11 ms·

Cache of devices capable of crashing cell network is found in NYC

• gnatman 1y ago
  “Cache of Devices Capable of Sending Millions of Spam Political Texts”
• ls612 1y ago
  This seems like at best (for the attackers) a DDoS risk to me?
• belter 1y ago
  https://archive.is/wNpfX https://archive.is/wNpfX
• gubbler 1y ago
  [flagged]
• easyat 1y ago
  What a bizarre story. They say it's an anonymous network. What does that mean when multiple locations with racks of tens of thousands of SIM cards and the supporting equipment are found around NYC area? In order to manage this hardware and the operations around this equipment it would take boots on the ground, at least occasionally, for repairs and maintenance. No mention of arrests or surveillance of any site to try and apprehend anyone related.
  • aesh2Xa1 1y ago
    The details are skimpy. In a CNN article we can see photos and mention that these were housed in apartment units and perhaps other rentals. https://www.cnn.com/2025/09/23/us/swatting-investigation-server-network-discovered https://www.cnn.com/2025/09/23/us/swatting-investigation-ser... EDIT: While the headline on NYT highlights an attack on the towers for disruption, the CNN piece gives more weight to two other uses: (1) criminal communication network and (2) swatting. I think those two make sense. The SIMs would probably hold US numbers and would appear authentic for accessing the US operators' networks.
    • jacquesm 1y ago
      (2) is the thing that brought attention of LE on these, and likely was a very dumb move by one of the users of this system. If just (1) they could have kept it going for much longer, (2) is what brought it down.
      • immibis 1y ago
        (2) shouldn't have brought it down because it's not illegal to be a pipeline for someone else's swatting, though you have to help LE identify who did the swatting to the extent you can (including if that's not at all).
        • jacquesm 1y ago
          A reminder not to take legal advice from HN.
  • trebligdivad 1y ago
    Yeh very weird; I mean if it was just spammers then you wouldn't bothered putting it in somewhere expensive like NY would you?
    • dvdkon 1y ago
      With that many devices, you'd need to have them in some place with very dense cell service.
  • Retr0id 1y ago
    I don't see why you'd actually need any SIMs in the first place if you wanted to DoS a cell tower. My guess is that it's basically just a device farm for either sending spam or receiving activation codes for spam accounts elsewhere. By putting them in a populated area, the increase in traffic is less noticeable.
    • jacquesm 1y ago
      It makes it much harder to nail down exactly where the farm is. You can't just go break down all the doors in a large high-rise and the reflections of the radio signals in the urban canyon will further hamper your ability to pin-point the devices. But you might be able to correlate power consumption or heat signature with activity.
  • bflesch 1y ago
    Could be as simple as faking app downloads for the NYC area to raise the appstore ranking
  • Loudergood 1y ago
    100,000 sims connecting to a cell network in Vermont will crash things. In midtown Manhattan that's a blip.
    • jacquesm 1y ago
      That much capacity could easily overwhelm things that scale poorly. 911 service for instance.
• theturtle 1y ago
  ICE is probably all "we want our stuff back!!!"
• comrade1234 1y ago
  I'm curious how this would work without being traced. Someone is paying rent on the apartments. For the simcards, I think they are all able to call 911 even if they don't have credit/dataplan. They're also able to connect to a tower and take up slots. So probably the only way to financially trace the simcards is the initial purchase.
  • instagib 1y ago
    Can also text 911 now which would overburden the texting protocol network so no one else’s texts will go through. It’s a cell tower jammer and terrorism multiplier. Can’t call or text. It will probably disturb internet service as well. Include a few radio jammers for local police and a few satellite antennas you could create an opportunity then a panic to cover your tracks getting out.
    • iberator 1y ago
      Its relatively hard to jam modern BTS with LTE and 5G. It's part of the design. PTP with fancy modulation helps :p
    • delfinom 1y ago
      I would wager a huge majority of text messages in NYC will go through either RCS or iMessages which skips the SMS layer and instead goes direct to data.
  • jacquesm 1y ago
    SIM cards don't 'call 911', you can call 911 even if there is no SIM card at all, all you need is a working radio.
    • Scoundreller 1y ago
      I wouldn’t be too surprised if the hardware vendors had the bare minimum of ethics to prevent that.
      • 1y ago
• jacquesm 1y ago
  So that's the tip. Makes you really wonder about the iceberg, this raises many more questions than it answers. The UK has criminalized possessing or using SIM farms or related gear in response to these popping up with some regularity. But the operators are pretty clever and know how to hide. I've been thinking about how easy it would be to detect these when you're a telco and I think the signature is unique enough that it should be possible to detect which SIMs are part of a farm, even if you don't know the exact location of the farm.
  • Chance-Device 1y ago
    Since you seem to know about the subject, how are these not immediately found and shut down? It seems like the messages they send could be traced to the sims physical location, and having a massive cluster of thousands of sims just sitting in an apartment also seems like an obvious giveaway. And there’s all the traceability required to rent the locations and buy the equipment. It seems like bothering with this is just asking to get caught.
