Not unless a software patch on the phone introduces significant random variances into the RTT. But yeah, there will be no pretty way to make the network "think"

Not unless a software patch on the phone introduces significant random variances into the RTT. But yeah, there will be no pretty way to make the network "think" you are actually near another far away tower. I bet, however, that this is still possible using a vulnerability in the "ping" method itself, like not sending a random nonce for authentication of responses (so that I couldn't send the "pong" before receiving the ping).