Loading story…
The U.S. Secret Service disrupted a large network of over 300 SIM servers and 100,000 SIM cards in the New York area, which posed imminent threats to national security and the UN General Assembly. The devices enabled encrypted communications for threat actors, could disrupt cellular infrastructure, and were linked to threats against senior officials. The investigation is ongoing, with forensic analysis underway and warnings issued about the risk of similar attacks during major events.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Public reporting said the operation involved roughly 300 SIM servers and about 100,000 SIM cards. Officials warned the setup could have disrupted local cellular service and threatened communications used by U.S. officials and nearby infrastructure.
U.S. Secret Service agents disrupted and seized a large covert cellular operation in the New York City area during the UN General Assembly period. Reports describe the infrastructure as an illicit telecom or SIM-farm network positioned near the UN and assessed as a threat to government officials and critical communications.
12 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcetrustwave.com
Open sourcescworld.com
Open sourcearstechnica.com
Open sourcetherecord.media
Open sourcebankinfosecurity.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Secret Service has uncovered and disrupted facilities operating SIM servers across the New York tristate area, which are devices capable of managing and coordinating up to 100,000 SIM cards simultaneously. These SIM servers have been identified as tools frequently leveraged by cybercriminals for a variety of illicit activities, including large-scale scamming operations. The Secret Service has raised concerns that, beyond their use in fraud, these devices could be weaponized to launch attacks against critical infrastructure, potentially disrupting mobile networks and communications. The discovery of these facilities highlights the growing sophistication and scale of cyber-enabled fraud operations in the United States. Law enforcement officials have warned that the presence of such high-capacity SIM management devices poses a significant risk to both consumers and businesses, as they can be used to automate and amplify phishing, smishing, and other social engineering attacks. The Secret Service's investigation into these operations is ongoing, with efforts focused on identifying the individuals and criminal groups responsible for deploying and operating the SIM servers. The takedown of these facilities is expected to have a disruptive effect on the cybercriminal ecosystem, at least temporarily reducing the volume of SIM-based scams in the region. Security experts have noted that the use of SIM farms is a growing trend among threat actors seeking to bypass traditional anti-fraud controls and scale their operations. The incident underscores the need for telecommunications providers to enhance monitoring and detection of anomalous SIM activity within their networks. In addition to fraud, the potential for these devices to be used in attacks targeting mobile infrastructure has prompted calls for increased collaboration between law enforcement, telecom operators, and cybersecurity professionals. The Secret Service has advised organizations to remain vigilant for signs of SIM-related fraud and to implement robust authentication measures to mitigate the risk of account takeovers. The exposure of these SIM server operations also raises questions about the adequacy of current regulatory and technical safeguards in preventing the abuse of telecommunications infrastructure. The incident has prompted renewed discussion about the balance between privacy, security, and the need for effective oversight of mobile network operations. As investigations continue, further details about the scale and impact of the disrupted operations are expected to emerge. The Secret Service's actions represent a significant step in combating the misuse of SIM technology for cybercrime and highlight the evolving tactics of threat actors in the digital age.
Jun 29, 2026
European law enforcement agencies have dismantled a sophisticated cybercrime network that provided phone numbers and SIM cards to criminals, enabling a wide range of fraudulent activities across Europe. The operation, coordinated by Europol, involved authorities from Latvia, Austria, and Estonia, and resulted in the arrest of at least five to seven individuals, including the alleged organizer of the illicit service. During the raids, police seized 1,200 SIM box devices containing 40,000 active SIM cards, as well as five servers and hundreds of thousands of additional SIM cards. The network operated an online platform that allowed criminals to rent phone numbers registered in more than 80 countries, which were then used to create fake accounts on social media and messaging platforms. These accounts facilitated crimes such as phishing, investment scams, account intrusions, credential and financial data theft, extortion, migrant smuggling, and the distribution of child sexual abuse material. Investigators linked the group to over 3,000 cyber fraud cases, with financial losses exceeding 5 million euros ($5.8 million), primarily in Austria and Latvia. The infrastructure supporting the operation was described as highly advanced and professionally organized, featuring a polished website and a global logistics network for procuring SIM cards. The service appeared to operate as a legitimate business, masking its true purpose and scale. Authorities estimate that more than 49 million online accounts were created using the illicit service, allowing criminals to conceal their identities and locations. The operation, dubbed "SIMCARTEL," involved 26 searches in Latvia and was described by Latvian police as unprecedented in scale and complexity. One of the main suspects had a prior criminal history in Estonia, including arson and extortion. The takedown of this network is considered a significant blow to cybercriminals who rely on anonymous phone numbers to evade detection and law enforcement. Europol emphasized the unique and novel nature of the scheme, noting that it posed a new challenge for European authorities. The successful operation demonstrates the effectiveness of international cooperation in combating organized cybercrime. The seized infrastructure and arrests are expected to disrupt ongoing and future cyber-enabled fraud schemes across Europe and beyond. Authorities continue to investigate the full extent of the network's activities and its connections to other criminal enterprises.
Jun 29, 2026
Major U.S. telecommunications providers have formed the **Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC)** to strengthen real-time threat sharing and collective defense after the China-linked **Salt Typhoon** campaign compromised carrier networks in the United States and abroad. The intrusions, described by Sen. Mark Warner as the worst telecom hack in U.S. history, affected multiple major providers including **AT&T, Verizon, Lumen Technologies, T-Mobile**, and others, with investigators saying the activity has been ongoing since at least 2019 and there is still no clear public evidence the threat actors have been fully removed from communications networks. Officials and reporting said the espionage campaign enabled attackers to move between telecom networks, exfiltrate large volumes of data, and in some cases listen to audio calls in real time while targeting high-value intelligence, government, and political communications. Investigators also found breaches of U.S. lawful intercept systems used for court-ordered surveillance, while a separate suspected China-linked compromise of an FBI surveillance system likely exposed phone numbers of monitored targets; the campaign has also been linked to exploitation of vulnerabilities in **Cisco** routers to gain access to telecom infrastructure.
Jun 29, 2026