    • jacquesm 1y ago
      Well, they did get caught. But for that to happen immediately would require a detection method that can point out the presence of a farm with only a few samples. SIMs don't know their 'physical location' and triangulation of signals in these bands in the urban environment is non trivial. Whoever did this likely isn't all that happy that their carefully created infra was used to harass officials, which most likely is the single reason this operation got uncovered in the first place. If it would have just been used for low level crime who knows how long they could have continued to do this. Note that these are not unique to NYC or even to the United States, they've been found in other countries as well, the UK has now criminalized possession or operation of these (but the fines are so low that I don't think it will make much difference).
      • huflungdung 1y ago
        “Triangulation is non trivial” Uh. No it isn’t. SNR between 5 or so masts gives you the exact location of any cell device. This is how $oldemployer used to track them
• tbrownaw 1y ago
  > Officials said the anonymous communications network, which included more than 100,000 SIM cards and 300 servers, could interfere with emergency response services and could be used to conduct encrypted communication. One official said the network was capable of sending 30 million text messages per minute, anonymously. The official said the agency had never before seen such an extensive operation. > Investigators found the SIM cards and servers in August at several locations within a 35-mile radius of the United Nations headquarters. The discovery followed a monthslong investigation into what the agency described as anonymous “telephonic threats” made to three high-level U.S. government officials this spring — one official in the Secret Service and two who work at the White House, one of the officials said. So 100k SIM cards scattered around the middle of New York City. Probably an egress point for scammers and bot farms, and the speculation about local disruptions isn't grounded in anything other than scale?
  • chedabob 1y ago
    Yeah there was this the other day, although I'd expect the hardware for this is much smaller than is shown in the photos in the OP: https://news.ycombinator.com/item?id=45294766 https://news.ycombinator.com/item?id=45294766
    • cootsnuck 1y ago
      Nah it's that size. You need an individual modem for each SIM card because you need a unique IMEI. It's possible each of those SIMs are eUICCs as well which means basically that each card is like a "wallet" with multiple profiles. I've used hardware a decent amount larger than what's pictured in the OP for work. But what I was using wasn't just for SMS. So I needed more sophisticated modems. What they're using looks like a bunch of 64 port modem banks exclusively for SMS. (Oh wait if you mean the devices for what's in the article you linked, then yea, those I'm sure are much smaller and quite different.)
      • foobarian 1y ago
        What kinds of things do these devices get used for in legit enterprises? If you're able to say :-)
• perihelions 1y ago
  Is there a less clickbait-y source? There's no tangible link to the United Nations described in the article; that seems to be a gratuitous flourish. > "several locations within a 35-mile radius of the United Nations headquarters" That's the entirety of New York City! edit to add: This very weird part was actually lifted from the USSS press release, > "These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City." https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york https://www.secretservice.gov/newsroom/releases/2025/09/us-s... ("U.S. Secret Service dismantles imminent telecommunications threat in New York tristate area")
  • tbrownaw 1y ago
    It reminds me of those "how to promote yourself" things about say turning "did routine performance optimizations on the website" into "saved the company $ZZZ million" and such.
  • wildzzz 1y ago
    That quote comes directly from the Secret service press release lol
    • kentm 1y ago
      News organizations should not uncritically repeat press releases like these. It is an ethical failure to do so.
  • lyu07282 1y ago
    [flagged]
    • puttycat 1y ago
      What is nonsense about this story?
      • agwa 1y ago
• wildzzz 1y ago
  Oh lol, this is a scam site. Yes, there are potential other uses for a sim box but mostly they are used for VoIP purposes. It's honestly so hard reading quotes from the US government these days. Cartels, drugs, guns. They make it sound like they interrupted the staging of an assault on the UN when the article actually says that the locations were within 35 miles of the UN headquarters in NYC. This is a significant distance as it covers beyond the 5 boroughs, it's the "tri state area". Like 20M people live in that circle. I highly doubt this is for anything other than VoIP scams.
  • CoastalCoder 1y ago
    > This is a significant distance as it covers beyond the 5 boroughs, it's the "tri state area" Same year as the Phineas and Ferb reboot. Coincidence???
    • jfengel 1y ago
      The "canonical" tri-state area is greater New York City, which stretches into Connecticut and New Jersey. But the lyrics are still stuck in my mind, "The tri state area was the bi state area with an adjacent area, right over there".
  • kotaKat 1y ago
    Yup. This is literally just a cellular grey route site for some shitty VoIP provider, just like the SIM box SMS scams go marching on in other countries. Some operator is shitting their pants right now, probably. The SIM cards come from cheap MVNOs that have dealer arrangements for cheap or free first month activations, then they just set up a handful of SIM boxes and a residential Internet connection back to the mothership (like they did at the captured house with the white Verizon 5G Home router just casually sitting on the floor next to the units). Similarly, I’ve had some friends on US MVNOs themselves that have access to “free” international calling, yet every time they call (the same) international number the receiving party gets a wildly different caller ID from a wildly different country each time (Poland, Moldova, etc). Also dodgy SIM boxes!
