CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

ProxySmart platform identified as core infrastructure for large-scale SIM farm operations worldwide

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A Belarus-based software platform named ProxySmart has been identified as the operational backbone for over 90 SIM farms across 17 countries, enabling large-scale cybercrime and evasion activities. The end-to-end platform supports device management, automated IP rotation via cellular reconnection, remote control, and network fingerprint spoofing, marketed as a turnkey ‘SIM Farm as a Service’ solution accessible to non-technical operators. The infrastructure is used to facilitate activities including smishing, premium-rate fraud, bot sign-ups, OTP interception, and potential nation-state disinformation campaigns.

Timeline

  1. 22.04.2026 13:00 1 articles · 2h ago

    ProxySmart platform exposed as core infrastructure for industrial-scale SIM farms

    Researchers identified ProxySmart as a Belarus-based software platform powering 94 SIM farm locations across 17 countries, enabling large-scale cybercrime operations through automated device management, IP rotation, and network fingerprint spoofing. The platform supports both smartphones and USB modems via obfuscated Python backend, implements cellular-based IP rotation via airplane mode toggling, and includes OS spoofing features in its web panel. Its commercialization as a turnkey solution lowers barriers to establishing mobile proxy infrastructure used in activities such as smishing, fraud, bot sign-ups, and OTP interception.

    Show sources
    Open in new tab

Information Snippets

  • ProxySmart is associated with a Belarus-based vendor and provides an end-to-end platform for operating and monetizing mobile proxy infrastructure, including device management, automated IP rotation, customer provisioning, retail proxy sales, and payment handling.

    First reported: 22.04.2026 13:00
    1 source, 1 article
    Show sources

  • Infrawatch identified 87 ProxySmart control panels linked to 94 phone farm locations across 19 US states and countries in Europe and South America, indicating widespread deployment and operational scale.

    First reported: 22.04.2026 13:00
    1 source, 1 article
    Show sources

  • The platform supports both physical smartphones (enrolled via unsigned Android APK) and USB 4G/5G modems (managed via open source ModemManager), orchestrated by a heavily obfuscated Python-based backend using PyArmor.

    First reported: 22.04.2026 13:00
    1 source, 1 article
    Show sources

  • IP rotation is implemented by toggling airplane mode for three seconds, forcing cellular network reconnection and reassignment of egress IPs, while tunneling/proxy protocols include OpenVPN, SOCKS5, VLESS, and HTTP proxies.

    First reported: 22.04.2026 13:00
    1 source, 1 article
    Show sources

  • ProxySmart includes an OS spoofing feature in its web panel allowing operators to simulate TCP fingerprints of macOS, iOS, Windows, and Android to evade detection.

    First reported: 22.04.2026 13:00
    1 source, 1 article
    Show sources

  • The platform is marketed as a commercial turnkey solution with web interface, API, remote access, documentation, and support, lowering the technical barrier for establishing and operating mobile proxy infrastructure.

    First reported: 22.04.2026 13:00
    1 source, 1 article
    Show sources