Closet Routers, Cold Pasta, And The “Gov” Texts That Aren’t

Dinner buzz, pocket gremlin, same number as last night wearing a new hat. “Verify your identity” from a “government service” I didn’t sign up for. Cute. My spaghetti doesn’t need two factors, it needs parmesan. I almost tap because habit is a tricky little algorithm, then I remember I like my bank balance and my sleep, so I put the fork down, look at the text, and laugh the way you laugh when the smoke alarm runs on fresh batteries. Not because it’s funny, because it’s familiar, and because my SIMpathy has limits.

So what’s actually happening? Nothing fancy. Criminal crews are hijacking industrial cellular routers, the little grey bricks in closets that keep traffic lights chatting with HQ and power meters reporting their numbers. They point them at everyone’s phones and fire off texts. Real devices. Real campaigns. This has been running since 2023. A lot of the boxes say Milesight on the label. Roughly eighteen thousand are reachable on the public internet, with hundreds configured so poorly you can curl an endpoint and start blasting. Most run firmware that belongs in a museum, full of bugs we already know by name.

Why target these boxes? Two easy wins. They already have SIMs and a legit relationship with carriers, so messages come down normal mobile routes, not bulk gateways that get flagged in a heartbeat. And they’re scattered across cities and countries, which lets spam trickle out in small streams that blend with daily noise. Think sprinkler, not hydrant. The operators aren’t masterminds, they’re thrifty and lazy in that professional way crime learns by repetition, and these routers take commands by text, by Python, or through a web panel, so once you’re in, you can automate the whole mess. Set it, forget it, count the money while your pasta gets cold, and pretend you orchestrated something clever instead of shoplifting from municipal closets.

How do they get in? Pick your flaw. CVE-2023-43261 let devices leak files over the web, including “encrypted” admin passwords stored next to the key and IV. That isn’t security, c’est une invitation. And yes, some of the abused units were patched and still got pulled into campaigns. Which means more than one door stays open. Sloppy settings, fleet password reuse, vendor remote portals nobody wants to talk about at a quarterly, and the classic “we’ll update it after peak season.” When your estate is five hundred sites of later, attackers don’t need a new exploit, they just need Tuesday.

Because these are real mobile endpoints, the phishing pages they point to only deliver on phones. They block right click, block dev tools, and phone home every tap to a Telegram bot called GroozaBot. The operator likely writes in Arabic and French, which means they’re sorting results by country and language and tuning fast, and, you know, like this one, are really into context. They borrow credibility from the network fabric itself, then chip away at filters by moving slow and local. Billions of texts, none of the neon signs that bulk gateways throw off. Efficient, in that please don’t admire this way.

Now the part that makes me grind my teeth. Basic fairness says the system shouldn’t draft your gear into crime without your knowledge, then send you the bill for cleanup. Yet here we sit. Carriers charge by volume and keep it moving, vendors sell “rugged IoT” to municipalities that budget for purchase but not for maintenance, so firmware stalls and nobody owns patch duty, integrators ship defaults because delivery gets them paid, not security. The public pays now with stolen logins and later with incident response, overtime, and reissuing IDs that never had to be stolen. Meanwhile the crews running this avoid infrastructure costs by conscripting yours, which is quite a business model for people who never filed a DBA.

And it’s not just phishing. The same access can push settings to traffic controllers, read meter data, or brick gear during a strike or an election. If your city’s comms layer doubles as someone’s text blaster, you don’t have an annoyance, you have a reliability problem in a hoodie. That’s the break point. Lights stick on red, meters go silent, remote sites stop listening, and suddenly a scam campaign turns into a service outage with uniforms and overtime. Outages don’t ask about your calendar, and they don’t care who you voted for, which is the sort of bipartisanship nobody wants.

What sticks is ugly because it’s boring. The weak link wasn’t math. It was a box in a closet nobody touched after the ribbon cutting, like floss for a bridge you swear you’ll use later, until the dentist is a sinkhole. That’s a habit, and habits scale. So fix the habit. Count the fleet. Kill default creds. Rotate cloud keys. Treat firmware updates like rent, not like a New Year promise. Put limits on outbound SMS, alert on sudden spikes per SIM, and write contracts that bake in patch timelines and watched access paths with real consequences for missing them. Actual fixes look like boring checklists, not glossy posters about “awareness.” Yes, even if it means spending less on signage, and yes, that meeting will sting, chef’s kiss. This can hit any town, any utility, any business that turned “temporary” gear into “permanent” by forgetting about it. Keep dinner quiet, keep the lights green, and keep your gear doing your work, not theirs. Speaking of which, pass the parmesan and let’s pull the closet door open together.

--Doc (yeah I said it!)
find me anywhere under @DocAtCDI