Skip to navigation

Threat reportThreat IntelligenceTL-2026-2609

Iran Exploits SS7 Cellular Interconnect Infrastructure to Track US Military Personnel

highACTIVE

Citizen Lab, the Financial Times, and the research initiative Mobile Surveillance Monitor report that Iran exploited long-standing SS7/Diameter telecom-interconnect weaknesses, combined with commercially purchased mobile-advertising location data, to track US military personnel and contractors roaming on regional carriers in Iraq, Bahrain, and other Gulf states before and during the 2026 Iran war. First disclosed .

Key facts for Iran SS7 military tracking

IdentifiersTL-2026-2609
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsGlobal Telecom Industry SS7 / Diameter signalling interconnect (3G/4G roaming infrastructure); Mobile Advertising / RTB Ecosystem Mobile advertising identifiers (MAID/AAID/IDFA) exposed via real-time-bidding ad exchanges
Weaknesses (CWE)CWE-306, CWE-311
Nation-state nexusIran
MITRE ATT&CK techniquesT1036 Masquerading, T1095 Non-Application Layer Protocol, T1199 Trusted Relationship, T1430 Location Tracking, T1430.002 Impersonate SS7 Nodes, T1583 Acquire Infrastructure, T1590.006 Network Security Appliances, T1591.001 Determine Physical Locations, T1599 Network Boundary Bridging, T1638 Adversary-in-the-Middle, T1650 Acquire Access
MotivationESPIONAGE
Target sectorsdefense, government administration, telecoms
Target regionsMiddle East, North America
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage for Iran SS7 military tracking

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2609 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SS7 MAP Location-Request Flood Against Roaming Subscriber Identifiers

Detects a burst of SS7 MAP location-disclosing opcodes (anyTimeInterrogation, provideSubscriberInfo, sendRoutingInfoForSM, sendRoutingInfo) issued against a roaming subscriber from a Global Title that is not a recognized roaming/billing partner, consistent with Citizen Lab's reporting on Iran's SS7 query surge against roaming US military/contractor devices in Iraq, Bahrain, and other Gulf states. Flags device-location harvesting by number alone, without any device compromise.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1591.001, T1430, T1430.002
  • Data sources: ss7-map-signalling-firewall, stp-cdr-logs, interconnect-roaming-logs
  • Severity: high
  • Confidence: high

Splunk SPL

index=telecom sourcetype="ss7:map" (opcode="anyTimeInterrogation" OR opcode="provideSubscriberInfo" OR opcode="sendRoutingInfoForSM" OR opcode="sendRoutingInfo")
| eval roaming_flag=if(visited_network!=home_network,1,0)
| where roaming_flag=1
| bin _time span=15m
| stats count as query_count, dc(opcode) as opcode_diversity, values(opcode) as opcodes, values(calling_gt) as calling_gts by _time, msisdn, home_network, visited_network
| where query_count >= 5
| lookup gt_reputation.csv calling_gt OUTPUT gt_owner, gt_country, gt_risk_score
| where gt_risk_score >= 70 OR isnull(gt_owner)
| table _time, msisdn, home_network, visited_network, query_count, opcode_diversity, opcodes, calling_gts, gt_owner, gt_country, gt_risk_score
| sort - query_count

Microsoft KQL

let LocationOpcodes = dynamic(["anyTimeInterrogation","provideSubscriberInfo","sendRoutingInfoForSM","sendRoutingInfo"]);
SS7SignallingLogs_CL
| where TimeGenerated > ago(24h)
| where Opcode_s in (LocationOpcodes)
| where VisitedNetwork_s != HomeNetwork_s
| summarize QueryCount = count(), OpcodeDiversity = dcount(Opcode_s), Opcodes = make_set(Opcode_s), CallingGTs = make_set(CallingGT_s) by bin(TimeGenerated, 15m), MSISDN_s, HomeNetwork_s, VisitedNetwork_s
| where QueryCount >= 5
| project TimeGenerated, MSISDN_s, HomeNetwork_s, VisitedNetwork_s, QueryCount, OpcodeDiversity, Opcodes, CallingGTs
| order by QueryCount desc