    • 1y ago
• josefritzishere 1y ago
  35 miles could be in Stamford, CT or the Jersey shore. They might as well state that it's in the same time zone as the UN.
• mmastrac 1y ago
  Hopefully this is a wakeup call for anyone thinking that phone number validation is sufficient to prevent botting and fraud.
  • tbrownaw 1y ago
    There's no such thing as (completely) "prevent", just substantially reduce by making it more expensive.
    • jandrese 1y ago
      Which makes me wonder how much these guys spent per phone number. If you figure you can use a phone number maybe 2 or 3 times per service before it gets blocked they could create literally millions of accounts with this operation across various services. I don't know what the black market value for a Gmail, Facebook, Instagram, Reddit, HN, etc... account is, but I suspect it is more than the price of a SIM card.
      • qingcharles 1y ago
        About a $1 for a Gmail, IG etc these days. I've used this before when I need to create an IG for a work project without wanting to link it to a personal number: https://www.textverified.com/verifications https://www.textverified.com/verifications
      • xp84 1y ago
        The SIMs pictured in the article are from a carrier called MobileX so that’s the first clue to finding that out. Looks like a couple bucks is enough to get started, but a dealer on the take may have more attractive options and the ability to activate a lot of SIMs without the fuss of signing up accounts with email for each one.
• sunscream89 1y ago
  Well, that is news. The pictures of the confiscated equipment is every phone phreaks orgiastic wet dreams. It is interesting that these sorts of things are going on in the first world, and until discovered anyone vocalizing suspicions of such a thing would be regarded as a paranoid delusional crackpot.
• xrd 1y ago
  Are there ways to prevent this kind of thing using GrapheneOS or FLX1s? Lots of interesting discussions about cell phone networks lately. Fake cell phone towers ICE is using to track people: https://www.forbes.com/sites/the-wiretap/2025/09/09/how-ice-is-using-fake-cell-towers-to-spy-on-peoples-phones/ https://www.forbes.com/sites/the-wiretap/2025/09/09/how-ice-... GrapheneOS (de-googled android) and FLX1s (pure Linux phone): https://news.ycombinator.com/item?id=45312326 https://news.ycombinator.com/item?id=45312326 My question is: are any of these alternatives helpful against these novel attacks? If you are on a phone using a network vanilla provider like tmobile or otherwise, is there any way to prevent your phone from trying to connect to a fake network? If I controlled the entire cell phone stack, like I would with FLX1s, then could I have something like the ssh initial connection signature: The authenticity of host '100.64.0.46 (100.64.0.46)' can't be established. ED25519 key fingerprint is SHA256:yE4jh7gROroduLqbIFcInlUXrpDy8JIpJPc+XvtIpWs. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? Once I accept that sshd endpoint, I know my ssh client will protect me if the sshd changes and I'm experiencing a MITM. It would be a bit of a pain to accept a new cell tower when I'm in a new city, but I could imagine syncing a whitelisted trusted set of cell phone towers (ha, when I think of that the whole idea of "trusted" is laughable). But, at least I would have more insight into when I am getting surveilled. And, I could say "not today ICE!" or "tmobile, idk, please give me my HN fix, I don't even care if you know I'm aware my government is tracking me as I pay the service fee!" I bet a whitelist hosted on github would be faster to update than tmobile installing new cell phone towers so privacy enthusiasts could enable their own safety.
  • toast0 1y ago
    > Are there ways to prevent this kind of thing using GrapheneOS or FLX1s? Prevent what exactly? > If you are on a phone using a network vanilla provider like tmobile or otherwise, is there any way to prevent your phone from trying to connect to a fake network? LTE and beyond have mutual authentication. Your phone will attach to any network for an emergency call, but attachment to LTE requires the network trusts your sim and your sim trusts the network. [1] No trust on first use necessary, because the SIM includes its private keys and public keys for the network. [1] https://www.sharetechnote.com/html/Handbook_LTE_Authentication.html https://www.sharetechnote.com/html/Handbook_LTE_Authenticati...
• Isamu 1y ago
  So they didn’t find the people running it or funding it?
  • catigula 1y ago
    Say, isn't there a country with a bone to pick with the UN that is considered """friendly"""?
    • actionfromafar 1y ago
      Russia?
      • catigula 1y ago
        Who's That Pariah State
    • jchip303 1y ago
      [dead]
    • arresin 1y ago
      If true that’s why their name won’t be published and why we won’t hear about this again. (The country currently committing genocide with us tax payer bought weapons).
    • morellt 1y ago
      I'm so happy at least one other person caught onto this. I figure if it had been a China/Russia/North Korea type actor they would've put it in the headline.
    • cheeseomlit 1y ago
      Maybe they should check the sewers
• bparsons 1y ago
  The photos in the NY Post article make it look like they raided cell phone shops in normal retail locations. It looked more like an engagement/click fraud operation.
