Daily Briefing for 09.23.25

Top stories.

1. US Secret Service dismantles illicit telecom network in New York.
2. Jaguar Land Rover extends shutdown until October.
3. Iranian malware campaign targets Western Europe.

US Secret Service dismantles illicit telecom network in New York.

The US Secret Service dismantled a network of tens of thousands of devices "located throughout the New York tristate area that were used to conduct multiple telecommunications-related threats directed towards senior U.S. government officials." Notably, the devices were "were concentrated within 35 miles of the global meeting of the United Nations General Assembly now underway in New York City." The New York Times cites an official as saying the network could have sent 30 million anonymous text messages per minute. Matt McCool, the special agent in charge of the Secret Service's New York field office, said the network "had the potential to disable cellphone towers and essentially shut down the cellular network in New York City."

The Secret Service stated, "This protective intelligence investigation led to the discovery of more than 300 co-located SIM servers and 100,000 SIM cards across multiple sites. In addition to carrying out anonymous telephonic threats, these devices could be used to conduct a wide range of telecommunications attacks. This includes disabling cell phone towers, enabling denial of services attacks and facilitating anonymous, encrypted communication between potential threat actors and criminal enterprises. While forensic examination of these devices is ongoing, early analysis indicates cellular communications between nation-state threat actors and individuals that are known to federal law enforcement."

Jaguar Land Rover extends shutdown until October.

Jaguar Land Rover (JLR) has extended its pause in production until at least October 1st, the Record reports. The company shut down its auto manufacturing plants in the UK at the beginning of September following a cyberattack, and is estimated to be losing up to £70 million (US$94 million) per day. The incident is also causing significant financial impacts to the company's supply-chain businesses across the UK, according to the Register.

JLR said this morning, "We have made this decision to give clarity for the coming week as we build the timeline for the phased restart of our operations and continue our investigation. Our teams continue to work around the clock alongside cybersecurity specialists, the NCSC, and law enforcement to ensure we restart in a safe and secure manner."

Iranian malware campaign targets Western Europe.

Check Point has published a report on an Iranian malware campaign targeting defense manufacturing, telecommunications, and aviation entities in Western Europe, with a primary focus on Denmark, Sweden, and Portugal. The threat actor is impersonating HR recruiters and sending spearphishing emails targeting job seekers. The emails direct users to phishing sites that install a new version of the Minibike malware, which Check Point tracks as "MiniJunk." The researchers note that the latest variant of the malware suggests "a significant increase in the actor’s abilities, including using a novel (and previously undocumented) technique to load DLLs from alternate paths by modifying process execution parameters."

Check Point attributes the activity to the Iranian threat actor Nimbus Manticore, also known as "UNC1549" or "Smoke Sandstorm."