Wednesday, August 13, 2025

Chinese SMS Spammers Go Mobile

CommsRisk once more has a story today about how Chinese organized crime is recruiting people online to drive around with SMS Blasters installed in their vehicles. 

https://commsrisk.com/thais-caught-with-smishing-sms-blaster-say-chinese-boss-paid-75-per-day/

In many countries, notably NOT the United States, government telecom regulations has made a significant impact on scammers by blocking the scam and fraud campaigns being sent via SMS messaging.  The response to these blockages has been the use of mobile base stations.  The technique turns a vehicle into a mobile cell phone tower, allowing it to send SMS messages directly, bypassing cell phone company's ability to block the messages. But the downside is that, depending on the power used, there is a limit to the range from 100 yards to a couple miles. 

In this case, the scammers were recruited in a Chinese WeChat channel where they were contracted by the scammer and trained how to install and set up their mobile station, which they installed in a small Mazda.  Their rig was on the low end, with a limited number of SIM cards, but was still able to send 20,000 SMS messages per day.

In November 2024, the Thai Royal Police picked up a much larger rig that was operating from a van being driven by a 35-year old Chinese national, Yang Muyi.  This device sent over a million messages in a three day period before being seized by police, as revealed in a press conference by Police Lt. General Thatchai Pitaneelabut.

Image from ThaiExaminer

Thai police have been greatly assisted in their investigations by a partnership with AIS (Advanced Info Systems) who have been helping them locate the false base stations. The image below shows the rig seized in a Honda CRV in January 2025 driven by two Chinese men, aged 47 and 49.  Police then went to the apartment where additional mobile phones, SIM cards and other telecom equipment was seized. 

Image from TheNation

On 10JUL2025, the Royal Oman Police shared a high-production quality video PSA on their Facebook, X.com, and Instagram channels warning about a Chinese tourist arrested with a vehicular-borne SMS Blaster case being used to send messages claiming to be from a local bank!

https://x.com/RoyalOmanPolice/status/1943369135477657693

Telecom Fraud expert Eric Priezkalns regular writes about this emerging technique and his map at CommsRisk showing details of more than 50 similar cases provides the most comprehensive information about such cases. 

https://commsrisk.com/fraud-dashboard/#baseStationsSection

One of the UK-based cases above happened in June 2025, with the investigation beginning when a local police officer received an SMS message claiming to be from HMRC - His Majesty's Revenues & Customs - the UK tax office. Their investigation identified Chinese student Ruichen Xiong who had been driving around London with a generator and an SMS blaster in his vehicle.

Image from The Guardian

"Captured SMS Blasting" 

The use of "captured SMS blasting" started in China where local advertisers used the technique to push advertisements for their store or services only to phones that are physically close to their location.  But scammers quickly realized there was a far more lucrative market by using the service to drive calls to fraud call centers!

The "3" over Beijing, China in this map actually goes back as far as 2014.  One of those three is a story from 2014 about Beijing police making 1,530 arrests and seizing 2,600 SMS Blasting devices! Already then, several of the text messages were imitating financial institutions, claiming a phone was infected with malware, or that their AliPay password had been changed.

Image from IBTimes

Because of the range limitations, scammers have frequently targeted places where crowds congregate.

If the problem comes in large crowds, perhaps the answer is ... 

Crowd-Sourcing Rogue Base Stations Identification

What can be done to detect and refer more of these cases to law enforcement?  The Gold Standard would have to come from Radio Yakuza! After noticing that his phone had a 2G connection to a fake base station, "Radio Yakuza" decided to investigate the situation.  He ended up recruiting a small army of volunteers on social media who reported incidents of fake base station capture and helped him to map out the possible locations.  In his initial break-through case, he was actually able to track the false base station to a black Audi hatchback!  The car was observed several more times by his team of volunteers, who noted that the driver had swapped the license plate!  His team was even able to help him get photographs of the equipment in the back of the car and demonstrate that the gear was identical to that shown in arrest photos in Thailand. 

https://x.com/denpa893/status/1911755963516014940



As with all the best reporting on this topic, the most detailed story comes from Eric Priezkalns on CommsRisk: "Amateur Detectives Find More Fake Base Stations in Japan" 

Radio Yakuza ==> https://x.com/denpa893

In a troubling example that Eric reports on, (See https://commsrisk.com/amateur-sleuths-plot-route-of-tokyo-sms-blaster-and-other-news-about-fake-base-stations/ )  one of Radio Yakuza's most recent discoveries involved a base station that was circling the Imperial Palace during Japan's recent Senate elections.  

https://x.com/denpa893/status/1946887928380367291

As Eric points out, the idea of mobile SMS Blasters being used for political mischief has also been observed in the Philippines. Maria Ressa's The Rappler.  Last month, their headline was "Spoof, smear, sabotage: How disinformation marred Cagayan de Oro’s 2025 polls."  One example they showed was an SMS campaign that claimed if people came to one politician's rally, they could show their copy of the SMS messages to receive 50,000 Pesos! (That candidate, Lordon G. Suan, went on to win his Congressional race.) 

(I can't mention The Rappler without begging you to read Maria Ressa's book, which I reviewed in December 2022 ==> 




No comments:

Post a Comment

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.