DEEP DIVE — When Secret Service agents swept into an inconspicuous building near the United Nations General Assembly late last month, they weren’t tracking guns or explosives. Instead, they dismantled a clandestine telecommunications hub that investigators say was capable of crippling cellular networks and concealing hostile communications.

According to federal officials, the operation seized more than 300 devices tied to roughly 100,000 SIM cards — an arsenal of network-manipulating tools that could disrupt the cellular backbone of New York City at a moment of geopolitical tension. The discovery, officials stressed, was not just a one-off bust but a warning sign of a much broader national security vulnerability.

The devices were designed to create what experts call a “SIM farm,” an industrial-scale operation where hundreds or thousands of SIM cards can be manipulated simultaneously. These setups are typically associated with financial fraud or bulk messaging scams. Still, the Secret Service warned that they can also be used to flood telecom networks, disable cell towers, and obscure the origin of communications.

In the shadow of the UN, where global leaders convene and security tensions are high, the proximity of such a system raised immediate questions about intent, attribution, and preparedness.

“(SIM farms) could jam cell and text services, block emergency calls, target first responders with fake messages, spread disinformation, or steal login codes,” Jake Braun, Executive Director of the Cyber Policy Initiative at the University of Chicago and former White House Acting Principal Deputy National Cyber Director, tells The Cipher Brief. “In short, they could cripple communications just when they’re needed most.”

Sign up for the Cyber Initiatives Group Sunday newsletter, delivering expert-level insights on the cyber and tech stories of the day – directly to your inbox. Sign up for the CIG newsletter today.

How SIM Farms Work

At their core, SIM farms exploit the fundamental architecture of mobile networks. Each SIM card represents a unique identity on the global communications grid. By cycling through SIMs at high speed, operators can generate massive volumes of calls, texts, or data requests that overwhelm cellular infrastructure. Such floods can mimic the effects of a distributed denial-of-service (DDoS) attack, except the assault comes through legitimate carrier channels rather than obvious malicious traffic.

“SIM farms are essentially racks of modems that cycle through thousands of SIM cards,” Dave Chronister, CEO of Parameter Security, tells The Cipher Brief. “Operators constantly swap SIM cards and device identifiers so traffic appears spread out rather than coming from a single source.”

That makes them extremely difficult to detect.

“They can mimic legitimate business texts and calls, hide behind residential internet connections, or scatter equipment across ordinary locations so there’s no single, obvious signal to flag,” Chronister continued. “Because SIM farms make it hard to tie a number back to a real person, they’re useful to drug cartels, human-trafficking rings and other organized crime, and the same concealment features could also be attractive to terrorists.”

That ability to blend in, experts highlight, is what makes SIM farms more than just a criminal nuisance.

While SIM farms may initially be used for financial fraud, their architecture can be easily repurposed for coordinated cyber-physical attacks. That dual-use nature makes them especially appealing to both transnational criminal groups and state-backed intelligence services.

Who Might Be Behind It?

The Secret Service, however, has not publicly attributed the network near the UN to any specific individual or entity. Investigators are weighing several possibilities: a transnational fraud ring exploiting the chaos of UN week to run large-scale scams, or a more concerning scenario where a state-backed group positioned the SIM farm as a contingency tool for disrupting communications in New York.

Officials noted that the operation’s sophistication suggested it was not a low-level criminal endeavor. The hardware was capable of sustained operations against multiple carriers, and its sheer scale — 100,000 SIM cards — far exceeded the typical scale of fraud schemes. That raised the specter of hostile governments probing U.S. vulnerabilities ahead of potential hybrid conflict scenarios.

Analysts note that Russia, China, and Iran have all been implicated in blending criminal infrastructure with state-directed cyber operations. Yet, these setups serve both criminals and nation-states, and attribution requires more details than are publicly available.

“Criminal groups use SIM farms to make money with scams and spam,” said Braun. “State actors can use them on a bigger scale to spy, spread disinformation, or disrupt communications — and sometimes they piggyback on criminal networks.”

One source in the U.S. intelligence community, who spoke on background, described that overlap as “hybrid infrastructure by design.”

