Thread by @mcdaidc

🧵A good recent example of #Ukraine contesting the Mobile Network / InfoSec battlespace.

Multiple #SIMBox seizures as part of an "enemy bot farm" network were announced yesterday by the Security Service of Ukraine. 1/6
ssu.gov.ua/novyny/z-pocha…

Technically this is a much bigger setup that the #SIMBox relay discovery from 2 weeks ago, (see my previous thread) which is not surprising as these are more traditional ‘bot farms’ used for signups for social media 2/6

https://twitter.com/mcdaidc/status/1503697414301044739

According to the #SBU, the 5 enemy bot farms in the network used social media (including some banned in Ukraine) to “spread disinformation about a full-scale Russian invasion of our state and spread distorted news from the front”.

This network used 100,000 fake accounts 3/6

On the telecom side, visually this comprises of what looks like Shenzhen Yundatong Technology's Eyondalink 64 SIM GSM Modems.

Presumably these would connect to a server to register and then receive SMSs as part of the fake account setup process 4/6
aliexpress.com/i/400098376274…

Ukraine has been identifying and cracking down on these for years, including recently before the war – here is a somewhat smaller one from February 9th with similar equipment.

But the one announced yesterday is a big one 5/6
vice.com/en/article/4aw…

For a timeline of other developments in the Ukrainian Mobile Network space, that have impacted the war see our latest blog 6/6

blog.adaptivemobile.com/the-mobile-net…