Thread by @mcdaidc

1/5 Another significant capture in #Ukraine. Reported discovery today of a #SIMBox being used to relay Voice calls & SMS and other info to Russian forces (including top leadership of Russian army) & other individuals in #Ukraine. I will explain what this is and how it works.

https://twitter.com/ServiceSsu/status/1503642820527239169

2/5
First the system is comprised of 3 main parts,
1) the SIM Box server - in this case a Hypertone SMB-128 . This handles the control of up to 128 SIM Cards, cycles them when detected etc , and co-ordinates interaction with the #GSM Gateways
hybertone.com/en/pro_detail.…

3/5 Next the GSM Gateways, there are two Hypertone types being used here:
- There are 3x GoIP 8 - VoIP Gateway for 8 Channels being used,
- along with 1x GoIP-4 4 SIM VoIP GSM Gateway.
Both can be used for SMS or Voice

4/5 Lastly the Software, unfortunately unable to make out the logo (anyone identify it?), but it would be used to co-ordinate the messages, call forwarding settings (in and out) etc. Whole system would look like the below.
There is also a Xiaomi Mi AIoT Router AX3600 present

5/5 A significant find as given their comms problems, this reportedly has been used to communicate with top leadership in the Russian forces. Ukrainian mobile opcos have made unprecedented defensive moves, this is '#cyberwar' impacting the battlefield
rusi.org/explore-our-re…

6/5 Extra point - expanding the above, you should never use systems like this for military comms. #SIMBoxes are unreliable and actively hunted by mobile opcos.The use (and detection) of this system is due to #Ukraine aggressively defending the mobile network #SS7/#Diameter space.

This image is from the Hypertone website btw. Manuals for the #Sim Bank and the GSM Gateways are also on the site. hybertone.com/uploadfile/dow…
hybertone.com/uploadfile/dow…