Where is the ringing coming from: who does business creating scam sim farms in Russia

The Ukrainian company GMA supplies its equipment and software to almost the entire network of fraudulent call centers operating against Russians, Izvestia found out. Related manufacturers HyberTone and DBL supply Russia with the necessary SIM boxes for criminals, and GMA programmers develop programs to bypass advanced anti-fraud protection systems. Entire SIM farms are being created directly in Russia, through which calls pass not only from scammers stealing money, but also from curators of the Ukrainian special services preparing terrorist attacks. So, the other day, the Investigative Committee of the Russian Federation reported: a SIM box was found through which calls were received to the criminal who blew up two traffic police officers in Moscow on December 24, 2025. Who and how provides the world of underground telephony with everything necessary is in the investigation of Izvestia.

A Ukrainian from Hong Kong

The vast majority of fraudulent calls received by Russians are made using hardware and software created by the Ukrainian company Global Mind Associated and related firms in China, Hong Kong and Poland, Izvestia has established. We are talking about both the sim boxes themselves and their "stuffing" - programs with which these devices are "flashed" so that they can bypass the anti-fraud protection systems used by telecom operators in the fight against fraudulent calls.

VoIP-GSM gateways of the GoIP series are the most popular among Internet scammers, Izvestia determined by examining ads in profile Telegram chats and live footage (in cases where law enforcement agencies covered the offices of scammers).

At the same time, the world's largest manufacturers of GoIP gateways are two affiliated companies HyberTone and DBL, registered at the same address in Shenzhen, China. The only partner on the HyberTone website is the GoAntiFraud cloud service, and the contact person is someone named Alex Nyman. This is the pseudonym behind which Alexey Bondarchuk, a native of Kiev, was born in 1989, was established by Izvestia. In particular, it is on Bondarchuk's phone that the Facebook account (owned by Meta Corporation, whose activities are recognized as extremist and banned in the Russian Federation) "Alexey Bondarchuk (Alex Nyman)" is registered.

Izvestia studied the resumes of several Ukrainian IT specialists with experience in GoAntiFraud. Almost all of them also indicate the Kiev company Global Mind Associated (GMA) as one of their places of work, the CEO of which, according to the register of Ukrainian legal entities, is the same Alexey Bondarchuk.

Global Mind Associated has been operating since 2014, the official field of activity is "software development for VoIP communications". And GoAntiFraud is, in fact, a GMA project, a service through which firmware updates for GoIP boxes are sent to customers, interlocutors familiar with the underground telephony market explained to Izvestia.

In other words, it is Global Mind Associated that creates firmware that allows SIM boxes to bypass the protection against fraudulent calls introduced by telecom operators. "Stitched" SIM boxes simulate that the SIM cards inside it belong to ordinary subscribers: they can call each other back, visit pages on the Internet, connect to different communication towers, imitating the movement of the device, generate its unique number (IMEI).

Showcase Instances: How Hackers Distribute Spyware through App Stores

Attackers disguise their software as useful services to steal data.

There is no mention of the GoAntiFraud service on the official GMA website. The conspiracy measures taken by Bondarchuk's company are understandable. The GoAntiFraud service has been in the field of European cybersecurity experts for a long time.

According to experts from the Paris Polytechnic Institute, from 2013 to 2023, more than two thousand fraudsters from 31 countries used the service. The same researchers have found that GoIP gateways are the least vulnerable to phone fraud prevention systems, so fraudsters usually choose them. In June 2022, as part of a large-scale raid by Chinese law enforcement agencies, almost three thousand GoIP SIM boxes manufactured by HyberTone were seized, which were used for remote fraud from abroad.

The GoAntiFraud service would seem to be Hong Kong-based (judging by the site, its programmers work there), but the domain name GoAntiFraud.com It was registered in 2016 by the Ukrainian company Dominant Telecom (registered in the city of Merefa, Kharkiv region).

