Last week the United Nations General Assembly kicked off in New York City. On the first day, a strange US Secret Service press conference revealed that they had seized 300 SIM Servers with 100,000 SIM cards. Various media outlets jumped on the idea that this was some state-sponsored sleeper cell waiting to destroy telecommunication services around New York. Like me, you may have immediately wondered why some of the photos showed sophisticated racks of servers on shelves while others showed a hodge podge of devices strewn about the bare floor of an otherwise empty apartment.
 |
| photos extracted from USSS reporting |
SIM Pools on Telegram
The most famous of the Chinese Guarantee Syndicates, Haowang Guarantee, is part of the US-sanctioned Huione Pay, “The Largest Illicit Online Marketplace” according to Elliptic and WIRED. Haowang has shifted their business to Tudou Danbao, but their vendors continue to offer SMS Modem Pools and associated hardware and software as part of their Crime-as-a-Service empire. Here’s an ad for one such vendor (with its translation):
Let’s look at the Telegram channel of Annie, a China-based seller of SMS equipment. (In Chinese, these are called “Cat Pools” — I’ll explain why at the bottom of this article.) Most of the posts I’ll show are from Chinese-language Telegram channels, so I’ll include an English translation.
 |
| @Annie068a operates a channel dedicated to selling SMS Gateway equipment |
 |
| Annie offers SMS Modem Pools in a variety of sizes |
SMS Modem Pools have a variety of configurations. The most basic has 8 modem ports with slots for one SIM card each. On the opposite end of the scale, is a 64 port modem with capacity for 512 SIM cards. (Many of those found by the USSS seem to be 32-port modems with 256 SIM cards.) When there are more SIM cards than modem ports message sending rotates between SIM cards.
What does Annie suggest you might use your SMS Pool for? Mostly “Marketing.”
The concept, as Annie explains, is that you can route messages from anywhere in the world and have them sent from an SMS pool sitting in the United States and being sent from a US-based SIM, thus having a US telephone number displayed in the caller id.
SMS Pools for Fraud and Phishing
Other Telegram channels are more blatant with suggesting the type of “Marketing” that one might do with the ability to send Bulk SMS messages to other countries. The Telegram channel “Mini Bulk SMS” provides examples, such as imitating the Irish bank AIB to send phishing emails, or imitating BMF in Austria, Binance in Italy, or doing an Apple refund scam in the US. In SouthEast Asia a major use of Bulk SMS is advertising to gamblers.
An English-speaking Bulk SMS provider, KathyBulkSMS, also is quite blatant about the criminal nature of the messages she suggests. Her service also has the ability to send using “Short Message Code” caller IDs. She particularly recommends imitating Coinbase if spamming in the US and says that her recent campaign, sending 170,000 such messages via Verizon, AT&T, and T-Mobile, was “very effective.”
Cheap SMS Modem Pools and Cheaper SIMs
Not to bust the “Nation-state” theories too hard, but this gear is ridiculously cheap. You can buy most of it used on places like eBay, but the various business-to-business services like “Made In China” have great prices. Here are a couple examples: a 16-modem 512 SIM-slot 4G SMS Gateway is $1,000. A 64-modem 512 SIM-slot 4G/3G/2G offering send and receive SMS can range from $2,400 to $4,000 depending on the configuration and software included.
But what about the SIM cards? Don’t worry, there are many Facebook groups, and many more Telegram channels that will hook you up. The Telegram user @Zoom557 posts to many Facebook groups using the new criminal-friendly “Anonymous Poster” service. On Telegram he is excited about the new $5 SIM cards offered
BaronLiu also uses Facebook to push his Telegram SIM card offerings.
Here are a few of the Facebook groups (all in Chinese) that specialize in SIM card selling. Notice the sizes: 2500 members, 3600 members, 6400 members, and 8700 members. Most of these groups also offer mass account creation and social media spamming services.
One Telegram vendor of SIM cards was proud to be supplying a variety of US SIM cards.
The same vendor shared the photo below. This isn’t USSS in New York. This is a deployment in Thailand using a SIM pool to provide Thai-WhatsApp numbers to customers around the world.
 |
Do eSIMs change the game? Durov has you covered:
Never one to shy away from offering anonymized criminal services to the masses, Pavel Durov has announced that you can now buy world-wide eSIMs from a special app inside Telegram called @Mobile. After choosing your region and country, you choose the eSim you want, and then can purchase it paying with Pavel’s built-in cryptocurrency, TON, or a credit card if you want to be easily traced by law enforcement.
What about those SMS Cats?
While Darcula was certainly a major player, “Little Gray Cat” was my favorite SMisher at the beginning of our work. He loved to show off his “Machine Room” full of iPhones all sending automated (and end-to-end encrypted) Toll Road and Package non-Delivery phish.
It wasn’t until recently I realized the story of why our SMS phishers have so many “Cat-named” things has to do with the slang for the word “modem.” The Chinese term for modem is 调制解调器 (tiáo zhì jiě tiáo qì). Because that’s quite a mouthful, young techies began to refer to their modem simply as 猫 (māo). Here are some of the “Cat” terms I’ve learned in this research:
A “Cat Card” is a SIM card. This is the term to search on Chinese Telegram to find people selling SIM cards and related services.
A “Cat Number” is a virtual number … it may be in an SMS Pool, but it might also be a Google Voice number or other virtual number.
A “Cat Pool” as we’ve already discussed, is an SMS Modem Pool.