  • jandrese 1y ago
    The thing that caught my eye is the power plug needed an adapter to use the US socket. This suggests the hardware was shipped in from overseas.
• pavel_lishin 1y ago
  > The discovery followed a monthslong investigation into what the agency described as anonymous “telephonic threats” made to three high-level U.S. government officials this spring — one official in the Secret Service and two who work at the White House, one of the officials said. > The agency did not provide details about the threats made to the three officials, but Mr. McCool described some as “fraudulent calls.” > Investigators have been going through the data on SIM cards that were part of the network, including calls, texts and browser history. Mr. McCool said they expected to find that other senior government officials had also been targeted in the operation. The article goes out of its way to imply a link between this farm and the threats, but doesn't actually explicitly make that link. The CNN article covering the same story does the same thing: https://www.cnn.com/2025/09/23/us/swatting-investigation-server-network-discovered https://www.cnn.com/2025/09/23/us/swatting-investigation-ser... The Secret Service statement, however, does make that claim explicitly in the first sentence: https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york https://www.secretservice.gov/newsroom/releases/2025/09/us-s...
• pavel_lishin 1y ago
  Both this article and the NYT one strongly implies a link between these farms & the threats to government officials without actually outright stating so.
• t1234s 1y ago
  Do those devices have any legitimate use at all?
  • Maxious 1y ago
    They have lots of illegitimate use that isn't about crashing the cell network like sending out spam https://www.cyberdaily.au/security/9949-sydney-man-arrested-over-massive-sms-phishing-operation https://www.cyberdaily.au/security/9949-sydney-man-arrested-... or allowing people to use in-network free call allowance to instead make voip international calls
  • monerozcash 1y ago
    They are mostly used for legal purposes, even if they might violate contracts with telcos.
  • gol706 1y ago
    I think smaller ones might be useful for network quality testing and mapping. I think carriers drive around with boxes in vehicles to test their own networks reliability and map their competitors.
• MangoToupe 1y ago
  Why are these networks accessible without signing keys in 2025?
  • pengaru 1y ago
    They use legitimate SIM cards, wdyt is the point of them?
• geetee 1y ago
  This is presented as if it's part of something like a terror plot, but my money is on it being related to your car warranty expiring.
  • randomfrogs 1y ago
    Yeah, they are putting two facts together to heavily imply that they are part of a single story, but there is no evidence presented that they are. "UN leaders are gathering!" "There is a huge SIM farm that could disrupt communications!" Both true, but seemingly unrelated. All those car warranty texts have to come from somewhere - this is probably where.
  • 762236 1y ago
    Yes, they were using these to commit crimes, and will miss them.
  • deleted 1y ago
    [deleted]
  • seanieb 1y ago
    It’s not. The Secret Service already has identified nation stare actors as being responsible.
    • wildzzz 1y ago
      That doesn't mean it wasn't money-making scams. North Korea engages in crypto theft all the time.
    • dfedbeef 1y ago
      I'm sure they'll find someone specific eventually
  • ajross 1y ago
    Exactly. And the whole point of a cellular network architecture is that it's resistant to DoS attacks (what the rubes call "unexpectedly heavy usage"). Sure, you can take a cell out with a hundred fake phones, and all the users in that cell will hop to the next one. Or at worst walk a block over to find another. The attack doesn't scale, at all. And even if you wanted to deploy custom hardware to do it, it would be far easier to just use a high power jammer on the band anyway than mucking around with all those SIMs. These are for making actual use of the telecom facilities at scale, with the anonymity you get from burner SIMs. It's fraud, not terrorism.
• jihadjihad 1y ago
  > While forensic examination of these devices is ongoing, early analysis indicates cellular communications between nation-state threat actors and individuals that are known to federal law enforcement. > These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City. Given the timing, location and potential for significant disruption to New York telecommunications posed by these devices, the agency moved quickly to disrupt this network.
  • agwa 1y ago
    These passages are from the Secret Service's press release and are not quoted in the CNN article. Note that a 35 mile radius of the UN includes literally all of NYC and then some. CNN wisely chose to change that to "35 miles of New York City" and not mention the UN at all, as the supposed link is extremely tenuous.
    • mhb 1y ago
      Also unclear whether shutting down the UN would be a desirable outcome.
• hnbear 1y ago
  "It could have overwhelmed cell towers, toppling New York City’s cell service and preventing every Manhattan resident from accessing Google Maps." Seems odd that the most important use they can highlight for cell service in NYC is accessing Google Maps. Not accessing 911, not some other vital use of cell service, but Google Maps. NYC is full of free Wifi all over the place. So many McDs, Starbucks, and other restaurants and sites you can get Google Maps anywhere.
  • Scoundreller 1y ago
    I’ve lived through enough cellular downtimes to have Google offline maps
• JdeBP 1y ago
  Looking at the original press release (https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york https://www.secretservice.gov/newsroom/releases/2025/09/us-s...) and the attached high-resolution photographs, there are things that probably leap out at a Hacker News readership: The Bad Guys are neat with their cable ties, and number their gateway boxes. The Bad Guys went with simple heavy-duty metal garage shelving rather than real racking, seemingly vastly overengineered for the weight of the equipment, as that sort of shelving can hold up to a Mg per shelf UDL. The "WallOfSimBoxes" kit does not sport any rack mounting brackets. The Bad Guys don't use redundant power supplies, or battery backup.