Judging by the license agreement posted on the GoAntiFraud website, another company participating in the scheme, New Age Technologies Group, is selling software for GoIP boxes represented by CEO Alexey Bondarchuk. According to the North Data search engine of European companies, she is registered in Krakow, Poland, where she regularly pays taxes.

GoIP in Russia

According to the Popular Front, up to 80% of fraudster calls in Russia are made through "gray" SIM cards using SIM boxes. And GoIP series gateways are perhaps the most popular SIM boxes used by scammers in Russia, Izvestia determined by examining an array of ads for their purchase, sale and rental.

Fraudulent call centers focused on Russia, as a rule, use ready-made solutions, renting already functioning communication channels ("sips" in the slang of market participants). To enter the market with such an offer, it is necessary to purchase SIM boxes, flash them using GoAntiFraud, rent an apartment where to place a similar SIM farm, hire and train its administrator. Illegal services are actively advertised on specialized forums and messengers.

The cost of renting one VoIP-GSM SIP is $80-100 per day, while SIM boxes can provide simultaneous operation of several dozen communication channels. One of the most popular GoIP 32 gateways on the shadow market (for 32 SIM cards) can generate revenue of $2.5 thousand per day or over $60 thousand per month when fully loaded.

However, participants in the underground telecom market explained to Izvestia that the costs of this kind of business are high. The main expense item is SIM cards, which are regularly blocked due to the security measures taken by telecom operators. At the same time, the cost of a working SIM card of a Russian operator from wholesalers is $20-25.

Under the guise of a potential client, the Izvestia correspondent managed to obtain instructions on how to use communication channels through which the key risks of blocking can be traced. In particular, it is recommended to avoid a certain set of keywords and phrases in conversations with victims that can serve as a trigger for anti-fraud protection systems. Among them are "passport data", "message code", "SVO", "military enlistment office", "debt". The reason for blocking may also be the high activity of the call center operator.

"Trigger words are a direct signal for anti—fraud. Change the wording, speak softly, and your lines will live longer," the organizers of illegal communication channels tell potential customers.

The organizers of the communication channels do not advertise their nationality, but Izvestia managed to find out that the accounts from which illegal telephony services are advertised are registered to Ukrainian numbers serviced by the Kyivstar operator. At the same time, the telephony hardware itself — SIM farms and their administrators - operate in Russia.

— People are recruited to service SIM boxes through profile chats in Telegram. Next, an apartment is rented, the curator brings the SIM box, SIM cards, laptop and instructs the person. Administrators are chatting with call centers and changing cards if they are blocked, and also updating equipment settings if necessary," Amin Stigal, an IT expert familiar with the "kitchen" of fraudsters, told Izvestia.

Bodies of days gone by: Russians attacked with deepfakes from 2016

Scammers collect photos of participants of flash mobs for subsequent blackmail

Judging by the profile chats, the recruitment of administrators of VoIP-GSM gateways is currently carried out with priority to regions geographically close to Ukraine. One of the most popular destinations is Crimea. The Izvestia correspondent, who turned to one of the illegal telecom operators in search of a "job", was offered vacancies in Sevastopol, Simferopol and Rostov-on-Don.

A sim box administrator can earn from 12,000 rubles per shift lasting 10-12 hours, but the work involves a fairly high risk, Amin Stigal added. Systems are being actively implemented in Russia to calculate the geolocation of illegal GSM gateways, including using artificial intelligence technologies.

At the same time, administrators of sim boxes can be recognized as accomplices in fraudulent schemes and even terrorist attacks. So, on May 26, 2025, the Voroshilovsky District Court of Volgograd sentenced two gateway administrators to six and four years in prison on charges of complicity in large-scale fraud.

The investigation found that at least eight crimes were committed with the help of the gateways and SIM cards used by them in different regions of the country, the amount of damage ranged from 80 thousand to 2.2 million rubles. At the trial, the defendants claimed that they did not know that they had participated in the fraud. But the court decided that the criminals were well aware of the criminal nature of their activities.

