Trying to make heads or tails of this "SIM server" thing from the US Secret Service.

https://www.secretservice.gov/newsroom/releases/2025/09/us-secret-service-dismantles-imminent-telecommunications-threat-new-york

Presumably the denial of service attacks would involve overloading cell networks or overwhelming targets, but I believe there are easier and cheaper ways to do that than with 100K SIMs.

The anonymous communication angle is more interesting. It might be a large-scale cellular "cheese box" that can bounce traffic through multiple accounts. Like Tor, but private.

1/

They talk about multiple sites (the photos appear to show at least two, one looks like a residential apartment and the other an office) "within 35 miles of the UN". That's a pretty big area that includes all of the NYC metro area, which has a lot of other important stuff besides the UN in it. Perhaps some other intel links it to UNGA week.

In any case, if the goal is anonymity, restricting the nodes to one metropolitan area would be odd. So was this just part of a larger network, or what?

2/

They show a big stack of empty SIM carriers from MobileX (a reseller). Again, if the goal is an anonymity network, it would be odd to restrict to a single provider. So were there others?

For most of the things being speculated about here, a bunch of Twilio-type accounts would be far cheaper and less conspicuous than a cellphone farm in space rented in one of the most expensive real estate markets in the US. So I assume whatever it was required the cell capability.

3/

Let's look at the economics here. They mentioned 100K SIMs, each of which presumably had some kind of paid service associated with it. Let's assume $10/SIM. That's $1,000,000 for the accounts. Not dirt cheap, but within the budget of any state actor or large-scale criminal enterprise.

The harder part is renting the physical space anonymously without attracting attention. Maybe some short-term sublets, but that still requires physical presence and local knowledge.

4/

Anyway, it's all weird. The press release talks about specific threats against officials and forensics linking it to natsec threats, so taking this at face value, there's more to this than has been disclosed so far.
Also, the part that suggests that the writers have gotten really lazy lately is that the secret service agent in charge is named “Matt McCool”.

The reporting on this SIM thing has so far been disappointing. Several reports refer to the system as being a "surveillance device", implying perhaps an IMSI catcher/fake base station, but nothing in the photos or the Secret Service's description suggests any capability like that.

The CNN article has some detail not in the USSS press release - most usefully that this was discovered as a result of a swatting case against several government officials.

https://www.cnn.com/2025/09/23/us/swatting-investigation-server-network-discovered

7/

Secret Service traced swatting threats against officials. They found 300 servers capable of crippling New York’s cell system

A Secret Service unit set out to unmask the layers of burner phones, changing phone numbers and SIM cards that were swatting American officials. It ended with the largest seizure of SIM servers and cards they’ve ever seen.

CNN

There appear to have been four locations raided, all just outside Manhattan (but none actually in Manhattan, apparently).

A lot of the reporting seems to be speculation, but it's also likely the USSS may have some additional intel not being reported.

Personally, if we're speculating, I tend to agree that this was more likely a sketchy/illicit commercial operation rather than a hostile state actor setting up for a big attack, but who knows.

8/

In particular, while I agree this kind of setup would be useful for launching a large scale attack against cellular infrastructure, it doesn't appear to be optimized for it. For hostile mischief, I'd probably want something mobile rather than at fixed locations.

But again, it's hard to say what this was for without knowing more about how it was used, which is presumably being investigated right now,

10/

@mattblaze Good analysis. Weird, amateurish, and perhaps meant to phish for $ and/or collect some passwords. 🤷‍♂️
@mattblaze this setup is apparently a common thing in UKR, used by the usual suspects. https://www.youtube.com/watch?v=C2hYOmdOhQ0
Covert Operations and Bot Farms: Russia/Ukraine Case Study | Tradecraft Sunday | #TS19

YouTube

@mattblaze I agreed completely about a "commercial" operation. Since there are unconfirmed (as near as I can tell) reports about nation state actors and criminal gangs using this to bounce through and whatnot, it is at least to me leaning towards a dark web style offering to whoever wants to use it, after they've paid a hefty price. The CNN bit on swatting supports this.

Probably located in New York because someone involved could get the real estate angle worked out, and not because of the UN or any other place.

I will say the techno nerd and former phreak in me finds the whole thing rather entertaining....

@mattblaze I'm glad it's not just me who's looking at some of the statements-of-fact in these news articles and being deeply suspicious. (Figuring out how a mere 100k SIMs could take down manhattan's cell network when the original iPhone launch didn't even manage that is the biggest, but there are definitely lots of other really sus claims in these articles)
@mattblaze I'm glad you posted this, my immediate thought seeing that headline was that "capable of" was doing a LOT of heavy lifting there, and it didn't seem like that would have been the intent behind the setup shown.
@mattblaze These appear to be the devices, its an sms spam setup https://www.youtube.com/watch?v=HbdU6mJiJK0
Ejoin 512 Sim SMS USA Bulk SMS Modem 64 Ports GSM Modem 4G for SMS Online -Customer Engagement

YouTube