FedEx Data Scraping and Telecom Insider Bribes Powered Nationwide iPhone Theft Operation

Federal authorities have broken up an international crime ring that stole thousands of iPhones from porches nationwide [non-paywalled link], arresting 13 people last month after a sophisticated operation that combined high-tech tools with old-fashioned bribery.

The thieves created software to scrape FedEx tracking numbers and paid AT&T store employees to provide customer order details and delivery addresses, according to WSJ, which cites prosecutors. Armed with this information, runners intercepted packages at doorsteps moments after delivery.

Demetrio Reyes Martinez, known online as "CookieNerd," developed code that circumvented FedEx limits on delivery-data requests, while AT&T employee Alejandro Then Castillo used his credentials to track hundreds of shipments and reportedly received up to $2,500 for recruiting other employees. Stolen devices were funneled through Wyckoff Wireless in Brooklyn, a store owned by Joel Suriel, who was already on supervised release from a previous wire-fraud conviction. The merchandise was then shipped overseas for sale and activation.

Read more of this story at Slashdot.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - FedEx Data Scraping and Telecom Insider Bribes Powered Nationwide iPhone Theft Operation
id: 7b27fb53-2171-4da2-a019-d910c2a148c9
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "FedEx Data Scraping and Teleco" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("FedEx Data Scraping and Telecom Insider ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*FedEx Data Scraping and Telecom Insider *"

CommonSecurityLog
| where Message has "FedEx Data Scraping and Telecom Insider "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc