Secret Service disrupts SIM‑farm capable of mass telecom disruption in New York

As the U.N. General Assembly convened, U.S. authorities quietly removed a dense cluster of SIM servers and cards that investigators say could have overloaded mobile networks and disrupted emergency communications across the New York metro area.

Scale and scope of the SIM‑farm seizure

Investigators seized more than 300 SIM servers and roughly 100,000 SIM cards distributed across multiple sites within 35 miles of the United Nations complex. The equipment resembled banks of virtual handsets designed to automate calls and texts at extraordinary volume. Officials said the system could saturate radio access and core network resources, degrade 911 availability, and mask communications among criminal groups. Early forensics point to involvement by nation-state actors coordinating with organized crime, though attribution has not been disclosed. No specific plot against the UN meetings was identified, but the capability was real and expanding.

Why SIM farms pose a critical telecom security risk

Mass device farms can generate signaling storms that overwhelm cell sites and the mobile core, similar in effect to a distributed denial-of-service attack. When combined with automated calling against emergency numbers or mass A2P messaging bursts, the result can be call setup failures, text delays, and service outages. Officials noted the system’s throughput was sufficient to message national-scale populations within minutes, providing a lever to flood networks at will. The operation appeared well financed, with inventory that could have scaled beyond current capacity.

Why it matters now for telecom security and resilience

The convergence of geopolitics, crime-as-a-service, and commoditized telecom gear is shifting network resilience from a theoretical exercise to a live operational concern during marquee events.

Event-driven risk amplified by low-cost automation

Global summits compress communications demand and create well-known patterns in time and place. Attackers no longer need specialized radio jammers to cause harm; they can weaponize legitimate network access at scale using SIM banks, cloud orchestration, and off-the-shelf automation. As 4G/5G densification increases cell counts and signaling complexity, the attack surface grows—especially around venues and motorcade routes where networks are already under strain.

Nation‑state and criminal collaboration dynamics

The alleged use of encrypted channels between nation-state operators and transnational crime rings mirrors broader trends: bulk SMS abuse, TDoS against public safety answering points (PSAPs), OTP fraud via SMS pumping, and mule networks renting residential space for covert infrastructure. These networks blend financially motivated and political objectives, complicating deterrence and response.

How SIM farms attack and degrade 4G/5G networks

Understanding the mechanics helps security and network teams tune defenses and prioritize spend.

RAN congestion and signaling storm impacts

Coordinated bursts from thousands of SIMs can congest the radio access network, triggering RRC connection churn, PRB exhaustion, and increased attach/detach cycles. In the mobile core, spikes in NAS signaling, authentication, and mobility management can degrade session establishment and handovers, impacting bystanders.

Disrupting 911 and public safety communications

Targeted floods to PSAPs can exhaust trunks and agent capacity, while concurrent mobile network congestion slows legitimate 911 call completion. As NG911 transitions PSAPs to IP-based ESInets, the threat surface includes both telephony and data pathways.

A2P abuse and gray‑route exploitation

SIM farms mimic consumer endpoints to bypass enterprise A2P controls and 10DLC policies, enabling mass messaging, OTP interception, and brand spoofing. Combined with number rotation and IMEI spoofing, detection becomes harder without cross-carrier telemetry and device fingerprinting.

Implications for carriers, vendors, and policymakers

This takedown is a stress test for industry readiness across carrier operations, public safety, and regulatory policy.

Carriers: defend against volumetric abuse beyond classic fraud

Operators such as AT&T, T-Mobile, and Verizon should elevate SIM-farm mitigation into mainstream network defense. Priorities include: tighter per-SIM rate limiting and throttling at the PGW/UPF; anomaly detection on attach rates and short message bursts per cell; cross-layer correlation between RAN KPIs and messaging/voice traffic; and fast-path blocking for coordinated floods. Expand SMS firewall policies beyond content to behavioral heuristics. Enforce stricter plan policies and KYC to reduce unlimited-plan abuse. Ensure priority and preemption policies (e.g., Wireless Priority Service and 3GPP QoS/ARP) are tested in event zones.

Public safety: harden PSAPs and accelerate NG911 resilience

State and local agencies should harden PSAPs against TDoS with carrier-level scrubbing, dynamic call filtering, and surge overflow routing. Run red-team exercises during high-profile events. Align with FCC CSRIC best practices and DHS/CISA guidance for communications resiliency. Ensure FirstNet and mutual-aid cellular assets are pre-positioned with coverage augmentation and spectrum management plans.

Policy: close sender identity and routing gaps

Extend authentication and vetting norms from voice (e.g., STIR/SHAKEN) to messaging, building on 10DLC and The Campaign Registry with stronger sender identity and reputation models. Support GSMA FASG-led anti-fraud frameworks, and accelerate adoption of signaling firewalls across SS7, Diameter, and 5G SBA interfaces. Consider mandatory reporting of SIM-bank seizures and interagency sharing of indicators of compromise to aid carriers and vendors such as iconectiv, TNS, Enea AdaptiveMobile Security, Mobileum, and Syniverse.

What enterprises and CISOs should do now

Enterprises are both collateral damage targets and potential amplifiers if their brands or apps are abused.

Reduce reliance on SMS for authentication

Phase in phishing-resistant MFA such as FIDO2 passkeys and hardware tokens. Where SMS is unavoidable, apply fraud controls against SMS pumping and detect abnormal OTP request patterns by ASN, device fingerprint, and velocity.

Plan for communications degradation during events

Assume intermittent mobile outages near high-profile venues. Equip exec protection and incident response teams with multi-carrier eSIMs, satellite messengers as a fallback, and pre-agreed out-of-band channels. Test continuity plans for contact centers and field operations if messaging or voice quality degrades.

A2P brand protection and campaign hygiene

Register A2P campaigns, enforce verified sender policies, and monitor for lookalike SMS domains. Coordinate with providers to block fraudulent short codes and alphanumeric sender IDs quickly.

What to watch next in telecom security

The investigation is ongoing and will shape how industry, government, and vendors recalibrate defenses.

Attribution clarity and copycat risks

Expect clarity on sponsoring actors and whether similar SIM-farm clusters exist in other U.S. metros. Copycats may accelerate before new controls harden.

Carrier coordination and standards updates

Look for joint operator announcements on shared telemetry, faster inter-carrier blocking, and updates from GSMA, 3GPP, and CTIA on anti-abuse frameworks for A2P and emergency traffic protection.

Regulatory actions to watch

Watch FCC and CISA actions on SIM-farm enforcement, NG911 DDoS protections, and potential expansion of sender authentication for messaging. Procurement guidance for public safety networks may prioritize volumetric attack resilience.

Bottom line: the threat actors used legitimate interfaces at illegitimate scale; resilience now hinges on behavior-driven detection, preemption for critical services, and public–private response that moves at attacker speed.