Hackers Use Cellular Router API to Send Malicious SMS with Weaponized Links

Cybersecurity: Analysis of Vulnerability Exploitations

The Threat Detection & Research (TDR) team at Sekoia.io is dedicated to monitoring and analyzing vulnerability exploitations. The team utilizes honeypots to observe traffic directed at edge devices and internet-facing applications.

On Mon, Jul 22, 2025, suspicious network activity was detected in our honeypots. It was revealed that a cellular router's API had been exploited to conduct smishing campaigns by sending malicious SMS messages containing phishing URLs. The attack primarily targeted Belgium, with services such as CSAM and eBox impersonated, using the +32 country code.

Logs from Milesight Industrial Cellular Router honeypots showed POST requests to the /cgi endpoint with JSON payloads specifically used to send SMS messages.

The traces began in late Jun 2025, originating from IP address 212.162.155[.]38 within AS Podaon SIA. Extracted messages, written in Dutch or French, targeted Belgian numbers (+32) and used typosquatted domains of official Belgian services.

No additional device exploitation or backdoors were identified, suggesting the operation was focused solely on SMS-based phishing.

Logs indicated the use of a valid authentication cookie, though the password could not be decrypted using AES keys related to CVE-2023-43261 exploitation methods. It was discovered that many Milesight routers allow unauthenticated access to SMS features, enabling attackers to send messages or retrieve inbox/outbox data without authentication.

Unauthenticated POST requests to /cgi with parameters like query_outbox or query_inbox return JSON objects containing timestamps, message content, recipient numbers, and status indicators. High volumes of “failed” statuses suggest attackers test routers against known numbers before launching mass campaigns. This operational fingerprint could aid in clustering and detection.

A Shodan search identified over 19,000 Milesight Industrial Cellular Routers exposed on the public internet, with nearly half located in Australia. Many were running outdated firmware versions (32.2.x.x, 32.3.x.x). Europe accounts for nearly half of these vulnerable routers, facilitating reliable SMS delivery to European phone numbers and explaining the disproportionate targeting of that region.

Smishing campaigns exploiting this vulnerability date back to Feb 2022. Belgian messages impersonated CSAM and eBox, offering fake notifications requiring immediate attention via malicious links. French campaigns imitated services like Ameli, La Poste, GLS, and Crédit Agricole, using varied pretexts from health card renewals to banking security alerts.

The attack infrastructure relied on domains registered through NameSilo and hosted by Podaon SIA. For Belgium-focused campaigns, domains such as csam.ebox-login[.]xyz resolved to Podaon IPs, remaining active. Phishing pages check for mobile environments using "detect_device.js" to evade desktop sandboxes.

Broader campaigns used the jnsi[.]xyz domain cluster under Russian AS211860, impersonating services from Netflix to Telia, with obfuscated scripts (GroozaV2) hindering analysis. This campaign highlights how accessible infrastructure, such as vulnerable cellular routers, can be weaponized for extensive smishing operations.

By decentralizing SMS distribution across multiple countries, attackers evade detection and maintain profitable phishing campaigns. Users are advised to scrutinize unsolicited messages, especially those containing shortened URLs, urgent language, or grammatical errors, as awareness and skepticism are crucial defenses against evolving smishing threats.

Based on reporting by GBHackers.