T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign

Smishing campaign targeting hotel customers in Luxembourg. The CIRCL MISP event lists six SMS sender phone numbers (NL/UK/ID country codes) that delivered the lure linking to a credential-harvesting page. This rule fires on SMS or mobile-threat-defense telemetry showing inbound messages from any of those senders. Source IOCs are sender numbers only — the source event does not publish the lure URL or landing domain, so URL/DNS coverage is left as a follow-up if those indicators surface. Tagged T1566.002 (Phishing: Spearphishing Link); the SMS delivery angle maps to MISP galaxy "phishing:techniques=sms-phishing".

Intel context

This detection responds to live corpus signal — the intel below is what its ATT&CK technique is exercising right now (recomputed July 14, 2026).

Technique	KEV CVEs	OSINT cites	Active families
T1566.002 Spearphishing Link	5	1	—

KEV CVEs mapped to this technique

Known-exploited vulnerabilities MITRE attributes to this ATT&CK technique — not necessarily to this specific campaign. They establish that the technique is under active exploitation, which is why a detection for it is worth authoring.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2015-5119	Adobe / Flash Player	0.993	—
CVE-2024-21413	Microsoft / Office Outlook	0.947	—
CVE-2024-42009	Roundcube / Webmail	0.834	—
CVE-2023-2533	PaperCut / NG/MF	0.292	—
CVE-2024-27443	Synacor / Zimbra Collaboration Suite (ZCS)	0.195	—

Rule ID: d4809b9b-47f0-54ea-b8ee-7a986643871e
Status: experimental
Level: medium
Log source: category: sms · product: mobile
Date: 2026-06-10
Modified: 2026-06-10
ATT&CK: T1566.002 (signal rollup)
Canonical YAML: t1566-002-luxembourg-hospitality-sms-phish.yml

References

False positives

Legitimate inbound SMS from one of these numbers after the campaign ends (sender-rotation is fast in smishing operations — expect short TTL).
Test traffic from security-awareness platforms simulating the campaign.

Rule YAML

title: 'T1566.002 Spearphishing Link — Luxembourg Hospitality SMS Phishing Campaign'
id: 'd4809b9b-47f0-54ea-b8ee-7a986643871e'
status: 'experimental'
description: 'Smishing campaign targeting hotel customers in Luxembourg. The CIRCL MISP event lists six SMS sender phone numbers (NL/UK/ID country codes) that delivered the lure linking to a credential-harvesting page. This rule fires on SMS or mobile-threat-defense telemetry showing inbound messages from any of those senders. Source IOCs are sender numbers only — the source event does not publish the lure URL or landing domain, so URL/DNS coverage is left as a follow-up if those indicators surface. Tagged T1566.002 (Phishing: Spearphishing Link); the SMS delivery angle maps to MISP galaxy "phishing:techniques=sms-phishing".'
references:
    - 'https://thrunt.me/sigma/t1566-002-luxembourg-hospitality-sms-phish.yml'
    - 'https://www.circl.lu/doc/misp/feed-osint/10a94632-a0a1-4062-a3a5-95fe321ae045.json'
    - 'https://attack.mitre.org/techniques/T1566/002/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-06-10'
modified: '2026-06-10'
tags:
    - 'attack.initial_access'
    - 'attack.t1566.002'
    - 'tlp.clear'
logsource:
    category: 'sms'
    product: 'mobile'
detection:
    selection:
        SenderNumber:
            - '+31613570733'
            - '+447470766507'
            - '+447346922620'
            - '+447990119737'
            - '+447423152571'
            - '+6283180060342'
    condition: 'selection'
falsepositives:
    - 'Legitimate inbound SMS from one of these numbers after the campaign ends (sender-rotation is fast in smishing operations — expect short TTL).'
    - 'Test traffic from security-awareness platforms simulating the campaign.'
level: 'medium'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1566-002-luxembourg-hospitality-sms-phish.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.