T-mobile transferred a phone number from an employee of a large company

• 
  T-Mobile transferred a phone number from an employee of a large company.
  
• 
  SIM swapping allows threat actors to bypass the security of SMS password resets and verification.
  
• 
  There’s been over 100 incidents in 2022.
  
• 
  https://krebsonsecurity.com/2023/08/kroll-employee-sim-swapped-for-crypto-investor-data/
  
• 
  https://en.wikipedia.org/wiki/SIM_swap_scam
  

Steps:

1. 
   They gather details about the individual from social media or gathered through a phishing site.
   
2. 
   They call the customer and use these details to appear authentic, and they try to convince the user to approve a SIM swap.
   
3. 
   If accepted, the threat actor will receive all SMS and voice calls; They can now bypass 2-Factor Authentication.
   

Jack Dorsey

FBI Complaints

• 
  S@T browser requires no authentication
  
• 
  Several hundred attacks per week in Mexico (primary targets)
  
• 
  A surveillance company
  
• 
  Around 10-20k of these messages in a year.
  
• 
  Over 100m globally could be affected.
  

1. 
   Binary “Attack message” sent to user. (Instructs SIM card to get location information)
   
2. 
   SMS message is sent to scammer receipient phone number, with location info.
   

Could also lock a user out of their account with S@T commands.

QAKBOT
https://www.bleepingcomputer.com/news/security/qakbot-botnet-dismantled-after-infecting-over-700-000-computers/

• 
  Compromised 700k computers
  
• 
  Found a payments.txt file with details of ransomware victims.
  
• 
  FBI deployed an uninstaller by redirecting Qakbot traffic.