Operation TrustTrap Uses 16,800 Domains to Spoof Government Portals
Summary
Cyble researchers report 16,800+ spoofed domains impersonating government services to harvest credentials and payment-card data. The campaign uses deceptive subdomains and hyphens; one infrastructure cluster was assessed as consistent with APT36.
Key points
- Cyble Research and Intelligence Labs identified more than 16,800 domains impersonating government portals, primarily targeting US state services, with lures also aimed at India, Vietnam, and the UK.
- The domains use government-like tokens in non-root subdomains, hyphen manipulation, and inserted benign words to make fraudulent URLs appear trustworthy.
- Fake DMV, toll-payment, and vehicle-registration portals are used to harvest credentials and payment-card information; lures are delivered by SMS and email.
- The researchers found infrastructure concentrated in Tencent Cloud and Alibaba Cloud APAC networks, with Gname.com the dominant registrar in the analyzed dataset.
- Domains were reportedly registered in bulk, sometimes kept dormant, then activated for short periods; researchers observed active URLs in early April 2026 that were unresolvable by late April.
- A distinct cluster was assessed as consistent with APT36 based on India-focused lures and overlapping hosting, registrar, TLD, and domain-generation patterns; this is an attribution assessment, not confirmation of actor responsibility.
- Recommended defenses include parsing registered domains correctly, checking the structural position of government-like tokens, scoring domain risk using registration and hosting signals, and teaching users to recognize root domains.
Article Details
- Attack Vectors
- Government-themed phishing links delivered by SMS and email direct victims to spoofed citizen-service portals.
- Domains place government-looking tokens such as state names and .gov strings in deceptive subdomain positions, with hyphens and benign words used to further obscure the registered domain.
- Fake DMV, toll-payment, vehicle-registration, and other government-service pages are used to harvest credentials and payment-card information.
- Some domains reportedly serve as staging infrastructure that loads credential-exfiltration endpoints or malicious scripts after a victim reaches a spoofed page.
- Defensive Notes
- Use eTLD+1-aware URL parsing and check whether government trust tokens appear in the registered domain rather than only in a subdomain.
- Assess domain risk using registrar, TLD, hosting ASN, and registration-age signals together; pivot on shared infrastructure when investigating campaign clusters.
- Teach users to identify the root registered domain and warn that official payment communications will not arrive by SMS with embedded URLs.
- Review email, proxy, and endpoint controls for detection of the reported domain structures and monitor the supplied indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mass[.]gov-bzyc[.]cc | Domain shown as a fake Massachusetts RMV citation landing page in the reported phishing campaign. |
| DOMAIN | nia[.]gov[.]in[.]in3ymonaq[.]casa | India-targeting spoofed NIA portal example in an infrastructure cluster assessed as consistent with APT36. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationDomains embedded government-looking tokens such as .gov in deceptive subdomain positions to impersonate trusted government URLs.T1071.001 · Web ProtocolsThe article reports HTTPS use with low-cost TLS certificates on phishing and exfiltration infrastructure.T1566.002 · Spearphishing LinkGovernment-themed phishing URLs were reportedly delivered through SMS and email to direct victims to spoofed portals.T1583.001 · DomainsThe campaign reportedly mass-registered lookalike government domains across .bond, .cc, and .cfd TLDs.T1598.003 · Spearphishing LinkFake government service portals, including DMV and toll-payment pages, were used to harvest credentials.
Threat Actors
APT36A distinct infrastructure cluster was assessed with moderate-to-high confidence as exhibiting TTPs consistent with APT36; the article links it to India-targeting lures and overlapping infrastructure.TEMP.LapisThe article lists TEMP.Lapis as another tracking name for APT36; the reported campaign cluster was assessed as consistent with APT36, not definitively attributed to it.Transparent TribeThe article identifies Transparent Tribe as another name for APT36 and describes the associated infrastructure cluster as consistent with that actor, rather than confirming attribution.
Vendors
Alibaba CloudInfrastructure clusters concentrate in Tencent Cloud and Alibaba Cloud APAC nodes with registrar dominance by Gname.com, and a distinct subset of domains shows TTPs consistent with APT36.Dominet (HK) LimitedLtd., Dominet (HK) Limited.Gname.com Pte. Ltd.Gname.com Pte. Ltd., Dominet (HK) Limited, NameSilo LLCNameSilo, LLCNameSilo, LLC accounts for a small fraction.Tencent CloudInfrastructure clusters concentrate in Tencent Cloud and Alibaba Cloud APAC nodes with registrar dominance by Gname.com, and a distinct subset of domains shows TTPs consistent with APT36.
Countries
ChinaInfrastructure clustering reveals overlapping IPs concentrated in Tencent Cloud ASNs (China)IndiaPrimary objective is credential and payment-card harvesting via fake citizen-facing services (DMV, tolls, vehicle registration) across US states and select international targets (India, Vietnam, UK-themed lures).Pakistanexhibiting TTPs consistent with APT36 (also tracked as Transparent Tribe, ProjectM, and TEMP.Lapis) — a Pakistan-nexus threat actor with a well-documented history of targeting Indian government entities, defenseUnited StatesUnited States, India, Vietnam, UK-AdjacentVietnamPrimary objective is credential and payment-card harvesting via fake citizen-facing services (DMV, tolls, vehicle registration) across US states and select international targets (India, Vietnam, UK-themed lures).