“It can sit dormant as a criminal enterprise for years until a foreign government needs it. That’s what makes it so insidious,” the source tells The Cipher Brief.

From Chronister’s purview, the “likely explanation is that it’s a sophisticated criminal enterprise.”

“SIM-farm infrastructure is commonly run for profit and can be rented or resold. However, the criminal ecosystem is fluid: nation-states, terrorist groups, or hybrid actors can and do co-opt criminal capabilities when it suits them, and some state-linked groups cultivate close ties with criminal networks,” he said.

The Broader National Security Blind Spot

The incident during the United Nations General Assembly also underscores a growing blind spot in U.S. protective intelligence: telecommunications networks as contested terrain. For decades, federal resources have focused heavily on cybersecurity, counterterrorism, and physical threats. At the same time, the connective tissue of modern communications has often been treated as a commercial domain, monitored by carriers rather than security agencies.

The Midtown bust suggests that assumption no longer holds. The Secret Service itself framed the incident as a wake-up call.

“The potential for disruption to our country’s telecommunications posed by this network of devices cannot be overstated,” stated U.S. Secret Service Director Sean Curran. “The U.S. Secret Service’s protective mission is all about prevention, and this investigation makes it clear to potential bad actors that imminent threats to our protectees will be immediately investigated, tracked down and dismantled.”

However, experts warn that U.S. defenses remain fragmented. Carriers focus on fraud prevention, intelligence agencies monitor foreign adversaries, and law enforcement investigates domestic crime. The seams between those missions are precisely where SIM farms thrive.

The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.

Hybrid Warfare and the Next Front Line

The rise of SIM farms reflects the evolution of hybrid warfare, where the boundary between criminal activity and state action blurs, and adversaries exploit commercial infrastructure as a means of attack. Just as ransomware gangs can moonlight as proxies for hostile intelligence services, telecom fraud networks may double as latent disruption tools for foreign adversaries.

Additionally, the threat mirrors patterns observed abroad. In Ukraine, officials have reported Russian operations targeting cellular networks to disrupt battlefield communications and sow panic among civilians. In parts of Africa and Southeast Asia, SIM farms have been linked to both organized crime syndicates and intelligence-linked influence campaigns.

That same playbook, experts caution, could be devastating if applied in the heart of a global city.

“If activated during a crisis, such networks could flood phone lines, including 911 and embassy hotlines, to sow confusion and delay coordination. They can also blast fake alerts or disinformation to trigger panic or misdirect first responders, making it much harder for authorities to manage an already volatile situation,” Chronister said. “Because these setups are relatively cheap and scalable, they are an inexpensive but effective way to complicate emergency response, government decision-making, and even protective details.”

Looking Ahead

The dismantling of the clandestine telecom network in New York may have prevented an imminent crisis, but experts caution that it is unlikely to be the last of its kind. SIM farms are inexpensive to set up, scalable across borders, and often hidden in plain sight. They represent a convergence of cyber, criminal, and national security threats that the U.S. is only beginning to treat as a unified challenge.

When it comes to what needs to be done next, Braun emphasized the importance of “improving information sharing between carriers and government, investing in better tools to spot hidden farms, and moving away from SMS for sensitive logins.”

“Treat SIM farms as a national security threat, not just telecom fraud. Limit access to SIM farm hardware and punish abuse. Help smaller carriers strengthen defenses,” he continued. “And streamline legal steps so takedowns happen faster.”

Chronister acknowledged that while “carriers are much better than they were five or ten years ago, as they’ve invested in spam filtering and fraud analytics, attackers can still get through when they rotate SIMs quickly, use eSIM provisioning, or spread activity across jurisdictions.”

“Law enforcement and intelligence have powerful tools, but legal, technical, and cross-border constraints mean detection often outpaces confident attribution and rapid takedown. Make it harder to buy and cycle through SIMs in bulk and strengthen identity verification for phone numbers,” he added. “Require faster, real-time information-sharing between carriers and government during traffic spikes, improve authentication for public alerts, and run regular stress-tests and red-team exercises against telecom infrastructure. Finally, build joint takedown and mutual-assistance arrangements with allies so attackers can’t simply reconstitute operations in another country.”

