Originally Posted By: mlord
All of the reports I have seen indicate that they exploit sub-accounts, and only those for which international calling is enabled: possibly only when enabled for the UK, as mine was.

When they hit an account, it is very abrupt, usually overnight Saturday to Sunday. They hit it hard and continuously (with calls) until Voip.ms belatedly disables the account with a negative balance in the hundreds of dollars.

...
Where/what is the upside for the attacker?

Are they calling numbers that somehow generate revenue for the destination number(s)?