Researchers Uncover ProxySmart Software Powering 90+ SIM Farms

Why It Matters

ProxySmart’s commoditization of SIM farms expands the attack surface for cyber‑crime and state‑sponsored disinformation, challenging telecom security and law‑enforcement attribution. The service’s ease of use forces regulators and carriers to rethink SIM verification and network monitoring practices.

Key Takeaways

• ProxySmart identified in 87 panels across 17 countries
• Supports 94 phone‑farm locations in 19 US states
• Offers turnkey “SIM Farm as a Service” platform
• Automates IP rotation via airplane‑mode toggling
• Lowers technical barrier, enabling broader cyber‑crime operations

Pulse Analysis

The rapid expansion of SIM farms has become a hidden engine for a variety of online fraud, from smishing to one‑time‑password interception. Researchers at Infrawatch uncovered a Belarus‑originated software suite called ProxySmart that powers more than 90 farms across 17 countries, including 19 U.S. states. By bundling device management, automated IP rotation, and multi‑protocol proxy support into a web‑based control panel, the platform transforms a complex network of physical smartphones and 4G/5G modems into a commercial‑grade service. This “SIM Farm as a Service” model dramatically reduces the expertise required to launch large‑scale mobile proxy operations.

Technically, ProxySmart leverages simple tricks such as toggling airplane mode to force a new carrier‑assigned IP, while also spoofing operating‑system fingerprints to evade network‑level detection. The backend, written in Python and obfuscated with PyArmor, orchestrates both Android devices via an unsigned APK and USB modems through ModemManager, offering OpenVPN, SOCKS5, VLESS and HTTP proxies. These capabilities enable attackers to rotate IPs at scale, bypass carrier‑grade NAT, and obscure the true source of malicious traffic, complicating attribution for security teams and law‑enforcement agencies alike.

The emergence of a turnkey platform like ProxySmart raises urgent questions for telecom operators, regulators, and security vendors. With pricing tied to SIM count, the service can be rapidly provisioned, making it attractive not only to cyber‑criminals but also to state‑backed actors seeking to disseminate disinformation. Industry responses may include stricter SIM registration, enhanced network‑level analytics, and coordinated takedowns of known farm infrastructure. Monitoring the adoption of such SaaS‑style mobile proxy solutions will be critical to staying ahead of the evolving threat landscape.