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

The wars in Ukraine and Gaza must stop. Russia’s February 2022 invasion of Ukraine, a sovereign nation with 1994 security assurances from Russia, has killed or maimed tens of thousands of combatants and civilians. Efforts by President Donald Trump to end this war have failed, with an emboldened Vladimir Putin escalating hostilities in Ukraine, while probing the credibility of NATO, flying drones into Poland and Romania and recently violating Estonia’s airspace. This is the Putin who lamented the dissolution of the Soviet Union in 1991 and vowed to recreate the Russian Empire. And that’s what he’s doing. Georgia and Crimea in 2008 and 2014 was a prelude to his invasion of Ukraine in 2022. The Baltic states - Estonia, Latvia and Lithuania – are next, on Putin’s quest to recreate the Russian Empire.

It's obvious what Putin is doing. He got away with Georgia and Crimea and Putin is confident he’ll prevail in Ukraine with minimal consequences. So, what could the UN do to sanction Russia for its violation of Ukraine’s sovereignty? Indeed, there should be an outcry from the UN demanding that Mr. Putin halt his invasion of Ukraine and enter negotiations with Kyiv.

Iran’s continued refusal to permit UN nuclear inspections and refusal to resume nuclear talks with the U.S. resulted in the reimposition — on September 28 — of sanctions lifted in 2015. So, given that Iran has not changed its attitude and in fact has become more defiant, “snap back” sanctions ban nuclear enrichment, establish an arms embargo and ban tests and transfers of ballistic missiles. It’s clear that Iran wants the option to acquire nuclear weapons capability. A nuclear-armed Iran will be an existential threat to Israel -- an adversary Iran wants to annihilate – and the region.

But for Iran it’s more than acquiring nuclear weapons. Iran is a state sponsor of terrorism, working with its proxies – Hezbollah, Hamas, Houthis -- to destabilize and terrorize the region. On September 17, the Department of State also designated three Iraqi militia groups aligned with Iran as terrorist organizations. These terrorist groups have attacked the U.S. Embassy in Baghdad and bases hosting U.S. and Canadian forces.

Indeed, the human rights situation in Iran is equally dismal. The 2009 presidential election protests and the 2022 killing of Mahsa Amini by the so-called morality police for incorrectly wearing her head scarf sparked national protests that were brutally suppressed by the ruling theocracy. Nationwide arrests and executions were conducted by a weak and corrupt theocracy that was threatened by the public and its outcry for justice and liberty.

The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.

Ensuring that food and water are available to the people of Gaza is a priority objective, as is ending this bloody war. The onslaught in Gaza was caused by Hamas’s October 7 attacks that killed approximately 1,200 people, mostly civilians, and the abduction of 251 hostages. This was the bloodiest day for Israel since its independence on May 14, 1948. Indeed, Hamas is a terrorist organization closely affiliated with Iran, which provides Hamas with the weaponry and support needed for its acts of terrorism.

The situation in the South China Sea could escalate quickly between China and the Philippines. The irony is that a 2016 ruling by a UN-backed arbitration tribunal invalidated China’s expansive claims in the South China Sea, ruling overwhelmingly with the Philippines. The ruling was deemed final and binding, although China has rejected the ruling and continues to defy it.

These are just some of the national security issues the UN should openly discuss and attempt to resolve. The wars and turmoil in Myanmar, Sudan, Yemen, Haiti and Libya also require immediate UN attention. This is the mission of the UN.

This column by Cipher Brief Expert Joseph Detrani was first published in The Washington Times.

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

EXPERT INTERVIEW – The United Nations has reimposed sweeping economic and military sanctions on Iran, ten years after lifting them under the 2015 nuclear deal.

Britain, France, and Germany triggered the “snapback” mechanism, accusing Tehran of nuclear escalation and blocking inspections. Iran had already halted oversight after U.S. and Israeli strikes in June damaged several nuclear sites and military facilities.

President Masoud Pezeshkian insists Iran has no intention of building nuclear weapons, calling the sanctions “unfair and illegal.” But the move marks another blow to the Joint Comprehensive Plan of Action (JCPOA), the deal meant to cap Iran’s enrichment and research while allowing civilian nuclear energy.

