The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data

The Hook: Censys research dives into the operational details of a USPS-themed smishing kit, utilizing DNS data to track its infrastructure and evolution, revealing how threat actors deploy and manage these deceptive campaigns.

Technical Breakdown:

• Threat Type: Smishing (SMS phishing) leveraging brand impersonation (USPS) to lure victims into revealing sensitive information.
• Methodology: The analysis focuses on DNS data to map the kit's associated domains, IP addresses, and underlying infrastructure over time, providing insights into its deployment patterns and resilience.
• TTPs (Inferred): Social engineering via SMS to deliver malicious links, rapid setup and tear-down of phishing domains, and likely utilization of various hosting providers or domain registrars.
• IOCs: While the provided summary doesn't include specific IOCs, the full article would detail domains and IP addresses identified as part of the smishing kit's infrastructure.

Defense: Educate users about smishing tactics and the importance of verifying unexpected messages. Monitor DNS query logs and external attack surface for newly registered domains or rapid infrastructure changes that mimic legitimate services. Implement robust email and SMS filtering solutions.

Source: https://censys.com/blog/following-a-usps-smishing-kit-through-censys-dns-data/