An increase in the targeting of telecommunications and business process outsourcing (BPO) companies has been identified and tied to a new campaign. Researchers detailed that the objective of the campaign is to gain access to mobile carrier networks and perform SIM swapping activity. In most of the analyzed incidents, the adversary gained initial access by impersonating IT personnel through social engineering (via phone calls, SMS, or Telegram). Then, victims were directed to visit credential harvesting websites or to download and run commercial remote monitoring and management (RMM) tools. If multi-factor authentication is enabled, the adversary would either leverage MFA push-notification fatigue, where MFA prompts are continuously sent to the victim until they accept the push challenge or persuade the victim to share their one-time password (OTP). Once the adversary gained access to the victim environment, it established persistence through a variety of non-malicious RMM tools and performed constant (often daily) activity. Researchers emphasized that the adversary operates in “Windows, Linux, Google Workspace, AzureAD, M365 and AWS environments” and has previously accessed SharePoint and OneDrive environments. At this time, the campaign has been attributed with low confidence to the eCrime adversary SCATTERED SPIDER. CTIX will continue to monitor campaigns targeting telecommunications and BPO organizations.