Sigma

title: SS7 MAP Location Request Flood Against Roaming Subscriber
id: 7a3f9c2e-1b4d-4e7a-9c1f-2d8a6b5e4f01
status: experimental
description: Detects a burst of SS7 MAP location-disclosing opcodes against a single roaming subscriber from a non-partner Global Title, consistent with commercial-surveillance-vendor and nation-state SS7 location tracking of roaming subscribers.
references:
  - https://citizenlab.ca/how-iran-uses-cellular-infrastructure-to-target-us-military-phones/
  - https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
  - attack.reconnaissance
  - attack.t1591.001
  - attack.collection
  - attack.t1430
  - attack.discovery
  - attack.t1430.002
  - attack.tool.ss7_map_scanner
logsource:
  category: application
  product: ss7-firewall
detection:
  selection_opcode:
    Opcode:
      - 'anyTimeInterrogation'
      - 'provideSubscriberInfo'
      - 'sendRoutingInfoForSM'
      - 'sendRoutingInfo'
  selection_roaming:
    VisitedNetwork|exists: true
  filter_known_partner:
    CallingGT_RegisteredPartner: true
  condition: selection_opcode and selection_roaming and not filter_known_partner | count(MSISDN) by CallingGT > 5 within 15m
falsepositives:
  - Legitimate roaming-partner billing or emergency-services (E911/E112) location queries
  - Steering-of-roaming platform traffic from the subscriber's actual home network operator
level: high

Known false positives:

  • Legitimate roaming-partner location queries for emergency services (E911/E112) or billing/rating verification
  • Steering-of-roaming (SoR) platform queries legitimately issued by the subscriber's actual home network during normal roaming registration

Tuning notes: Seed gt_reputation.csv / GT registry lookup from GSMA IR.21-aligned interconnect records for carriers actually serving the deployed AOR (Iraq, Bahrain, Gulf states); raise the 15-minute query_count threshold for high-traffic MVNOs and lower it for low-traffic bilateral roaming partners.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SS7 MAP Location-Request Flood Against Roaming Subscriber Identifiers · unlock with TL Creds
  • Diameter-to-SS7 Combined-Attach Downgrade Bypassing Diameter Signalling Firewall · unlock with TL Creds
  • Leased Global Title Masquerading as Legitimate MNO Combined with RTB Ad-ID Beaconing to Known Ad-Exchange Infrastructure · unlock with TL Creds
  • SS7 MAP Location-Request Flood Against Roaming Subscriber Identifiers · unlock with TL Creds
  • Diameter-to-SS7 Combined-Attach Downgrade Bypassing Diameter Signalling Firewall · unlock with TL Creds
  • Leased Global Title Masquerading as Legitimate MNO Combined with RTB Ad-ID Beaconing to Known Ad-Exchange Infrastructure · unlock with TL Creds
  • Diameter-to-SS7 Combined-Attach Downgrade Bypassing Diameter Signalling Firewall · unlock with TL Creds
  • Leased Global Title Masquerading as Legitimate MNO Combined with RTB Ad-ID Beaconing to Known Ad-Exchange Infrastructure · unlock with TL Creds

Indicators of compromise for Iran SS7 military tracking

As of 2026-09-21, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-2609.

7 indicators of compromise · unlock with TL Creds. Compare plans

How Iran SS7 military tracking works

The Pentagon has since confirmed receiving multiple threat reports of the activity and, per Congressional oversight letters, disabled advertising identifiers on government devices, though as of September 2026 lawmakers say the underlying exposure remains only partially addressed.

Between the build-up to the February 2026 US/Israel strikes on Iran and the collapse of the April ceasefire in July 2026, security researchers documented a surge in SS7 (Signaling System No. 7) location-request traffic across Middle East telecom networks aimed at roaming devices belonging to US military personnel and contractors stationed in Iraq, Bahrain, and other Gulf countries. SS7, the decades-old inter-carrier signalling protocol still used to route calls and SMS globally, was designed on a model of implicit trust between operators and lacks robust source authentication or encryption, allowing any party with signalling access to query a subscriber's approximate location by number alone.

Citizen Lab Senior Fellow Gary Miller — who also leads the nonprofit research initiative Mobile Surveillance Monitor — found that rather than attacking military communications systems directly, the campaign abused commercial roaming infrastructure that regional carriers use to service visiting subscribers. Iran reportedly supplemented SS7 queries with commercially purchased advertising data: smartphones broadcast unique mobile advertising identifiers (MAID/AAID/IDFA) into real-time-bidding (RTB) ad-exchange auctions whenever an app serves a targeted ad, and these identifiers — sold onward by data brokers with no buyer vetting — can be correlated into a historical location trail for a device with no compromise of the device itself.

