Silent Smishing : The Hidden Abuse of Cellular Router APIs

Sekoia.io observed active smishing campaigns leveraging Milesight industrial cellular routers whose SMS APIs are exposed or misconfigured; attackers (linked to Podaon SIA/NameSilo-registered domains and an operator cluster referenced as "Grooza") have sent phishing SMS messages—largely targeting Belgium but also multiple European countries—since at least February 2022. The report documents honeypot logs showing POST requests to the /cgi endpoint, identifies ~19,000 publicly exposed Milesight devices with 572 tested allowing unauthenticated inbox/outbox access, lists phishing domains and URLs, analyzes phishing kits and device-detection JavaScript, and provides IOCs for detection and mitigation.