Attackers are impersonating the USTelecom Industry Traceback Group (ITG) to carry out a social engineering and phishing campaign against telecom operators. The employees are encouraged to install remote access software, giving the attackers access to their systems.
The campaign has targeted carriers listing within the FCC’s (Federal Communications Commission) Robocall Mitigation Database, which holds the contact details for roughly 11,500 US and international providers. It acts as a central registry where all voice service providers must register.
How The Attack Works
Operators first receive an email posing as an urgent traceback request, explaining that the recipient network has been “identified” as part of an ITG investigation. To increase the authenticity and urgency of the demands, they reference FCC rule 47 CFT § 64.1200(n)(1), requiring providers to answer traceback requests. The email also cites the 24-hour deadline to add to the urgency.
Targets are encouraged to respond via a “secure Traceback Portal” and warned not to share or forward the email. However, the in-body text link does not match the URL destination. Instead, it links to a GitHub repository for remote access software.
Compliance data as a target list
Commsrisk editor Eric Priezkalns explains that the RMD “has always been a case study in terrible security hygiene,” and that the open publication allows malicious actors to exploit data from genuine telecos companies. Priezkalns said that rather than “being a tool that reduces crime, the RMD is equally effective at punishing compliant telecos.”
Next steps
Security teams should inform any susceptible departments or employees about the latest campaign. As this attack is so targeted, it is unlikely to affect those not in a position to respond to genuine ITG requests.
Standard phishing advice remains: do not reply to suspicious or unsolicited emails. Users can also verify genuine ITG requests via the public contact form on the organization’s website.
Security teams can ensure that unapproved remote access tools are blocked by going to their allowlist settings.
