Loading story…
Researchers at Infrawatch said a Belarus-linked platform called ProxySmart is powering an industrial-scale mobile proxy ecosystem spanning at least 94 SIM-farm locations in 17 countries, with 87 internet-exposed control panels tied to 24 commercial proxy providers and 35 cellular carriers. The platform reportedly gives operators centralized management of phones and 4G/5G modems, customer provisioning, tunneling, automated IP rotation, and anti-bot evasion features such as TCP/IP OS fingerprint spoofing, allowing mobile traffic to masquerade as desktop systems and making abuse harder to detect.
The infrastructure has been linked to spam, phishing, account abuse, bot activity, product scalping, geo-restriction bypass, and broader fraud operations, with researchers warning that weak or absent KYC checks and the legal ambiguity around SIM farms have helped the market scale. Coverage of the findings also pointed to growing law-enforcement pressure, including a 2025 U.S. Secret Service takedown of a large SIM farm near UN headquarters and Europol-backed Operation SIMCARTEL, while the UK and other governments move toward tighter restrictions; ProxySmart has disputed the cybercrime framing, saying its software supports legitimate uses such as ad verification, brand protection, cybersecurity research, fraud-model training, and application testing.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
After the research was reported, ProxySmart challenged the depiction of its software as cybercrime infrastructure. Its technical consultant and PR lead Alex Zak said the platform is a data-path proxy management layer intended for legitimate uses such as ad verification, brand protection, cybersecurity research, fraud-model training, and QA.
Europol-backed Operation SIMCARTEL targeted SIM-box and SIM-farm activity in Latvia and was linked to more than 1,700 cyberfraud cases in Austria and Latvia. The references place this law-enforcement action in 2025, but do not provide a more specific date.
On 2026-04-21, Infrawatch published research describing a shared control-plane operation spanning 87 internet-exposed ProxySmart panels, at least 94 physical SIM-farm locations, 24 proxy providers, and 35 carriers across 17 countries. The report linked much of the infrastructure to a Belarus-linked platform from Minsk and detailed features such as device management, IP rotation, customer provisioning, tunneling, and anti-bot evasion.
In September 2025, the U.S. Secret Service took down a large SIM farm near UN headquarters in New York. Reporting says the site contained more than 300 SIM-based servers and over 100,000 SIM cards.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcezdnet.fr
Open sourcecybersecuritynews.com
Open sourcezdnet.com
Open sourcehelpnetsecurity.com
Open sourceinfrawatch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than **65%** of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly **300–400 billion** queries in early 2025 to more than **500 billion** by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against **IPIDEA**, and recorded a **265%** single-day spike in queries to `ipinfo[.]ipidea[.]io` on January 23. Separate telemetry from Gen Digital linked residential proxy traffic to **7.4 million** malicious incidents affecting **572,000** users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include **Protective DNS**, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Jul 9, 2026
The US Secret Service has uncovered and disrupted facilities operating SIM servers across the New York tristate area, which are devices capable of managing and coordinating up to 100,000 SIM cards simultaneously. These SIM servers have been identified as tools frequently leveraged by cybercriminals for a variety of illicit activities, including large-scale scamming operations. The Secret Service has raised concerns that, beyond their use in fraud, these devices could be weaponized to launch attacks against critical infrastructure, potentially disrupting mobile networks and communications. The discovery of these facilities highlights the growing sophistication and scale of cyber-enabled fraud operations in the United States. Law enforcement officials have warned that the presence of such high-capacity SIM management devices poses a significant risk to both consumers and businesses, as they can be used to automate and amplify phishing, smishing, and other social engineering attacks. The Secret Service's investigation into these operations is ongoing, with efforts focused on identifying the individuals and criminal groups responsible for deploying and operating the SIM servers. The takedown of these facilities is expected to have a disruptive effect on the cybercriminal ecosystem, at least temporarily reducing the volume of SIM-based scams in the region. Security experts have noted that the use of SIM farms is a growing trend among threat actors seeking to bypass traditional anti-fraud controls and scale their operations. The incident underscores the need for telecommunications providers to enhance monitoring and detection of anomalous SIM activity within their networks. In addition to fraud, the potential for these devices to be used in attacks targeting mobile infrastructure has prompted calls for increased collaboration between law enforcement, telecom operators, and cybersecurity professionals. The Secret Service has advised organizations to remain vigilant for signs of SIM-related fraud and to implement robust authentication measures to mitigate the risk of account takeovers. The exposure of these SIM server operations also raises questions about the adequacy of current regulatory and technical safeguards in preventing the abuse of telecommunications infrastructure. The incident has prompted renewed discussion about the balance between privacy, security, and the need for effective oversight of mobile network operations. As investigations continue, further details about the scale and impact of the disrupted operations are expected to emerge. The Secret Service's actions represent a significant step in combating the misuse of SIM technology for cybercrime and highlight the evolving tactics of threat actors in the digital age.
Jun 29, 2026
The FBI warned that cybercriminals are abusing residential proxy networks to mask their identities and relay malicious traffic through consumer and small-business internet connections. Devices may join these networks through SDK partnerships and bandwidth-sharing applications, deceptive “free” VPN terms, malware and backdoors, or compromised IoT devices. The proxy infrastructure can obscure command-and-control traffic and support phishing, account takeover, brute-force attacks, data exfiltration, fraud, spam, and illicit-market operations. A report titled **“SuperProxy: How Residential Proxy Networks Have Become Malware Delivery Platforms”** also identifies residential proxy services as infrastructure for malware delivery. Organizations should restrict unvetted software and bandwidth-sharing tools, promptly patch systems, segment and monitor networks, enforce device and firewall controls, and report suspected compromise to the FBI’s IC3.
Sep 4, 2026