Iran accelerated banned nuclear activity after Trump pulled the U.S. out of the deal in 2018, repeatedly dismissing the accord as flawed.

The latest sanctions cut Iran off from global banks, reimpose arms and missile restrictions, and revive asset freezes and travel bans on key officials. Analysts say the measures hit Iran at a fragile moment with its economy shrinking, inflation surging, and the rial collapsing to record lows. Oil sales, foreign investment, shipping, and manufacturing are all expected to take a hit.

The Cipher Brief spoke with longtime Middle East and Energy Analyst Norm Roule, who formerly served as National Intelligence Manager for Iran at ODNI. Roule continues to travel regularly to the region for meetings with high-level officials throughout the Middle East.

Norman T. Roule

Norman Roule is a geopolitical and energy consultant who served for 34 years in the Central Intelligence Agency, managing numerous programs relating to Iran and the Middle East. He also served as the National Intelligence Manager for Iran (NIM-I)\n at ODNI, where he was responsible for all aspects of national intelligence policy related to Iran.

The Cipher Brief: Why are snapback sanctions different from other sanctions already imposed on Iran?

Roule: First, we should touch on what this means for the regime. The sanctions hit Iran at one of its most fragile moments since the late 1980s. The government remains unpopular to an unprecedented degree. Virtually every economic indicator in Iran is poor. Its national security architecture of militias, foreign proxies, Russia, China, and the Revolutionary Guard failed during the recent conflict with Israel and the U.S. The main driver of the regime is to maintain stability as it completes transitions to the post-revolutionary generation of leadership. Despite the absence of large-scale protests, destabilizing national unrest could occur at any time.

Over the past few months, Iran’s diplomats have used the prospect of a nuclear deal and the possibility of sanctions relief as a source of hope for the Iranian people. The return of UN sanctions strips Tehran of one of its few remaining political assets.

The primary difference between the latest sanctions and U.S. sanctions is that these measures are binding on all 193 member states of the United Nations. Iran will, of course, do everything it can to evade sanctions. Russia, China, North Korea, Venezuela, and other Iranian partners who already have a history of violating Iran sanctions are unlikely to enforce these sanctions with enthusiasm.

However, unlike U.S. sanctions, which they have argued could be ignored because they were imposed only by Washington, these sanctions are imposed by the United Nations. This will make it harder for these countries to involve other countries in their own violations. Likewise, it makes it much easier for the U.S. government to seek compliance worldwide due to the legal and reputational risks associated with countries and businesses that we might approach on this issue.

The Cipher Brief: Can you discuss the specific sanctions and your assessment of their likelihood of success?

Roule: First, and most damaging for Iran, these sanctions isolate Iranian banks from a large part of the global financial system and require that UN members prevent the use of their banking systems on sanctioned trade. Hence, Iran has lost the ability to manage its oil revenues through international banks. Instead, it will need to engage in oil bartering or use intermediaries, which is a slower and more expensive process. It will likely reduce its oil sales at a time when Saudi Arabia is trying to reclaim some of the market share lost to Iran in recent years.

Banks understand that Iran will seek to defy sanctions. They also know that there are expensive legal consequences if they fail to undertake due diligence operations to examine transactions and shipments, thereby demonstrating that they have fulfilled their sanctions obligations.

Next, there is the restoration of the conventional arms embargo: This bans traditional arms transfers to or from Iran. This should make it harder for Iran to acquire advanced weapons from Russia and China, but also to sell its weapons systems to Russia, Sudan, and other countries. I will admit that I am not sanguine on the last point.

Third, we have nuclear and missile restrictions: This includes a prohibition on uranium enrichment, reprocessing, heavy-water activities, and ballistic missile technology transfers or tests capable of delivering nuclear weapons (beyond 300 km range). Iran is likely to ignore most of these restrictions and will test the international community as it does so. But I think it will also try to do so in a way that avoids sparking a regime-destabilizing war with Israel or the U.S.

