Hello and welcome to the Wednesday, April 30th, 2025 edition of the Sands and the Internet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Today I expanded a little bit on work that I already wrote about last Thursday's Nets attacks against SMS gateways and tools.

Now, on Thursday I talked particular about attacks against Teltonica, networks, gateways.

These are sort of standalone devices more or less that you can use to basically programmatically send SMS messages.

But of course, that's actually not what most people are using to send SMS messages.

Most people are using some kind of API.

Twilio comes to mind sort of as one of the big ones offering these services, broadband.com, and a couple

of other companies like this. So I went through our logs today to see what other ways I see

how attackers are trying to attack these types of SMS gateways. And well, no big surprise here.

I saw a number of different techniques being used here.

First of all, well, WordPress.

I sort of stopped, of course, talking a little bit about WordPress vulnerabilities.

There are just so many about the plugins in particular.

And turns out there are dedicated plugins that allow you to send SMS messages from WordPress and these plugins of course are attacked. What we are seeing here in our data

is mostly attempts to fingerprint WordPress sites to check if they're running one of these plugins.

And then it's assumed that once they find

that a particular site has this plugin installed, they will then actually attempt to exploit it.

Now, there's also a couple of a little bit odd and broken scans here, like these yes, sort of word press scans,

but notice that percent, percent, target, percent,

that's often left over when people sort of built these templates

and then are not properly filling them in and dealing with them.

...