NYC Sim Farm Bust Demonstrates Major Threat to Mobile Networks

“Sim farms” are not something that makes the news much even in cybersecurity circles, but a recent bust made in New York City demonstrates how just a few million dollars could be deployed to cripple regional cell phone towers and jam communications networks.

While this did not appear to be the intent of this particular SIM farm, it was operating at a capacity that would have been great enough to take down NYC mobile towers or DDoS emergency communications networks if so desired. Such operations only require the perpetrators to smuggle some basic equipment into the country and find an apartment or house for rent, at a cost in the low single-digit millions of dollars to present a serious threat to critical infrastructure for even the biggest cities.

Secret Service SIM farm raid uncovers capacity of 100,000 phones

It is not yet clear who was behind the New York SIM farm, but the Secret Service said that two Romanian nationals were prior clients of its “swatting for hire” services and that these two apparently have a prior connection to swatting king Alan Filion, who started serving a four-year sentence earlier this year.

While swatting is what put the Secret Service on to the SIM farm in the first place, this is not the only criminal enterprise it was engaged in. SIM farms of this sort are more commonly found in other countries, and primarily used for fraud; they are a bit more rare in the US due to a ban on the SIM boxes needed to run them, with the equipment in this case apparently smuggled in from China disguised as audio parts. Other ties to organized crime include cocaine and illegal firearms found at the sites.

The SIM farm was thought to cost only a few million dollars in total, for rented apartments in five fairly expensive areas and 300 SIM boxes running about 100,000 SIM cards. Though there is no indication the operators had plans for terrorism, this setup would have been more than sufficient to overwhelm NYC phone towers or DDoS police and emergency communications.

Secret Service involvement began with swatting of members of Congress

Investigation into the SIM farm began due to swatting calls on assorted members of Congress and members of the Trump administration transition team, calls that began in late 2023 and stretched into the present year. The first location to be found was an apartment just outside of New York City; four more residential rentals tied into the same SIM farm were found in Armonk and Queens as well as in cities in New Jersey and Connecticut.

SIM farms are difficult to detect in no small part due to the sheer amount of SIM cards used, which when regularly rotated and routed properly will look like ordinary phones making ordinary calls. Placing them in residences also helps to cover for unusual patterns of activity that might be more readily spotted in a commercial office rental. While this particular incident did not end in some sort of critical infrastructure attack, there is no doubt that nation-state threat actors are considering this approach if they have not put it into play already.