  • JdeBP 1y ago
    By the way, if you want a quick overview of this kind of equipment if you've never seen it before, here's (randomly picked by Bing Shopping) China Skyline's marketing blurb for a similar 64-port SMS gateway: * https://chinaskyline.net/sk-gsm-voip-gateway/esim-64-ports-sms-gateway.html https://chinaskyline.net/sk-gsm-voip-gateway/esim-64-ports-s...
    • foobarian 1y ago
      This is fascinating.
  • Maken 1y ago
    I'm seriously wondering about the practicality of this operation. Wouldn't that many SIMs on the same spot overload any nearby cell tower? And even if the antennas could stand the load, that many SIMs hugging the network without any logical reason (like a parade or a demonstration) is bound to raise alarms at the network operator HQ. If this is a scam operation, I would expect these boxes to be distributed across several locations.
    • delfinom 1y ago
      It's likely a "crime-web" service host. They are probably somewhere in Manhattan or Brooklyn to have enough tower cells to handle it (tis the benefits of a dense city for this type of operation). They probably gradually grew it as their crime web demand rose and flew too close to the sun. It also sounds like they did have multiple locations, but they didn't distribute the modems out enough to flew under the radar longer.
• lo_zamoyski 1y ago
  I wonder what kinds of techniques, if any, these virtual cell phones employ to evade being discovered. You would suspect that they could be discovered through triangulation. Two possibilities: 1. Most if not all of these virtual cell phones are connecting from the same location. 2. Some of these virtual cell phones are connecting from the same location, with the remainder in reserve. In the case of (1), you have both a fixed location and a high saturation that is unlikely. In the case of (2), you could imagine using certain numbers at certain times to simulate the work day or hours during which people are more likely to be at home. Randomization or round robin could produce unlikely patterns, but without them, these virtual phones would be underutilized, save for some kind of cyberattack that would compromise their location. Or the truth simply may be that they aren't doing anything, because no one is watching.
• matt-p 1y ago
  Not sure why, but I find that an astonishingly professional setup. The sim servers clearly haven't really got a legit use at that size - yet they come built with a very professional steel case. Setups even have color coded uplink vs downlink cat5 cables. I mean just very neat and tidy.
  • dfedbeef 1y ago
    How could anyone but professionals know how to have colored cables
  • deleted 1y ago
    [deleted]
• seanieb 1y ago
  Missing the key context: > “While forensic examination of these devices is ongoing, early analysis indicates cellular communications between nation-state threat actors and individuals that are known to federal law enforcement.” https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york https://www.secretservice.gov/newsroom/releases/2025/09/us-s...
  • jandrese 1y ago
    Criminals and intel services using a criminal network? News at 11. The Secret Service is really trying to make hay out of these things being close to UN, but so are millions of other things in the New York City Metro Area. Either they have intelligence they aren't disclosing or someone's try to put a lot of spin on this crime bust.
    • bflesch 1y ago
      If state actor propaganda botfarms operate in this fashion in other cities, we can try to find more of these patterns. Would be interesting to see a drop in youtube, reddit or facebook user activity correlated with such bust.
• tensorlibb 1y ago
  This hardware is fascinating - I've seen other examples of these farms Deployed in Ukraine but does anyone have more info on how these "servers" are orchestrated?
• wildzzz 1y ago
  Here's my guess how this has and will play out: 1. Sim box operators were running multiple locations for sending spam texts, cheap VoIP for scams, and potentially other phone-related crimes. 2. Operators were associated with other criminal gangs. Maybe directly, maybe indirectly. Someone may have been running a drug side-business from a location. 3. Someone uses this sim box operation to send threatening scam messages that happen to reach these government officials. For whatever reason, they take it seriously. 4. Now that the feds and NYPD have raided this sim box operation, they have to justify why they were doing this. It's probably not directly illegal to run a sim box farm so they are going to play up the threat a bit to get more coverage of the investigation. I can assure you, a lot more dangerous criminal activity happened within a 35 mile radius of the UN than some zombie cell phones sending scam texts. While I applaud anyone shutting down scams, the window dressing is embarrassing. Someone has watched too much Blacklist or any of those fantastical police procedurals.
  • dfedbeef 1y ago
    Literally anything the government does from now on is going to be related to discovering terrorist plots. They have to find some way to fit the agenda into that giant post-9/11 loophole.
  • OhMeadhbh 1y ago
    Yeah. Sorta weird USSS is investigating this. Maybe it was originally related to some Treasury-related fraud case. We're close to budget time so they have to demonstrate congress should give them the money they asked for, so it's pretty easy to upgrade some random scam/spam texter to a terrorism case. It's sort of endearing, actually, when they get some adults back in the USSS reporting chain we'll probably see less "imaginative" press releases.
