The Secret Service said Tuesday that it disrupted a network of electronic devices in the New York City area that posed imminent telecommunications-based threats to U.S. government officials and potentially the United Nations General Assembly meeting currently underway.

The range of threats included enabling encrypted communications between threat groups and criminals, or disabling cell towers and conducting denial-of-service attacks to shut down cell communications in the region. Matt McCool, special agent in charge of the Secret Service’s New York field office, said the agency’s early analysis of the network indicated “cellular communications between foreign actors and individuals that are known to federal law enforcement.”

In all, the agency said it discovered more than 300 servers and 100,000 SIM cards spread across multiple sites within 35 miles of the U.N. meeting. The Secret Service announcement came the same day President Donald Trump was scheduled to deliver a speech to the General Assembly.

“The potential for disruption to our country’s telecommunications posed by this network of devices cannot be overstated,” U.S. Secret Service Director Sean Curran said in a news release.

McCool said in a video statement that the investigation was ongoing, but the threat the network posed had been neutralized.

“These devices allowed anonymous, encrypted communications between potential threat actors and criminal enterprises, enabling criminal organizations to operate undetected,” he said. “This network had the potential to disable cell phone towers and essentially shut down the cellular network in New York City.

“We will continue working toward identifying those responsible and their intent, including whether their plan was to disrupt the U.N. General Assembly and communications of government and emergency personnel during the official visit of world leaders in and around New York City,” McCool continued.

News outlets briefed on the operation reported that the network anonymously conveyed assassination threats against senior U.S. officials, that the agency had never seen such an extensive operation, that the investigation uncovered empty electronic safehouses rented around the area and that hackers, terrorists, spies and human traffickers could’ve made use of the network. The investigation reportedly began in response to swatting and bomb threats against U.S. officials.

Other participants in the investigation were the Department of Homeland Security’s Homeland Security Investigations, the Department of Justice, the Office of the Director of National Intelligence and the New York Police Department.

Some cybersecurity professionals reacted skeptically to elements of the Secret Service announcement.

“Super weird framing by the Secret Service,” Marcus Hutchins, the researcher known for stopping the 2017 WannaCry ransomware attack, wrote on BlueSky. “They found a SIM card farm, which is typically used by criminals to anonymously send calls and texts. They issued a press release claiming ‘it could have shut down the entire NY cell network during the UN general assembly’ which is some serious FUD,” he said, using the acronym for “fear, uncertainty and doubt.”

He added: “it’s possible they found an actual plot to cause widespread destruction, but way more likely they found some generic cybercrime service and have absolutely no clue what it’s for.”

Johns Hopkins cryptography expert Matthew Green wrote on the same social media platform that “I no longer know what we can trust from the Secret Service, especially when a ‘Trump speech’ is involved, and the mechanics of this thing are a little bizarre.”

Updated 9/23/25: to include reaction from cybersecurity professionals.

The post Secret Service says it dismantled extensive telecom threat in NYC area appeared first on CyberScoop.

Sean Cairncross took his post this week as national cyber director at what many agree is a “pivotal” time for the office, giving him a chance to shape its future role in the bureaucracy, tackle difficult policy issues, shore up industry relations and take on key threats.

The former White House official, Republican National Committee leader and head of a federal foreign aid agency became just the third Senate-confirmed national cyber director at an office (ONCD) that’s only four years old. He’s the first person President Donald Trump has assigned to the position after the legislation establishing it became law at the end of his first term.

Two people — House Homeland Security Chairman Andrew Garbarino, R-N.Y., and Adam Meyers, senior vice president of counter adversary operations at CrowdStrike — specifically used the word “pivotal” to describe this moment for Cairncross and his office, while others said as much in other ways.

“It’s a new organization, and with any new organization, you’ve got to build up the muscle memory of how ONCD fits into the interagency process and what it means to set a unified national cybersecurity agenda, the language the director was using in his nomination hearing,” Nicholas Leiserson, a former assistant national cyber director under President Joe Biden who worked on the legislation to create the office as a Hill staffer, told CyberScoop. “We need to make sure that ONCD is the center of the policymaking apparatus. … That is going to be critical to his success.”

Brian Harrell, a former infrastructure protection official at the Deparment of Homeland Security and the Cybersecurity and Infrastructure Security Agency in Trump’s first term, said that with personnel reductions at CISA and change elsewhere, Cairncross has a big opportunity.

“ONCD must be seen as the air traffic controller on all things cyber moving forward,” he said via email. “Given the agency rebuild happening at CISA, and new leadership at FBI and NSA cyber, now is the time to build influence and patch struggling relationships. Add to this, a private sector that is unsure where to turn to during a crisis … Sean must be seen as a convener and facilitator to get the President the right information to make key decisions.”

On the policy front, Leiserson, now senior vice president for policy at the Institute for Security and Technology, said Cairncross has a great opportunity to work through the thicket of federal cybersecurity regulations and disentangle them in a harmonization effort that began under Biden and has bipartisan support. Some seasoned staffers who worked on the issue then remain in the federal government, Leiserson said.

Garbarino also brought up harmonization in a written statement as an issue he wants to see Cairncross address, along with leading the charge renewing the 2015 threat data sharing law known as the Cybersecurity Information Sharing Act, set to expire next month. Jason Oxman, president of the Information Technology Industry Council, said in a press release congratulating Cairncross that renewal of that law was “essential to help ONCD achieve its cybersecurity mission.”

