T1496.003 SMS Pumping

Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.² SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.³

Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.²¹ In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.²

Mitigations

References