That annoying SMS phish you just got may have come from a box like this

Scammers are abusing unsecured industrial cellular routers to blast SMS-based phishing messages, a campaign that has been ongoing since 2023, according to Sekoia. The devices, UR35 routers made by Milesight IoT Co., Ltd., are rugged IoT gear used to connect traffic lights, power meters and other industrial assets, and they can be controlled by text message, Python scripts and web interfaces.

Sekoia said more than 18,000 such routers are accessible on the Internet, with at least 572 allowing free access to programming interfaces; most are running firmware versions more than three years out of date and harbour known vulnerabilities, including the CVE-2023-43261 flaw fixed in 2023 with firmware version 35.3.0.7.

The campaigns date back to October 2023 and rely on smishing, directing recipients to login pages to verify their identity, with some sites logging visitor data through a Telegram bot known as GroozaBot operated by an actor named “Gro_oza.” Researchers Jeremy Scion and Marc N. said the devices’ utility for decentralised SMS distribution makes takedowns harder, though some routers abused in the campaigns were not susceptible to CVE-2023-43261.