Secret Service Disrupts Extensive NYC Telecom Threat Targeting UN Assembly
Executive Summary
In September 2025, the U.S. Secret Service disrupted a sophisticated illicit telecom infrastructure in the New York City area, uncovering more than 300 servers and over 100,000 SIM cards located near the United Nations General Assembly. The operation identified a network enabling encrypted, anonymous communications allegedly used by foreign actors, criminals, and potentially threat groups to coordinate activities and transmit assassination threats. Investigators warned that the scale of the system posed significant risk, including the theoretical ability to disable cellular networks and disrupt critical communications during high-security events.
This incident highlights rising risks of criminal and nation-state actors leveraging physical telecom infrastructure to subvert detection, illustrating how sophisticated SIM farms and server farms can facilitate large-scale anonymity and attacks. The operation underscores heightened scrutiny on telecom supply chain security during high-profile events and the need for robust infrastructure monitoring.
Why This Matters Now
This case demonstrates how cyber and physical infrastructure threats increasingly intersect, particularly around major geopolitical gatherings. Malicious actors can weaponize telecom assets to disrupt emergency services and communications, making it critical for organizations and authorities to monitor for rogue devices and enforce zero trust network policies.
Attack Path Analysis
Attackers established a distributed network of anonymized SIM cards and servers, likely by compromising telecom infrastructure or misusing provisioning access. They may have escalated privilege by gaining broader access to network management interfaces or telecom back-end systems. Using lateral movement, the adversaries spread operations across multiple geographic sites to maintain redundancy and persistence. For command & control, they enabled covert, encrypted communications for criminal or nation-state actors via the infrastructure. Exfiltration likely involved relaying sensitive communications (e.g., threats, coordination) outside monitored channels. The impact could have ranged from disruption of government and emergency communications to large-scale telecom outages or denial-of-service attacks.
Kill Chain Progression
Initial Compromise
Description
Attackers deployed and secretly managed hundreds of servers and tens of thousands of SIM cards across the NYC area, likely by compromising telecom infrastructure or abusing provisioning channels.
Related CVEs
CVE-2023-47610
CVSS 9.8A heap overflow vulnerability in Cinterion modems' SUPL message handlers allows remote attackers to execute arbitrary code via SMS, potentially compromising communication networks.
Affected Products:
Cinterion Modems – All versions prior to patch
Exploit Status:
exploited in the wildCVE-2018-0171
CVSS 9.8A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or execute arbitrary code on an affected device.
Affected Products:
Cisco IOS and IOS XE Software – All versions prior to patch
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Acquire Infrastructure: Virtual Private Server
Establish Accounts: Social Media Accounts
Active Scanning: Wireless Sniffing
Data Manipulation: Transmit Data Manipulation
Network Denial of Service
Compromise Infrastructure: Domains
Obfuscated Files or Information
Proxy
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Detect and Respond to Unauthorized Wireless Access Points
Control ID: 11.4.7
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management
Control ID: Art. 21
CISA ZTMM 2.0 – Segmentation and Isolation of Critical Assets
Control ID: Network and Environment Segmentation – 4.4.2
NIS2 Directive – Incident Detection & Response
Control ID: Article 21(2)(c)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Direct infrastructure compromise targeting cellular networks, SIM card farms, and encrypted communications poses existential threats to telecommunications operations and regulatory compliance.
Government Administration
Anonymous encrypted threats against U.S. officials during UN General Assembly demonstrate critical vulnerabilities in government communications and emergency response infrastructure security.
Law Enforcement
SIM card farms enabling criminal enterprises to operate undetected undermines law enforcement capabilities and requires enhanced threat detection and anomaly response systems.
Financial Services
Criminal networks using anonymous communications infrastructure pose significant risks to financial institutions through potential fraud, money laundering, and regulatory compliance violations.
Sources
- Secret Service says it dismantled extensive telecom threat in NYC areahttps://cyberscoop.com/secret-service-dismantles-nyc-telecom-threat-un-general-assembly/Verified
- Secret Service dismantles telecom threat around UN capable of crippling cell service in NYChttps://www.latimes.com/world-nation/story/2025-09-23/secret-service-dismantles-telecom-threat-around-un-capable-of-crippling-cell-service-in-nycVerified
- Secret Service disrupts NYC telecom threathttps://cybernews.com/security/new-york-telecommunications-threat-dismantled-us-secret-service-critical-infrastucture/Verified
- Secret Service dismantles telecommunications threat near UN General Assemblyhttps://www.foxnews.com/us/secret-service-dismantles-telecommunications-threat-near-un-general-assembly-new-yorkVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying zero trust segmentation, east-west traffic controls, egress enforcement, and real-time threat detection would have limited adversary movement, exposed unauthorized device networks early, and prevented the use of the infrastructure for persistent, covert communications or wide-area telecom disruption.
Control: Zero Trust Segmentation
Mitigation: Blocked unauthorized infrastructure placement and network access.
Control: Zero Trust Segmentation
Mitigation: Constrained escalation paths using least privilege access.
Control: East-West Traffic Security
Mitigation: Detected or blocked unauthorized lateral movement between distributed sites.
Control: Encrypted Traffic (HPE) & Threat Detection & Anomaly Response
Mitigation: Flagged and inspected encrypted C2 and abnormal remote sessions.
Control: Egress Security & Policy Enforcement
Mitigation: Prevented unapproved data flows and externalization of sensitive traffic.
Limited blast radius and detected destruction attempts in real time.
Impact at a Glance
Affected Business Functions
- Telecommunications Services
- Emergency Response Communications
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of sensitive communications between foreign actors and known criminals; however, specific data exposure details are under investigation.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce zero trust segmentation for device and network onboarding to block rogue infrastructure.
- • Apply east-west traffic security to monitor and restrict internal lateral movement across all telecom and cloud domains.
- • Implement comprehensive egress policy enforcement to detect and prevent unauthorized communications and data exfiltration.
- • Deploy inline encrypted traffic inspection and continual anomaly detection to identify covert C2 usage or abnormal mobile/voice patterns.
- • Ensure all critical infrastructure and multi-site deployments are surfaced in a unified fabric with centralized, real-time policy and threat response.
