This threat describes a large-scale SMS pumping campaign conducted by the adversary group O-UNC-036. The attackers exploit customer sign-up pages that utilize SMS-based verification or notification by automating the creation of numerous fake accounts through public API endpoints. They employ disposable email addresses and proxy services to evade detection and rate limits, enabling high-volume, automated requests. The primary goal is to trigger SMS messages to phone numbers controlled by the attackers, thereby incurring substantial financial costs for the targeted organizations due to SMS fees. The attack lifecycle includes reconnaissance to identify vulnerable endpoints, setting up disposable email and proxy infrastructure, and launching high-frequency requests targeting phone numbers in countries with expensive SMS rates. The campaign has been ongoing since at least March 2024 and affects multiple tenants and organizations across various sectors. Indicators include a large list of suspicious disposable email domains used by the attackers. Recommended defenses focus on preventing automated account creation through strong authentication mechanisms such as FIDO, blocking known malicious domains and ASNs, and improving monitoring to detect unusual sign-up activity. This attack does not exploit a software vulnerability but abuses legitimate functionality at scale.

The primary impact of this SMS pumping campaign is financial, as organizations incur high costs from sending large volumes of SMS messages to attacker-controlled numbers. This can lead to unexpected operational expenses and potential service disruptions if SMS gateways become overwhelmed or rate-limited. Additionally, the attack may degrade user experience by causing delays or failures in legitimate SMS delivery. Organizations relying on SMS for multi-factor authentication or user verification may face increased risk of service abuse and potential reputational damage. While the attack does not directly compromise user data confidentiality or system integrity, the financial strain and operational disruption can be significant, especially for companies with large user bases and public APIs. The abuse of disposable email and proxy infrastructure complicates detection and mitigation, increasing the burden on security teams. If left unmitigated, the campaign could lead to sustained financial losses and degraded service availability.

1. Implement FIDO Authentication or other phishing-resistant multi-factor authentication methods to prevent automated account creation and reduce reliance on SMS-based verification. 2. Enforce strict rate limiting and anomaly detection on sign-up API endpoints to identify and block high-volume, suspicious requests. 3. Maintain and update blocklists of known disposable email domains and proxy ASNs to prevent registrations using these services. 4. Employ CAPTCHA or other challenge-response tests that are resistant to automation to filter out bot-driven sign-ups. 5. Monitor SMS sending patterns for unusual spikes, especially targeting high-cost country codes, and establish alerting mechanisms. 6. Collaborate with SMS gateway providers to implement fraud detection and blocking of suspicious message patterns. 7. Conduct regular threat intelligence updates to incorporate new indicators of compromise related to disposable email and proxy infrastructure. 8. Harden API authentication and consider requiring additional verification steps before sending SMS messages. 9. Educate development teams about the risks of exposing unauthenticated or poorly protected sign-up APIs. 10. Prepare incident response plans specifically addressing SMS pumping scenarios to enable rapid mitigation.