Follow
Follow
Follow
Follow
News
In the era of cloud-based provisioning and AI-driven connectivity, even the smallest piece of silicon in your phone—the SIM card—has become a target in global cyberwarfare. My research tracks how SIM and eSIM technologies—long treated as passive identifiers—have become active attack surfaces exploited by nation-states and organized crime.
What’s New (Late 2025): SIM Farms & Phone/Laptop “Farms” at Scale
1) New York UN-week “SIM farm” takedown (Sept 2025)
The U.S. Secret Service dismantled a sprawling network of SIM farms in the New York tri-state area just as world leaders arrived for UNGA. Agents found 300+ SIM servers and >100,000 SIM cards across multiple sites; follow-on searches uncovered another 200,000 cards in New Jersey. Officials warned the network could mass-send texts/calls and potentially disrupt cellular service or emergency communications during a high-risk window. (U.S. Secret Service)
Context: While some telecom experts downplayed the likelihood of a full cellular blackout, all agreed the infrastructure could power large-scale spam, fraud, and swatting—and at scale, stress radio and signaling resources. (Barron's)
2) Europol “SIMCARTEL” operation (Oct 2025)
A coordinated EU action seized 1,200 SIM-box devices, ~40,000 SIMs, and took down 5 servers, linking the service to 3,000+ fraud cases and an estimated €4.5M in losses; authorities say the infrastructure supported tens of millions of fake accounts used for phishing, impersonation, and other crimes. (Europol)
3) India: serial SIM-box crackdowns (Sept–Oct 2025)
Raids in Chennai, Delhi, and Hyderabad seized dozens of high-capacity SIM boxes and hundreds of cards tied to international call-bypass and digital-arrest scams—a reminder that SIM farms operate globally and pivot quickly under enforcement pressure. (The New Indian Express)
4) “Smartphone/phone farms” & laptop farms as parallel threat models
Law enforcement and media briefings around the NYC case highlighted phone/bot farms that simulate fleets of real devices for spam, spoofing, or coordinated campaigns. In a related modality, the U.S. Justice Department disclosed nationwide searches of “laptop farms” tied to North Korean remote-IT schemes—showing how adversaries industrialize device fleets (phones, SIMs, laptops) for identity obfuscation, fraud, and infrastructure stress. (NBC New York)
Legacy SIM Exploits: Commanding the Phone from Afar
SIMjacker (2019). Binary-SMS triggers against the legacy S@T Browser applet enabled silent retrieval of IMEI/location and other SIM Toolkit actions across multiple operators.
WIBattack (2019). Similar abuse via the Wireless Internet Browser applet until operators filtered traffic and purged vulnerable applets.
SIM key theft (2010–2011; revealed 2015). Reported compromise of a major vendor’s internal networks to steal Ki/session keys underscored supply-chain fragility and the cloning/decryption risks on older networks.
eSIM & Remote SIM Provisioning (RSP): Cloud Moves into the Chip
Peer-reviewed analyses of the GSMA consumer RSP stack (SM-DP+/SM-DS, eUICC) map plausible attack paths if servers/PKI are weakly managed, even though no confirmed, at-scale RSP hijack has been publicly documented. Misconfiguration or compromised infrastructure could enable unauthorized profile injection or swaps.
Abusing Remote Provisioning: Three Common Angles
Why SIM/Phone Farms Matter to Critical Infrastructure
Modern Mitigations: What to Ask Your Operator (and Enforce on pLTE)
The Takeaway
As 5G and private-LTE deployments expand, the SIM—physical or embedded—remains a high-value pivot. The late-2025 takedowns show that industrialized SIM/phone farms are no longer fringe; they’re operational, global, and capable of stressing networks, fueling fraud, and masking coordinated campaigns. Security must extend into provisioning systems, supply chains, and the cryptographic lifecycle that defines device identity—governed by zero-trust principles and audited with national-security rigor.
