#ParsedReport #CompletenessMedium
23-09-2026

Inside a multi stage toll fraud operation targeting Poland

https://cert.pl/en/posts/2026/09/tollfraud-analysis/

Report completeness: Medium

Threats:
Artemis
Joker

Victims:
Polish mobile subscribers, Mobile telecommunications sector

Geo:
Malta, Saudi arabia, Turkey, Indonesian, Jordan, French, Malaysia, Indonesia, France, Netherlands, United arab emirates, Arab emirates, Switzerland, Nederland, German, Nigeria, Polish, Austria, China, Poland, African, Thailand, Greece, Romania, Germany

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1016, T1027.013, T1041, T1053, T1059.007, T1071.001, T1082, T1105, T1132.001, T1140, have more...

IOCs:
Domain: 36
File: 11
Hash: 60
Url: 41
IP: 26

Soft:
Google Play, android, Max Messenger, TikTok, chromium, Unix, Chrome, maxmessenger, pdfviewer

Algorithms:
sha256, xor, hmac, cbc, gzip, aes, md5, base64, aes-cbc

Functions:
getApplicationContext, getClassLoader, getDeclaredMethod, getPackageName, getSimOperator, getMethod, getInstance, getBytes, setTimeout, nextThings, have more...

Win API:
JBridge

Win Services:
CVD

Languages:
javascript, java

Platforms:
arm