Snapback also restores restrictions on dual-use goods, materials, and technologies that could aid nuclear or missile programs. These sections require increased inspections of Iranian ships and aircraft to prevent the transfer of prohibited materials or goods. For governments and businesses, this requirement will be among the more intrusive and time-consuming, and thus expensive. At the same time, Tehran will game the system by introducing complicated, multi-country layers of shell companies to obtain critical materials. This is where international legal and intelligence partnerships will play an essential role in identifying and neutralizing these networks.

Next, snapback returns asset freezes and travel bans on designated Iranian individuals. This is a rather long list and includes Islamic Revolutionary Guard Corps officials, nuclear scientists, and officials related to their programs, as well as their assets worldwide. Travel bans should be successful. Asset bans are less so, primarily due to the small number of such assets located abroad. These restrictions, however, serve as a powerful reminder to businesses of the reputational impact of doing business with Iran.

What does all of this mean? Join The Cipher Brief Threat Conference - happening October 19-22 in Sea Island, GA. to engage with the world’s leading national security experts to help answer those questions. Apply for your seat at the table today.

The Cipher Brief: Let’s go deeper. Can you break this down by sector? Is there any part of Iran’s economy that will be hurt more than another? Oil seems most likely.

Roule: We should keep in mind that, following the negative impact of the initial sanctions announcement, the effect of sanctions should be understood as corrosive. Further impact is shaped by how seriously and loudly we enforce sanctions, as well as how vigorously and successfully Tehran develops countermeasures.

To begin, Iran started the year in challenging economic conditions. The IMF’s projection for Iran’s GDP was dismal, 0.5%, so negative growth in the coming months would be far from surprising. Indeed, one wonders how it will be avoided.

The snapback announcement caused the Iranian rial to plummet to a new record low of 1.12 million to the dollar. Tehran will have little choice but to inject precious hard currency into the market to sustain its failing currency. I also expect more enthusiasm for the effort to cut some of the zeros from the Iranian currency. Iran’s leaders likely worry that the coming months will see a further weakening of the rial and a spike in inflation, which currently hovers around 43%.

Foreign investment, such as it is, will also take a hit. In 2024, Iran claimed – and probably overstated – that it attracted around $5.5 billion in foreign investment. That minuscule figure will shrink even further.

Let’s talk about sectoral impacts.

Shipping costs for Iran are likely to increase substantially. A significant portion of Iran’s seaborne trade will face new cargo inspections, bans on dual-use goods shipments, insurance difficulties, and possibly even port servicing complications.

Manufacturing and mining will be impacted in terms of both imports and exports as they face new pressures on supply chains and financing. This impact will affect trade with Europe, but it will also dampen Iran’s efforts to establish trade with Africa and complicate its trade relations with Iraq.

Although Iran’s defense industry may not be participating in trade shows, one suspects that its existing trade in drones and light arms will continue. Its current clients – Russia, Sudan, and other African countries, and reportedly Venezuela and Bolivia – may choose to ignore sanctions given their lack of alternative suppliers and animosity with the West.

The impact of sanctions on Iranian oil sales to China will be the most significant, if difficult to assess, in the coming months. Beijing and Tehran have deliberately obscured the payment relationship, and the former has imposed tough terms on Iran. China will view this new phase as an opportunity to offload more goods, machinery, and technology onto the Iranian market, and possibly to negotiate a larger price discount for the oil it acquires.

The use of intermediaries, smaller banks that are outside the scope of international monitoring, and shell firms will also increase costs for Tehran. Last, it isn’t unreasonable to think that Chinese oil sales could contract. Beijing – likely seeing the writing on the wall on this issue – has been building its reserves, and the Saudis and Emirates can fill the missing production, although they won’t discount their oil to match Iran’s prices.

The Cipher Brief: What are Iran’s likely next moves? Is diplomacy dead? What do you say to those who believe military action is expected?

Roule: Iran’s playbook is unlikely to be a surprise. Tehran’s leaders used Western media to issue their side of the story, projecting a blend of confidence, defiance, and dismissal of the impact of sanctions. Once home, Iran’s leaders will show that they won’t stop their nuclear work.

