Loading story…
The US Secret Service has uncovered and disrupted facilities operating SIM servers across the New York tristate area, which are devices capable of managing and coordinating up to 100,000 SIM cards simultaneously. These SIM servers have been identified as tools frequently leveraged by cybercriminals for a variety of illicit activities, including large-scale scamming operations. The Secret Service has raised concerns that, beyond their use in fraud, these devices could be weaponized to launch attacks against critical infrastructure, potentially disrupting mobile networks and communications. The discovery of these facilities highlights the growing sophistication and scale of cyber-enabled fraud operations in the United States. Law enforcement officials have warned that the presence of such high-capacity SIM management devices poses a significant risk to both consumers and businesses, as they can be used to automate and amplify phishing, smishing, and other social engineering attacks. The Secret Service's investigation into these operations is ongoing, with efforts focused on identifying the individuals and criminal groups responsible for deploying and operating the SIM servers. The takedown of these facilities is expected to have a disruptive effect on the cybercriminal ecosystem, at least temporarily reducing the volume of SIM-based scams in the region. Security experts have noted that the use of SIM farms is a growing trend among threat actors seeking to bypass traditional anti-fraud controls and scale their operations. The incident underscores the need for telecommunications providers to enhance monitoring and detection of anomalous SIM activity within their networks. In addition to fraud, the potential for these devices to be used in attacks targeting mobile infrastructure has prompted calls for increased collaboration between law enforcement, telecom operators, and cybersecurity professionals. The Secret Service has advised organizations to remain vigilant for signs of SIM-related fraud and to implement robust authentication measures to mitigate the risk of account takeovers. The exposure of these SIM server operations also raises questions about the adequacy of current regulatory and technical safeguards in preventing the abuse of telecommunications infrastructure. The incident has prompted renewed discussion about the balance between privacy, security, and the need for effective oversight of mobile network operations. As investigations continue, further details about the scale and impact of the disrupted operations are expected to emerge. The Secret Service's actions represent a significant step in combating the misuse of SIM technology for cybercrime and highlight the evolving tactics of threat actors in the digital age.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
A critical Cisco zero-day, CVE-2025-20352, was reported as under active exploitation and affecting as many as 2 million devices. The SNMP-related flaw could let attackers crash systems or obtain root access.
Attackers launched a broad campaign distributing Atomic macOS stealer malware through fake GitHub Pages sites. The operation targeted Mac users with infostealer delivery infrastructure designed to appear legitimate.
A phishing campaign targeted PyPI users in an effort to steal account credentials. The activity threatened software package maintainers and the broader Python package ecosystem.
A malicious npm package masquerading as Postmark MCP was found stealing users' email data. The package represented a software supply-chain threat aimed at developers and downstream users.
Reporting linked BRICKSTORM malware to Chinese threat actors targeting technology and legal organizations. The malware set included stealthy backdoors and credential stealers that could remain undetected for more than a year.
Microsoft identified a phishing campaign in which attackers used AI-generated code to obfuscate malware embedded in SVG files. The activity highlighted growing use of AI techniques in email-borne malware delivery.
UK law enforcement arrested a suspect in connection with a ransomware attack that caused disruption at European airports. No ransomware group had publicly claimed responsibility at the time of reporting.
Jaguar Land Rover suffered a major cyberattack that disrupted operations and halted production worldwide, causing financial and supply-chain impacts. Scattered Spider was suspected, though attribution was not presented as confirmed.
CISA disclosed that a U.S. federal agency was compromised through exploitation of GeoServer vulnerability CVE-2024-36401. The incident established active real-world abuse of the flaw against government infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Secret Service disrupted a large network of over 300 SIM servers and 100,000 SIM cards in the New York area, which posed imminent threats to national security and the UN General Assembly. The devices enabled encrypted communications for threat actors, could disrupt cellular infrastructure, and were linked to threats against senior officials. The investigation is ongoing, with forensic analysis underway and warnings issued about the risk of similar attacks during major events.
Jun 29, 2026
European law enforcement agencies have dismantled a sophisticated cybercrime network that provided phone numbers and SIM cards to criminals, enabling a wide range of fraudulent activities across Europe. The operation, coordinated by Europol, involved authorities from Latvia, Austria, and Estonia, and resulted in the arrest of at least five to seven individuals, including the alleged organizer of the illicit service. During the raids, police seized 1,200 SIM box devices containing 40,000 active SIM cards, as well as five servers and hundreds of thousands of additional SIM cards. The network operated an online platform that allowed criminals to rent phone numbers registered in more than 80 countries, which were then used to create fake accounts on social media and messaging platforms. These accounts facilitated crimes such as phishing, investment scams, account intrusions, credential and financial data theft, extortion, migrant smuggling, and the distribution of child sexual abuse material. Investigators linked the group to over 3,000 cyber fraud cases, with financial losses exceeding 5 million euros ($5.8 million), primarily in Austria and Latvia. The infrastructure supporting the operation was described as highly advanced and professionally organized, featuring a polished website and a global logistics network for procuring SIM cards. The service appeared to operate as a legitimate business, masking its true purpose and scale. Authorities estimate that more than 49 million online accounts were created using the illicit service, allowing criminals to conceal their identities and locations. The operation, dubbed "SIMCARTEL," involved 26 searches in Latvia and was described by Latvian police as unprecedented in scale and complexity. One of the main suspects had a prior criminal history in Estonia, including arson and extortion. The takedown of this network is considered a significant blow to cybercriminals who rely on anonymous phone numbers to evade detection and law enforcement. Europol emphasized the unique and novel nature of the scheme, noting that it posed a new challenge for European authorities. The successful operation demonstrates the effectiveness of international cooperation in combating organized cybercrime. The seized infrastructure and arrests are expected to disrupt ongoing and future cyber-enabled fraud schemes across Europe and beyond. Authorities continue to investigate the full extent of the network's activities and its connections to other criminal enterprises.
Jun 29, 2026
Researchers at Infrawatch said a Belarus-linked platform called **ProxySmart** is powering an industrial-scale mobile proxy ecosystem spanning at least **94 SIM-farm locations in 17 countries**, with **87 internet-exposed control panels** tied to **24 commercial proxy providers** and **35 cellular carriers**. The platform reportedly gives operators centralized management of phones and 4G/5G modems, customer provisioning, tunneling, automated IP rotation, and anti-bot evasion features such as **TCP/IP OS fingerprint spoofing**, allowing mobile traffic to masquerade as desktop systems and making abuse harder to detect. The infrastructure has been linked to spam, phishing, account abuse, bot activity, product scalping, geo-restriction bypass, and broader fraud operations, with researchers warning that weak or absent KYC checks and the legal ambiguity around SIM farms have helped the market scale. Coverage of the findings also pointed to growing law-enforcement pressure, including a 2025 U.S. Secret Service takedown of a large SIM farm near UN headquarters and Europol-backed **Operation SIMCARTEL**, while the UK and other governments move toward tighter restrictions; ProxySmart has disputed the cybercrime framing, saying its software supports legitimate uses such as ad verification, brand protection, cybersecurity research, fraud-model training, and application testing.
Jun 29, 2026