A 35-year-old Chinese national was arrested in Bangkok for deploying a base station in a car to transmit fraudulent SMS messages. There is a newspaper article as well as a YouTube video.
[,,] device simulated AIS signals, sending up to 1 million fraudulent messages […] advertised offers requiring users to click dangerous links
Cell-site simulator or Stingrays mimic real cell sites in order to lure mobile devices to connect to them. These devices are commonly used for security and privacy attacks. However, the cost and difficulty to deploy a stingray has come down quite a lot. Back in April, Bangkok police arrested two men who carried a false base station through the Siam Paragon mall in an ordinary backpack.
For an SMS blaster attack a fake network downgrades the user’s connection to legacy 2G. By exposing a fake 2G network mobile devices are lured to establish a connection. This is possible, because 2G is lacking mutual authentication between mobile device and base station. Once connected, the attackers can inject fraudulent SMS payloads with custom metadata. This way completely bypasses the carrier networks.
GSMA’s Fraud and Security Group (FASG) has developed a briefing paper for GSMA members. Google has also published an article on this topic. They also describe security features for Android against such attacks.