It is likely that even within Iran, the program's future remains under debate, with several options being considered. Tehran’s efforts to maintain close relations with Moscow and Beijing make it likely that it will seek to involve these capitals in its programs. One could imagine Iran dangling IAEA access at some point to gain international acceptance. Three possible programs could emerge in the coming months.

The most likely option is that Iran will seek to rebuild a modernized version of the enrichment and even the conversion facilities destroyed in the Twelve-Day War. This process would be expensive, and, depending on the number and location of facilities, could take years to complete. This option would be consistent with Iranian policy rhetoric but would risk a military attack and an extension of sanctions. The problem with lengthy construction is that this also delays benefits to Iran’s economy.

Tehran could reduce the likelihood of an attack by allowing the IAEA access to the sites or involving Russia or China in the operation and construction of the sites. Such an option, if involving advanced centrifuges, would allow Iran to retain the capability to produce highly enriched uranium, including weaponization levels, in the future should it wish to do so.

A far less likely option is to select a foreign fuel source for domestic reactors to provide power. Since this would mean abandoning a domestic enrichment program, this option is thus improbable in the foreseeable future.

Least likely for now would be weaponization. Such a decision would require Iran’s leadership to believe it could undertake and execute such an activity without discovery by Israeli or Western intelligence and, if discovered, would not face devastating military action similar to the June 2025 war.

In any case, activity at the recently reported Mount Kolang Gaz La facility in Esfahan Province is sufficient to be observable to the West, and as we have recently seen, to draw the attention of Western media, thereby sending a message. I expect construction at the site won’t be very fast until Tehran sees how Israel and the U.S. respond to this announcement and until Iran comes to a conclusion as to what direction it wishes to go in its nuclear program.

Diplomacy on Iran’s nuclear program is far from over, with low-level conversations perhaps taking place in Vienna and European capitals. The international community will remain – and should remain- insistent that the International Atomic Energy Agency (IAEA) gain access to Iran’s nuclear enterprise as soon as possible. Such a return cannot be achieved without engagement and diplomacy. However, it will take time for the politics to cool and a new paradigm of proposals to emerge.

Washington, Europe, and the Gulf will entertain serious proposals from Iran that it will accept a nuclear program that allows the IAEA access it requires. More broadly, Washington is looking for a deal that means Iran won’t have the capacity to build nuclear weapons, or accept constraints on its missile program, and end the regional operations of the Quds Force.

Iran’s current leadership is unlikely to make such a decision until sanctions begin to erode the economy. The death of the Supreme Leader could pave the way for a new generation of leadership, which – while no less assertive and potentially even hostile – might be more willing to be more accommodating on these issues to ensure the survival of the Islamic Republic.

Extreme caution should be exercised when discussing the possibility of military hostilities. The U.S. certainly doesn’t seek to start a war in the region. Israel may conduct military operations in Iran over Quds Force actions. Still, it is hard to see why Israel would argue it needs to undertake a costly military operation simply because Tehran is denying the IAEA access to rubble at Natanz. However, the Twelve Day War has changed the rules. An Israeli or US military attack on Iran is no longer unthinkable. If Iran were to undertake weaponization activity or attempt to conceal weaponization-related equipment or material, some in Tehran probably won’t be surprised if another surgical attack takes place.

Moving to Tehran, it is hard to see what benefits military action brings to Tehran. Iran is operating under some harsh realities. The Twelve Day War made it clear that Israel’s intelligence capabilities within Iran are extraordinary, and there is no reason to believe the capabilities aren’t still in place. If so, any plan would likely be discovered and perhaps neutralized before it could take off. Further, Iran’s air defenses continue to be no match for Israel or U.S. air and missile systems.

Iran’s missiles and drones not only had no strategic impact on the course of the Israeli attack but were significantly reduced in number by Israeli attacks. Iran fought alone in June: neither Russia nor China showed the slightest interest or capability in helping Iran during the June war. A conflict that spread to the region risks costing Iran its détente with the GCC and potentially jeopardizing its support from China. Iran’s population remains disillusioned, and testing their willingness to endure a conflict would be quite the risk. Much depends on specific events and drivers, but current conditions don’t seem to lean towards a regional conflict.

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.