data-theft
Submission: On June 05 via api from TR — Scanned from DE
Submission: On June 05 via api from TR — Scanned from DE
Form analysis
0 forms found in the DOMText Content
The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Security Now Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Anatomy of a Data Breach - A Dark Reading June 22 Event Webinars * Next-Generation Supply Chain Security Jun 07, 2023 * Here's What Zero Trust Really Means Jun 13, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > Newsletter Sign-Up The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Security Now Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Anatomy of a Data Breach - A Dark Reading June 22 Event Webinars * Next-Generation Supply Chain Security Jun 07, 2023 * Here's What Zero Trust Really Means Jun 13, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Security Now Events Close Back Events Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Anatomy of a Data Breach - A Dark Reading June 22 Event Webinars * Next-Generation Supply Chain Security Jun 07, 2023 * Here's What Zero Trust Really Means Jun 13, 2023 Resources Close Back Resources Dark Reading Library > Webinars > Reports > Slideshows > White Papers > Partner Perspectives: Microsoft Tech Library > -------------------------------------------------------------------------------- Newsletter Sign-Up SEARCH A minimum of 3 characters are required to be typed in the search bar in order to perform a search. Announcements 1. 2. 3. Event How to Launch a Threat Hunting Program | Webinar <REGISTER> Event How to Accelerate XDR Outcomes: Bridging the Gap Between Network and Endpoint | Webinar <REGISTER> Report Black Hat USA 2022 Attendee Report | Supply Chain & Cloud Security Risks Are Top of Mind | <READ IT NOW> PreviousNext DR Global 2 MIN READ News 'POSTALFURIOUS' SMS ATTACKS TARGET UAE CITIZENS FOR DATA THEFT SMS campaigns targeting members of the public in the United Arab Emirates have been detected. Dan Raywood Senior Editor, Dark Reading June 02, 2023 Source: Tero Vesalainen via Alamy Stock Photo PDF Residents of the United Arab Emirates have been targeted by SMS campaigns that aim to steal payment and personal details. Previously targeted at users in Asia-Pacific, the campaign has been named PostalFurious as it impersonates postal services. Investigations by Group-IB attributed both campaigns to a Chinese-speaking phishing ring dubbed PostalFurious. This group has been active since at least 2021 and are able to rapidly set up large network infrastructures, which they also change quite frequently to avoid detection by security tools, and utilize access-control techniques to avoid automated detection and blocking. There's evidence that they operate globally, beyond the bounds of this one Middle Eastern initiative. In this campaign, payment details are collected via scam SMS messages asking the recipient to pay fees for tolls and deliveries. The URLs from the texts lead to fake branded payment pages that ask for personal details, such as name, address, and credit-card information. The phishing pages also appropriate the official name and logo of the impersonated postal service provider, and can only be accessed from UAE-based IP addresses. The text messages contain a shortened URL which features a fake branded payment page, and has been active since at least April 15 of this year; when it launched, the campaign impersonated a UAE toll operator, but a new version was launched on April 29, with UAE postal service spoofing. The same servers were used for the phishing domains in both cases, while the SMS messages were sent from phone numbers registered in Malaysia and Thailand, as well as via email addresses through iMessage. WHO IS THE ANGRY POSTMAN? When asked who the messages targeted, Anna Yurtaeva, senior cyber investigation specialist at Group-IB's Digital Crime Resistance Center in Dubai, confirms that PostalFurious' scam campaigns are all targeted at members of the public. "They launch widespread SMS phishing campaigns, and we are aware of cases where messages have been sent to UAE residents who are not users of the services," she says. "From our analysis of the source code and infrastructure of PostalFurious website, we see that the gang aims to steal payment credentials and personal data from victims." She confirms there was no malware downloads seen in the two detected campaigns, but the attacks against users in the UAE appear to be part of a broader, mass campaign that could have global implications. She says the operators of PostalFurious previously targeted users in Singapore and Australia, where they also produced fake sites impersonating postal services and toll operators. The news comes on the heels of a similarly themed campaign that came to light earlier this week. Dubbed "Operation Red Deer," the effort saw Israeli engineering and telecommunications companies being targeted with a sustained phishing message campaign that is convincingly impersonating Israel's postal service. Threat IntelligenceMobileEndpointMiddle East & Africa Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe More Insights White Papers * Adopting a Defense-in-Depth Approach to IT Security * Every Minute Matters: Real-World Incident Response Timelines In Action More White Papers Webinars * Next-Generation Supply Chain Security * Here's What Zero Trust Really Means More Webinars Reports * Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks * How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment More Reports Editors' Choice Top macOS Malware Threats: Here Are 6 to Watch Jai Vijayan, Contributing Writer, Dark Reading Dark Reading Launches Inaugural CISO Advisory Board Kelly Jackson Higgins 2, Editor-in-Chief, Dark Reading Meet Charlotte, CrowdStrike's New Generative AI Assistant Dark Reading Staff, Dark Reading 'Volt Typhoon' China-Backed APT Infiltrates US Critical Infrastructure Orgs Tara Seals, Managing Editor, News, Dark Reading Webinars * Next-Generation Supply Chain Security * Here's What Zero Trust Really Means * Mastering Endpoint Security: The Power of Least Privilege * The Future is CNAPP: Cloud Security From Prevention To Threat Detection * Secrets to a Successful Managed Security Service Provider Relationship More Webinars Reports * Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks * How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment * Successfully Managing Identity in Modern Cloud and Hybrid Environments * The 10 Most Impactful Types of Vulnerabilities for Enterprises Today * The Promise and Reality of Cloud Security More Reports White Papers * Adopting a Defense-in-Depth Approach to IT Security * Every Minute Matters: Real-World Incident Response Timelines In Action * Large Insurer goes beyond Breach and Attack Simulation (BAS) with Cymulate * 2023 Gartner Market Guide for Cloud-Native Application Protection Platforms (CNAPP) * 2023 Global Future of Cyber Report More White Papers Events * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More * Anatomy of a Data Breach - A Dark Reading June 22 Event * Black Hat USA - August 5-10 - Learn More More Events More Insights White Papers * Adopting a Defense-in-Depth Approach to IT Security * Every Minute Matters: Real-World Incident Response Timelines In Action More White Papers Webinars * Next-Generation Supply Chain Security * Here's What Zero Trust Really Means More Webinars Reports * Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks * How Enterprises Are Managing Application Security Risks in a Heightened Threat Environment More Reports DISCOVER MORE FROM INFORMA TECH * Interop * InformationWeek * Network Computing * ITPro Today * Data Center Knowledge * Black Hat * Omdia WORKING WITH US * About Us * Advertise * Reprints FOLLOW DARK READING ON SOCIAL * * * * * * * Home * Cookies * Privacy * Terms Copyright © 2023 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG. Cookies Button ABOUT COOKIES ON THIS SITE We and our partners use cookies to enhance your website experience, learn how our site is used, offer personalised features, measure the effectiveness of our services, and tailor content and ads to your interests while you navigate on the web or interact with us across devices. You can choose to accept all of these cookies or only essential cookies. To learn more or manage your preferences, click “Settings”. For further information about the data we collect from you, please see our Privacy Policy Accept All Settings COOKIE PREFERENCE CENTER When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information Allow All MANAGE CONSENT PREFERENCES STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button BACK Search Icon Filter Icon Clear checkbox label label Apply Cancel Consent Leg.Interest checkbox label label checkbox label label checkbox label label * View Cookies * Name cookie name Confirm My Choices