Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Why Are You Texting Me? Unc3944 Leverages Sms Phishing Campaigns for Sim Swapping, Ransomware, Extortion, and Notoriety
Threat Actors
Malware Families
Excerpt
https://cloud.google.com/blog/topics/threat-intelligence/unc3944-sms-phishing-sim-swapping-ransomware Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety By Mandiant Published: 2023-09-14 · Archived: 2026-10-16 02:01:20 UTC Written by: Mandiant Intelligence UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to…
Read the original report →Diamond Model
Adversary(8)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | helpdesk.com | High | Score 62/100 | First seen |
| Domain | internal.com | High | Score 67/100 | First seen |
| Domain | help.com | High | Score 67/100 | First seen |
| Domain | servicedesk.com | High | Score 67/100 | First seen |
| Domain | secretsdump.py | Medium | Score 66/100 | First seen |
| Domain | sso.com | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…