USTelecom President and CEO Jonathan Spalter said enhancing the government’s relationship with the private sector, a subject Cairncross brought up in his confirmation hearing, was also vital. Dave DeWalt, CEO of NightDragon, a venture capital and advisory firm, said of Cairncross in a statement to CyberScoop: “I know that under his leadership, public-private partnership will continue to strengthen and secure our future.”

Those policy challenges, as well as the challenges of strengthening the national cyber director’s standing within the federal government and fortifying the public-private partnership, go hand-in-hand with the threats Cairncross will have to confront.

“The mission of the Office of the National Cyber Director has never been more critical: advancing a unified, strategic, and forward-leaning approach to the cyber threats facing our increasingly digital society,” Frank Cilluffo, director of the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University and a former member of the Cyberspace Solarium Commission that recommended that Congress create the office, said in a written statement.

Leiserson said threats like the Chinese hackers known as Salt Typhoon penetrating telecommunications networks surely would be at the forefront of Cairncross’s concerns — a threat Cairncross brought up at his confirmation hearing. Harrell mentioned the looming possibility of a Chinese attack on Taiwan.

Oxman raised the threats to U.S. critical infrastructure and the supply chain. CrowdStrike’s Meyers, in a statement to CyberScoop, said the pivotal moment of Cairncross’s confirmation comes as “threat actors weaponize AI and the threat landscape continues to evolve at machine speed.”

Cairncross comes into the job with far less cybersecurity experience than many who have held federal cyber leadership posts. And he comes in with other potential disadvantages, too. At his nomination hearing, Sen. Elissa Slotkin, D-Mich., pointed to deep budget cuts at CISA, telling Cairncross that “you will oversee the single biggest cut in federal cybersecurity dollars.”

But Leiserson said it was encouraging that Trump’s fiscal 2026 budget proposal would keep funding for the Office of the National Cyber Director pretty level.

There are other reasons to be optimistic about the view from federal leaders on the office, too, some pointed out. Cilluffo noted that the 59-35 vote for Cairncross in the Senate suggested some bipartisan support. Leiserson observed that Cairncross was one of the few nominees to escape the nominee backlog in the Senate before lawmakers went on recess.

As for his relative lack of cyber experience, Cairncross has talked about surrounding himself with the right people, Leiserson said.

“You want the unicorns who are incredibly politically astute and who have very deep cyber knowledge,” he said. “These people are hard to come by. We’ve had real cyber experts on the job. Now we’ve got someone who … is going to have an easy time navigating the West Wing. That is a skill set that is vital for running a White House organization, and shouldn’t be discounted.”

The post New National Cyber Director Cairncross faces challenges on policy, bureaucracy, threats appeared first on CyberScoop.

As the U.S. government contemplates additional sanctions on Moscow, the United Kingdom went ahead and levied its own Friday against what it said was a group of Russia’s hackers and spies. 

The sanctions target 18 military intelligence officers and three divisions of the Russian military unit known as the GRU. Cyber operations in support of Russia’s war against Ukraine drew the U.K. targeting of the hackers.

“The GRU routinely uses cyber and information operations to sow chaos, division and disorder in Ukraine and across the world with devastating real-world consequences,” reads a news release.

But the sanctions also go after the use of malware tied to an attempted assassination of a former Russian double agent residing on U.K. soil and the related poisoning of his daughter.

“Today’s action also hits GRU military intelligence officers responsible for historically targeting Yulia Skripal’s device with malicious malware known as X-Agent — five years before GRU military intelligence officers’ failed attempt to murder Yulia and Sergei Skripal with the deadly Novichok nerve agent in Salisbury,” the release states.

According to a 2018 U.S. grand jury indictment, X-Agent is custom malware that Russia developed to hack the Democratic National Committee and Democratic Congressional Campaign Committee to interfere in the 2016 election.

The U.K. sanctioned some of the military officers for spying operations like those involved in the 2022 bombing of Mauripol Theatre, which had been sheltering Ukrainian civilians.

In the U.S. Congress, lawmakers have been demonstrating some rare bipartisan consensus on the notion of slapping Moscow with more sanctions. That legislation would likewise seek to punish Russian cyber operations in Ukraine, among other Russian aggression in the former Soviet satellite nation.

President Donald Trump, too, has grown impatient with Russian President Vladimir Putin over the Ukraine war and has threatened further sanctions against Moscow and its trade partners.

The United Kingdom warned in a separate alert Friday that GRU cyber operations could spill over from the Ukraine war.

“The future trajectory of this threat remains uncertain and international partners need to prepare for its redirection and a range of potential scenarios,” the alert states.

The three units drawing U.K. sanctions have been connected to a range of hacking activity, from meddling in elections across the globe to the massive 2017 NotPetya attack.

“GRU spies are running a campaign to destabilise Europe, undermine Ukraine’s sovereignty and threaten the safety of British citizens,” said U.K. Foreign Secretary David Lammy. “The Kremlin should be in no doubt: we see what they are trying to do in the shadows and we won’t tolerate it. …  Putin’s hybrid threats and aggression will never break our resolve.”

Also Friday, the European Union agreed to sanctions targeting Russia’s energy and banking sectors, the bloc’s 18th set of sanctions against Moscow.

You can read the full list of those sanctioned on the U.K. government’s website.

This article has been updated to reflect news about the additional EU sanctions.

The post UK sanctions Russian hackers, spies as US weighs its own punishments for Russia appeared first on CyberScoop.