On the night of December 24, an explosion occurred on Yeletskaya Street in Moscow, which killed two traffic police inspectors and the bomber himself. Later, representatives of the Investigative Committee reported that the criminal's actions were coordinated through calls from a call center. Moreover, the SIM box through which these calls went was discovered, and three people connected with his work were arrested. They were charged under Article 274.3 of the Criminal Code of the Russian Federation "Illegal use of a subscriber terminal for traffic or a virtual telephone exchange to commit a crime or with serious consequences."

This is a new article of the Criminal Code, which became effective on September 1, 2025. Nevertheless, judging by regular reports of arrests of sim farm administrators, the number of people willing to make money on criminal telephony is not decreasing, and the most "high-margin" equipment can be purchased in Russia without problems.

There is no ban on the sale of VoIP-GSM gateways in Russia, as these devices are used quite legally. GoIP equipment in Russia (still legal, not stitched to bypass anti-fraud systems) is sold by several Internet sites with varying degrees of transparency. Prices for SIM boxes range from 8 thousand rubles for a simple model for one SIM card and up to 460 thousand for a device with the ability to connect 128 SIM cards. As Izvestia found out, GoIP boxes also have an official distributor, FAN Telecom LLC, registered in Moscow. This company, in particular, applied for a declaration of compliance of GoIP gateways with the requirements of the EAEU technical regulations. In a conversation with a correspondent of Izvestia, Andrey Fillipov, the company's CEO, refused to name the volume of equipment supplies to Russia, while identifying the target audience of the product.

— If we talk about legal use, then this equipment is purchased for instant transfer of calls from the Internet to a mobile network and sending SMS messages. They acquire both small companies that need to make GSM calls to the Internet, and large businesses, including banks," our interlocutor said. — As for illegal immigrants, GoIP equipment is popular with scammers primarily because of the price. It is 2-3 times lower than that of its powerful rack-mounted counterparts.

Invitation with hacking: scammers began to advertise in the "working version of WhatsApp"

How many people have already been injured, and how not to fall for such deception

Nevertheless, in the near future, the sim-box market may enter a zone of strict regulation. As Senator Artem Sheikin, Deputy Chairman of the Council for the Development of the Digital Economy at the Federation Council, told Izvestia, the topic of using SIM boxes in telephone fraud is under constant control, as it is directly related to the safety of citizens and the effectiveness of crime investigation. According to him, the Ministry of Finance has already developed draft regulations governing this area and posted them for public discussion.

— The use of SIM boxes is supposed to be allowed only to subscribers — legal entities and individual entrepreneurs. The telecom operator will not be able to provide services if the SIM box is used without a separate agreement, or if the information about the device differs from the data specified in the agreement. It is envisaged that the contracts will record the purpose of using the SIM box, equipment parameters and identifiers of electronic devices, as well as binding to the details of the Internet access agreement," said Sheikin, noting that the technical requirements for SIM boxes are set out in a separate document.

Answering a question about the possibility of a complete ban on the turnover of SIM boxes in Russia, the senator noted that SIM boxes can also be used quite legally - by banks, large companies, for service purposes. In developing solutions, according to the parliamentarian, it is necessary to maintain a balance: strengthen barriers to abuse and at the same time not create disproportionate restrictions for bona fide companies and government services operating in the legal field.

Izvestia sent questions to the FSB of Russia and the Ministry of Internal Affairs of Russia about the extent of the use of SIM boxes in illegal activities. At the time of publication, the editorial office had not received any comments.

Meanwhile, the Ukrainian companies Global Mind Associated and GoAntiFraud are actively engaged in providing GoIP programs in other regions of the world. In particular, individuals associated with GoAntiFraud train and recruit sim box administrators in Asia and Europe, as well as in the United States. The hottest destination is Africa, which is currently experiencing a real pandemic of phone fraud. Sim farms with the support of Ukrainian curators are opening all over the black continent - in Mali, Liberia, Nigeria, Morocco, Senegal, Zambia and other countries, according to ads in profile groups on social networks.