Hackers Hijack Industrial Cellular Routers to Launch Widespread Smishing Campaigns Across Europe

A new report from Sekoia[.]io’s Threat Detection & Research (TDR) team reveals that attackers are weaponising industrial cellular routers to launch widespread smishing campaigns across Europe, with Belgium a primary target. On 22 July 2025, Sekoia[.]io honeypots captured suspicious network traces revealing that a cellular router’s API was exploited to send malicious SMS messages containing phishing URLs.

The TDR team confirmed that threat actors have been exploiting this vector since at least February 2022, using hijacked routers to impersonate legitimate institutions and distribute fraudulent links. Belgium appears to be the most consistently targeted nation, with phishing URLs typosquatting well-known Belgian government platforms and messages written in Dutch and French; recent campaigns impersonated CSAM and eBox.

The attacker infrastructure relied on Milesight Industrial Cellular Routers, with a Shodan search revealing over 19,000 such devices and 572 allowing unauthenticated access to their inbox/outbox APIs, many running outdated firmware. Sekoia[.]io notes that smishing remains a profitable, low-barrier attack method and that these campaigns demonstrate how simple infrastructure can scale globally.