Pulse Detail — Threat Intelligence

● 0 online

ANALYZING THREAT INTELLIGENCE

PULSE NAME

Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns

WHITE Tr1sa111 2026-05-05 Modified: 2026-05-29

24

IOCs

MEDIUM VOLUME

↓ CSV ↓ JSON

credential harvesting smishing phaas mfa bypass phoenix system financial fraud bts injection

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1566.002 T1204.001 T1539

Indicators of Compromise (9 / 24 total)

All IPv4 URL

TYPE	INDICATOR	DESCRIPTION	CREATED
URL	http://154.91.90.0	—	2026-05-05
URL	http://38.162.114.0	—	2026-05-05
URL	http://43.133.0.0	—	2026-05-05
URL	http://43.134.0.0	—	2026-05-05
URL	http://43.153.0.0	—	2026-05-05
URL	http://43.160.192.0	—	2026-05-05
URL	http://43.162.0.0	—	2026-05-05
URL	http://45.203.220.0	—	2026-05-05
URL	http://47.80.0.0	—	2026-05-05

References (1)

↗ https://www.group-ib.com/blog/phoenix-phaas-kit-smishing/