On September 23, 2025, the U.S. Secret Service uncovered a large network of “SIM farms” near New York City, just as United Nations meetings took place. The agency is quietly dismantling these sites, which could have caused widespread telecom disruptions. The operation involves multiple locations with servers and over 100,000 active SIM cards. Although no arrests have been made, officials believe the network is highly organized and possibly linked to nation-state actors.
- Secret Service dismantles large SIM farm network near UN
- SIM farms can send bulk messages, facilitate fraud
- Potential for network overload and service blackouts
- Equipment may be used for surveillance or device cloning
- Organized, well-funded operation possibly linked to nation-states
- Threat highlights risks to critical telecom infrastructure
The investigation revealed the sites contained equipment capable of holding numerous SIM cards. These devices exploit voice over internet protocol (VoIP) technology to send bulk messages and calls. Originally designed for low-cost international calling, this technology now underpins organized fraud, including phishing and scam calls. The devices were concentrated within 35 miles of the United Nations building, raising concerns about their potential use for encrypted messaging with criminal groups or terrorists.
- Monitor for signs of telecom disruptions or suspicious activity near critical infrastructure.
- Enhance security measures for telecom networks in high-profile areas like the UN.
- Investigate further to determine if the equipment was used for espionage or interference.
- Develop protocols to detect and disable large-scale SIM farm operations promptly.
The discovery highlights how simple tools can threaten critical infrastructure and how local vulnerabilities can be exploited globally. Authorities continue to analyze the operation’s scope, emphasizing the need for robust defenses against such technological threats. The ongoing investigation aims to assess whether the system was used for surveillance, communication interception, or device cloning, underscoring the evolving risks in digital security.