    • bell-cot 1y ago
      Speculation: Some gov't types wanted to shut down the scammers (or whatever they are) - but were not getting much traction with the higher-ups, to actually do something. Vs. after their case was rebranded as "this may be part of a plot to assassinate the President" - suddenly every approval and resource they could want was being push into their laps.
• xnx 1y ago
  My first instinct is this is a normal mobile proxy/bot farm. Also, how would 100,000 phones in a single cell affect the network. Isn't this pretty normal for any major concert or sporting event?
  • deleted 1y ago
    [deleted]
• OhMeadhbh 1y ago
  NYC emergency services use consumer mobile phones for radio comms? News to me.
  • toast0 1y ago
    People in NYC use consumer mobile phones to reach NYC emergency services.
• toss1 1y ago
  >>...early analysis indicates cellular communications between nation-state threat actors and individuals that are known to federal law enforcement. >>These devices were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City. Given the timing, location and potential for significant disruption to New York telecommunications posed by these devices, the agency moved quickly to disrupt this network. What nation-state actor might want to disrupt a major US city during a meeting of the UN General Assembly?
  • psunavy03 1y ago
    Likely one that wanted to plausibly deniably create some kind of chaos via proxy actors.
    • dfedbeef 1y ago
      yeah likely someone somewhere who wanted to do something bad via some kind of other group without us knowing
      • dfedbeef 1y ago
        Good thing we caught whoever it was
      • dfedbeef 1y ago
        I hope whoever it was thinks twice before they try to do whatever they were trying to do again, if they were trying to do it
  • stubish 1y ago
    There is no claim that it had anything to do with the UN General Assembly ('within 35 miles' covers a lot more than the UN General Assembly). They do say senior US officials were targeted.
    • toss1 1y ago
      Umm, that claim is literally a cut-and-paste quote from the US Secret Service announcement (which is why I inserted the ">>" at the beginning of the paragraph to signify the quotation). So YES, there is a specific claim, and it came directly from the USSS, in the exact article heading this topic. The USSS does not merely toss in observations without a basis in their working threat model (unless they've changed since I worked adjacent to them). It may indeed turn out to be unrelated, but the USSS is publicly stating they are treating it as more than a coincidence.
• delfinom 1y ago
  "Within 35 miles" is basically all of NYC and the surrounding suburban area lol. It's a ridiculous statement. This was probably just a phone botnet for online botting purposes, where you want IP addresses in not-obviously-third-world bot countries.
  • sunscream89 1y ago
    They were running an extortion and intimidation campaigns. Remember when Trump was running the second time? Those white Americans who were calling people all throughout America with those moronic threatening messages? Until it happens to you or yours it is hard to comprehend. May the Internet gods provide an audio link.
    • delfinom 1y ago
      Were they? I haven't seen that stated anywhere. The news report from NYTimes does say "the cartels were using it too". >One official, speaking on the condition of anonymity, said agents also found 80 grams of cocaine, illegal firearms, computers and cellphones when they discovered the network. Sounds like literally a mobile botnet and it was probably just leased out access to a range of users. Leasing access to botnets and other resources is 1000% normal in the "crime web" and is a business in of itself rather than being directly part of the crimes. On top of that, a "nation state" attacker isn't going to be giving their employees cocaine, unless its Hamas lolololol.
    • engineer_22 1y ago
      > Remember when Trump was running the second time? Those white Americans who were calling people all throughout America with those moronic threatening messages? I've never heard of this, do you have a source?
      • Helithumper 1y ago
        https://www.reuters.com/legal/republican-operatives-pay-125-mln-robocalls-threatening-black-voters-ny-2024-04-09/ https://www.reuters.com/legal/republican-operatives-pay-125-... https://www.nysenate.gov/sites/default/files/admin/structure/media/manage/filefile/a/2024-11/a11.-national-coalition-on-black-civic-participation-v-wohl.pdf https://www.nysenate.gov/sites/default/files/admin/structure...
• ofrzeta 1y ago
  Where/how do people get 100.000 SIM cards?
  • thenthenthen 1y ago
    100k Not sure. Good question! 100 is easy, in NL you can just grab boxes of them at certain phone shops, Lebara etc. These are free and anonymous. Sometimes they will stop you and say: these are only for clients, other times they are happy if you take the whole box of 100pcs.
  • Steeeve 1y ago
    Walmart
  • stackskipton 1y ago
    Side deal with someone who can buy in bulk like convenience store or cell phone store owner.
  • jandrese 1y ago
    The cards are the easy part. It's setting up 100,000 accounts where you run into trouble. There was some traceable payment methods in use here, which might be how they got busted by the Secret Service. The whole thing could have been fallout from an earlier counterfeiting operation.
  • qingcharles 1y ago
    Looks like they all came from https://mymobilex.com https://mymobilex.com
• xnx 1y ago
  For reference, ~18 million people live within 35 miles of Manhattan. "In addition to jamming the cellular network, he said, such a large amount of equipment near the United Nations could be used for eavesdropping." How could a SIM farm be used for eavesdropping?
