{"id":5217,"date":"2026-04-26T10:36:55","date_gmt":"2026-04-26T10:36:55","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2026\/04\/26\/researchers-uncover-proxysmart-software-powering-90-sim-farms\/"},"modified":"2026-04-26T10:36:55","modified_gmt":"2026-04-26T10:36:55","slug":"researchers-uncover-proxysmart-software-powering-90-sim-farms","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2026\/04\/26\/researchers-uncover-proxysmart-software-powering-90-sim-farms\/","title":{"rendered":"Researchers Uncover ProxySmart Software Powering 90+ SIM Farms"},"content":{"rendered":"
\n

Cybersecurity researchers have uncovered a Belarus-based software platform which\u00a0is helping SIM farm operators support cybercrime on an \u201cindustrial scale.\u201d<\/p>\n

In a new report published yesterday on April 21, Infrawatch said\u00a0that it had identified 87 instances of ProxySmart control panels in 17 countries and 94 phone farm locations. These farms are located across 19 US states, as well as countries in Europe\u00a0and South America.<\/p>\n

\u201cProxySmart is publicly associated with a Belarus-based vendor footprint and offers an end-to-end stack for operating and monetizing a physical farm, including device management, automated IP rotation, customer provisioning, plan enforcement, and anti-bot countermeasures,\u201d the report explained.<\/p>\n

\u201cTechnical analysis indicates operator capabilities consistent with large-scale evasion enablement, including automated IP rotation, remote device control, and network fingerprint spoofing.\u201d<\/p>\n

Read more on SIM farms: Government Set to Ban SIM Farms in European First.<\/em><\/p>\n

SIM farms enable a range of cybercrime activity such as smishing, premium-rate number fraud, bot sign-ups and one-time password interception. They can also be used by nation states, with the Russian authorities using them to spread disinformation in Ukraine.<\/p>\n

A large percentage of this ecosystem is managed by ProxySmart, effectively enabling \u201cSIM Farm as a Service,\u201d Infrawatch claimed.<\/p>\n

\u201cThe platform is marketed as a turnkey solution rather than a tool intended only for highly technical operators,\u201d the report continued.<\/p>\n

\u201cIts public-facing materials advertise a web interface, API, remote access, documentation, and support, presenting SIM farm deployment as a productised commercial setup rather than a specialist engineering effort. This likely lowers the technical barrier to establishing and operating mobile proxy infrastructure.\u201d<\/p>\n

How It Works<\/strong><\/h2>\n

Sold to farm operators via a pricing model dependant on SIM count, ProxySmart provides an end-to-end platform for operating and monetizing mobile proxy infrastructure, including farm management, device control, customer provisioning, retail proxy sales, and payment handling.<\/p>\n

It\u2019s accessible via a web-based control panel and is typically self-hosted by the farm operator, with a reverse proxy deployed in front of the panel to disguise its location, the report claimed.<\/p>\n

ProxySmart supports physical smartphones and USB 4G\/5G modems, with the former enrolled via an unsigned Android APK downloaded from the operator\u2019s site, and the latter managed by the open source ModemManager.<\/p>\n

\u201cBoth device types are orchestrated by the ProxySmart backend service, which Infrawatch observed to be implemented in Python and heavily obfuscated by PyArmor,\u201d the report continued.<\/p>\n

IP rotation for phones is apparently enabled by automatically toggling airplane mode on\/off for three seconds, forcing a reconnection to the cellular network (and reassigned egress IP).<\/p>\n

There\u2019s support for several tunnelling and proxy protocols including OpenVPN, SOCKS5, VLESS, and HTTP proxies, and there\u2019s an OS spoofing feature that lets farm operators to \u201csimulate other OS TCP fingerprints\u201d such as macOS, iOS, Windows, and Android through the web panel.<\/p>\n

\u201cInfrawatch assesses this ecosystem materially lowers the barrier to operating and reselling mobile proxy infrastructure, with limited evidence of meaningful eligibility checks across many downstream providers,\u201d the report concluded.<\/p>\n

\u201cThe combination of carrier-grade NAT, rapid IP rotation, and multi-carrier availability reduces the effectiveness of IP-centric controls and complicates attribution at scale.\u201d<\/p>\n

ProxySmart Responds<\/h2>\n

ProxySmart technical consultant and PR lead, Alex Zak, reached out to Infosecurity<\/em> claiming Infrawatch published its findings without contacting the developer.<\/p>\n

He sent the following statement:<\/p>\n

\u201cProxySmart is a data-path proxy management layer, not a SIM farm. It has no voice primitives, no SMS origination, no interconnect functionality \u2013 the technical capabilities that define the infrastructure dismantled in the Europol and Secret Service cases the research references. Our deployments run on IoT-class cellular equipment authorized by the carriers themselves, in stock configurations, not the amplifier-heavy rack hardware used for SIM-box fraud. The infrastructure underpins legitimate work across advertising verification, brand protection, cybersecurity research, fraud-detection model training, and application QA, alongside the downstream providers visible on the public internet. Our full response to the research, covering the technical, methodological, and process points in detail, is here.\u201d<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Cybersecurity researchers have uncovered a Belarus-based software platform which\u00a0is helping SIM farm operators support cybercrime on an \u201cindustrial scale.\u201d In a new report published yesterday on April 21, Infrawatch said\u00a0that it had identified 87 instances of ProxySmart control panels in 17 countries and 94 phone farm locations. These farms are located across 19 US states<\/p>\n","protected":false},"author":2,"featured_media":5218,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-5217","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"featured_image_urls":{"full":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"thumbnail":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6-150x150.jpg",150,150,true],"medium":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"medium_large":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"large":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"1536x1536":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"2048x2048":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"morenews-featured":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"morenews-large":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"morenews-medium":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6.jpg",300,300,false],"crawlomatic_preview_image":["http:\/\/ft365.org\/wp-content\/uploads\/2026\/04\/5217-0fdddf04-74d6-4868-8518-cc3981426ba6-146x146.jpg",146,146,true]},"author_info":{"display_name":"henry","author_link":"http:\/\/ft365.org\/index.php\/author\/henry\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","_links":{"self":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/5217","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/comments?post=5217"}],"version-history":[{"count":0,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/5217\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media\/5218"}],"wp:attachment":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media?parent=5217"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/categories?post=5217"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/tags?post=5217"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}