While the headline on NYT highlights an attack on the towers for disruption, the CNN piece gives more weight to two other uses: (1) criminal communication network and (2) swatting.
I think those two make sense. The SIMs would probably hold US numbers and would appear authentic for accessing the US operators' networks.
(2) is the thing that brought attention of LE on these, and likely was a very dumb move by one of the users of this system. If just (1) they could have kept it going for much longer, (2) is what brought it down.
(2) shouldn't have brought it down because it's not illegal to be a pipeline for someone else's swatting, though you have to help LE identify who did the swatting to the extent you can (including if that's not at all).
https://www.cnn.com/2025/09/23/us/swatting-investigation-ser...
EDIT:
While the headline on NYT highlights an attack on the towers for disruption, the CNN piece gives more weight to two other uses: (1) criminal communication network and (2) swatting.
I think those two make sense. The SIMs would probably hold US numbers and would appear authentic for accessing the US operators' networks.