  • 2OEH8eoCRo0 1y ago
    How could lots of cellular radios be used to capture data that's in the air?
    • xnx 1y ago
      Yes, this is what I want to know. I didn't think a cell phone (or any number of cell phones) could intercept other phone calls/data. I know a fake cell tower has some capability for that.
      • thenthenthen 1y ago
        Crash the tower (instead of jamming it) and then put up your own fake tower?
        • 2OEH8eoCRo0 1y ago
          It's wireless comms, can't anyone with a radio tune in? The problem is capturing all channels which can be accomplished with lots of radios How are cell signals different from any other radio comms?
          • jandrese 1y ago
            The problem is that it's all encrypted.
            • 2OEH8eoCRo0 1y ago
              Yes I know. I assume a state actor could still use it if not decrypt it.
• deleted 1y ago
  [deleted]
• 1121redblackgo 1y ago
  I really dislike that I cannot trust what comes from .gov right now. Even something as innocuous seeming as this article. That's a big problem.
  • engineer_22 1y ago
    [flagged]
  • eagrt4tdg 1y ago
    Please tell me how the government before this administration, and the one before, and the one before etc was trustworthy?
    • homeonthemtn 1y ago
      "please provide evidence" Provides evidence "No, not that evidence" No thank you.
    • joquarky 1y ago
      If you have nothing to ground yourself upon, then you're just floating In space.
• julianeon 1y ago
  This is pretty low on information but maybe that's how it has to be, since there probably is a tradeoff between covering the investigation & revealing investigative methods that should be kept private.
  • dfedbeef 1y ago
    That's being extremely charitable.
• MountDoom 1y ago
  I made this comment on another thread that ended up getting flagged as dupe, but this is probably not all that mysterious. These SIM boxes are a commercial product you can buy from China: https://cnetross.en.made-in-china.com/product/OSomfpPGJWUH/China-GSM-SIM-Box-VoIP-Gateway-32-Port-512sims.html https://cnetross.en.made-in-china.com/product/OSomfpPGJWUH/C... ...and their purpose is mostly to provide an IP-to-cell-phone-number gateway for SMS spam and phone scams. A real cell phone number is greatly preferable to VoIP phone numbers, which are blocked / flagged at a much higher rate.
• thenthenthen 1y ago
  Looks like those bulk sms ‘gateway’ boxes sold on Ali etc: https://ejointech.shop/products/ejointech-4g-16-port-gsm-voip-gateway-256-sim-goip-gsm-gateway-sim-box-voice-sip-gateway https://ejointech.shop/products/ejointech-4g-16-port-gsm-voi... Edit: removed tracking id
• bhouston 1y ago
  "The agency said on Tuesday that last month it found more than 300 SIM servers and 100,000 SIM cards that could have been used for telecom attacks within the area encompassing parts of New York, New Jersey and Connecticut." Isn't it costly to acquire that many SIM cards? Or maybe they were inactive until they were associated with an account? So it was just to keep allowing for a rotating set of SIM accounts? Are we going to find out that all these cellphones were used to run bots on X or similar?
  • hyperhopper 1y ago
    100k is the number of active cards. It is being reported that they had 2-3x as many cards in total. Seems like a nation-state level attack from somebody that has millions to spend to keep this up their sleeve
    • bhouston 1y ago
      Why even have cards when there are eSims, but maybe cards have some advantages in terms of deniability or something? It sounds sophisticated, but nation state or cartel or something else big?
      • 9cb14c1ec0 1y ago
        Most the these SIM card stations require physical SIM cards, just because they always have.
      • jandrese 1y ago
        Probably because it's way easier to pull a SIM out of the package and stuff it into the reader than it is to go through the QR code/web site/phone app you need to get the eSIM up and running for your provider. What I'm really curious about is the money trail. These cards weren't bought in one off cash purchases or via some penny ante crypto reseller. Someone bought in bulk using real money. They probably had to talk with the salesguy at the MVNO to make an order that large. This kind of thing must leave a footprint.
• trustsafe 1y ago
  [dead]
• abeppu 1y ago
  > "from an operational perspective, we want those behind the network to know that the Secret Service is aware and that we're kind of coming for them." "Kind of"?
• xnx 1y ago
  Imagine how many guns there are "near" (i.e. 3800 sq. miles) the UN!
• dmix 1y ago
  The only interesting bit that makes this sound like something more than a VoiP farm > Telephonic threats to multiple senior U.S. officials this past spring – including multiple people protected by the Secret Service – first triggered the investigation, but officials say the network was seized within the last three weeks. and guns/drugs > Investigators also found 80 grams of cocaine, illegal firearms, plus computers and phones. Maybe cartel tech stuff, but I'm not sure why cartels would mess with threatening politicians.
  • mcny 1y ago
    > 80 grams of cocaine This sounds more like someone's personal property or a small party and not a commercial operation?
    • ahmeneeroe-v2 1y ago
      80 grams is a whole bunch. I agree it isn't "cartel operation" amount, but it is definitely a dealer.
      • jandrese 1y ago
        Yeah, this makes the guy sound like a mid-high end career criminal. Sells coke to Wall Street guys in the morning. Gets shipments of weird hardware during the day that he drives over to buildings and sets up according to their directions. Probably runs crypto scams or card duping or whatever else is good for a buck whenever there is a chance.
      • Scoundreller 1y ago
        Iunno, some people buy years worth of car at a time to save money instead of by-the-weekend as they consume it. If you know of a better risk-free, tax-free ROI than 20%+ in a year
  • cactusplant7374 1y ago
    > The only interesting bit that makes this sound like something more than a VoiP farm The word only is doing a lot of work here. There are also pictures of the equipment.
• sandworm101 1y ago
  Anyone else think the secret service may have just "busted" some sort of NSA program?
  • jandrese 1y ago
    Inside the US? Unlikely. This is physical hardware being shipped to the US, that sort of thing really lacks plausible deniability unlike rolling up phone records in foreign countries that happen to contain American tourist phone calls. If these were found in a foreign country then maybe, but these would be far more likely to be some foreign intel service than the NSA.
    • sandworm101 1y ago
      Unless NSA is listening to the diplomats from other countries. Maybe this is a system to quietly force devices belonging to diplomats onto certain networks/nodes so they can be more easily intercepted. If someone wanted to simply shut down a network, a few basic white noise jammers could block frequencies far more easily/cheaply than a thousand sims.
  • solid_fuel 1y ago
    The NSA doesn't use a bunch of SIM cards on wire racks. If the NSA needs outbound phone numbers, they're more likely to set up a shell company and pretend to be an MVNO or a VOIP telco provider, a couple computers on a cheap cloud host masquerading as a phone provider is a lot easier to manage and hide than a setup like this. This is a pretty common kind of business so it's easy enough to blend in, and it isn't restricted to a single apartment or city. If the NSA wants to eavesdrop on phone calls, they just set up a room inside the relevant phone provider [0]. I think this is more likely a gang operation or a foreign influence operation. Details are thin but it feels like a shady organized crime operation (think quasi-legal, probably advertising as bottom-rate VOIP numbers or text gateways) that got used at one point by a foreign influence operation to make threats and try to interfere in domestic politics. [0] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
• dust42 1y ago
  Probably they were next to sports stadiums. Most of the time there is ample unused cell capacity. Also: the New York marathon hosts 50k+ runners. I don't easily believe that 100k phones distributed over several sites on a 35 mile radius around New York have any impact.
• qafy 1y ago
  What sane cellular carrier would issue tens of thousands of sims to a party like this? There do appear to be a few different colors / designs of sims in the photos but still there has to be some shady back-end dealings with cellular carriers for this to even be plausible.
  • lxgr 1y ago
    Presumably they issued tens of thousands of SIMs to hundreds of accomplices using hundreds of false names each.
  • toast0 1y ago
    The packaging in one of the photos is a MVNO. It's easier to get sims for a MVNO than a carrier, but either way, there's tons of sim card resellers, they have to be getting inventory from carriers/MVNOs. Ask a hundred resellers for 1000 sims each, and you'll get to 100k. 1000 sims may be a lot for some resellers, but is probably small for many of them.
• exabrial 1y ago
  CIA called, wants their equipment back.
• sigmar 1y ago
  That pictures with the sim cards are impressive, mainly with how clean the setup looks. Can even see power/network cords taped down to the floor even underneath the metal shelving[1]. Could it perhaps be espionage related to a downgrade attack? ie force a target's phone to switch to 3G by temporarily overloading/confusing the 4G/5G network. [1] https://www.secretservice.gov/sites/default/files/2025-09/SimBoxes.jpg https://www.secretservice.gov/sites/default/files/2025-09/Si...
• tjopies 1y ago
  There are hundreds of these operations at any one moment in time, some more legit than others (voip dial backs, short message farms for scammers) not sure why they are making this out to be the end all and be all of this type of things. Telcos have the ability to lock these down pretty quickly using proximity of devices alone, but the almighty dollar is more important ;)
  • immibis 1y ago
    It's just another distraction from the unreleased Epstein files. The admin has been doing this periodically since people started asking about the files - taking something mundane and blowing it up into front page news.
• torified 1y ago
  I'm 100% convinced that the UN was under attack... But I'm very surprised there wasn't a copy of Sims 3 visible.
• axydlbaaxr 1y ago
  I'm out of my depth here, but I find it Matt McCool (honestly...) who is head of the WASHINGTON field office is the reporting to have broken this case for the NY Field office. Hmm. PRIOR to his serving in Washington, he was head of the New York Field office...likely from 2021 to early 2024. Hmmmmmmmm. Also, nothing from the FBI or FCC--agencies NORMALLY involved in telecom takedowns. HMMMMmmmmmmmmm. mm. mm.
• more_corn 1y ago
  No. It’s just vanilla spam crime.