This reporting builds on Citizen Lab's broader April 2026 'Bad Connection' investigation, which separately catalogued how commercial surveillance vendors (CSVs) and 'ghost' front companies posing as legitimate mobile network operators lease Global Title (GT) signalling identifiers from real carriers to inject SS7 and Diameter (the 4G/LTE-era signalling protocol) tracking queries, in some cases pivoting between the two protocols via a device's 'combined attach' 3G/4G registration to bypass Diameter-only firewalls — establishing the general SS7/Diameter tradecraft that outlets subsequently described as being used against US forces, without Citizen Lab confirming the same named vendors executed the Iran-specific campaign.

US officials acknowledged the threat while disputing its operational significance: USCENTCOM told Congress on 2026-04-14 that it had 'received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater,' and a DoD official separately told the Financial Times that claims the tracking meaningfully influenced strike targeting were 'a departure from the facts.' Bipartisan lawmakers (Sens. Wyden and Heinrich, Rep. Harrigan, and others) wrote to DoD CIO Kirsten Davies on 2026-05-28 — the first DoD confirmation that adversaries were using commercial location data against US personnel in an active war zone — calling for advertising IDs to be disabled DoD-wide, privacy-protective browsers to replace default browsers on government devices, and enrollment of servicemembers in data-broker opt-out programs. Military branches subsequently disabled advertising identifiers on government-issued devices (the Army since roughly February 2026, other branches by mid-2026), but a follow-up Congressional letter in September 2026 requesting a DoD Inspector General investigation found troops remained trackable, attributing the gap to late rollout of the mitigations, ad-ID disabling alone being insufficient against non-ad-tech SS7 querying, and continued exposure via personal devices.

No CVE applies: this is an architectural weakness in globally deployed signalling protocols and in the advertising-technology supply chain, not a flaw in a single vendor's product.

MITRE ATT&CK techniques by tactic:

Stealth

T1036 Masquerading

Command and Control

T1095 Non-Application Layer Protocol

Initial Access

T1199 Trusted Relationship

Collection

T1430 Location Tracking

Discovery

T1430.002 Impersonate SS7 Nodes

Resource Development

T1583 Acquire Infrastructure; T1650 Acquire Access

Reconnaissance

T1590.006 Network Security Appliances; T1591.001 Determine Physical Locations

defense-impairment

T1599 Network Boundary Bridging

collection

T1638 Adversary-in-the-Middle

Remediation for Iran SS7 military tracking

Immediate actions

  • Disable mobile advertising identifiers (MAID/AAID/IDFA) on government-issued and BYOD/personal devices used in theater
  • Enroll servicemembers in commercial data-broker opt-out programs
  • Replace default mobile browsers on DoD devices with privacy-protective browsers implementing ad blocking and Global Privacy Control

Workarounds

  • Operational-security restrictions on personal smartphone use near sensitive installations while deployed
  • Prefer host-nation or DoD-managed connectivity over commercial roaming where mission-feasible

Longer-term hardening

  • Deploy cross-protocol SS7 and Diameter signalling firewalls that jointly filter 3G and 4G traffic to close the 'combined attach' downgrade gap
  • Enforce GSMA IR.21-aligned interconnect routing verification and Diameter Origin-Host/Origin-Realm validation at carriers serving deployed personnel
  • Restrict and audit third-party Global Title leasing arrangements with commercial signalling-access resellers
  • Complete the DoD Inspector General audit of location-data safeguards across service branches requested by Congress in September 2026

Affected and fixed versions

  • Global Telecom Industry — SS7 / Diameter signalling interconnect (3G/4G roaming infrastructure)
    Vulnerable versions: SS7 deployments without signalling firewalls; Diameter (4G/LTE core) without TLS/IPsec enforcement
    Fixed in: No universal fix exists; risk is reduced only via signalling-firewall deployment, GT-leasing controls, and interconnect monitoring
  • Mobile Advertising / RTB Ecosystem — Mobile advertising identifiers (MAID/AAID/IDFA) exposed via real-time-bidding ad exchanges
    Vulnerable versions: Devices with advertising ID enabled and location-permissioned ad SDKs installed
    Fixed in: Advertising ID disabled at the OS level; ad-supported apps with location permission removed

Timeline of Iran SS7 military tracking

  • Mobile security researchers John Hering and Karsten Nohl publicly demonstrated live SS7-based smartphone location tracking on '60 Minutes' in 2016, establishing SS7 exploitation as a known, unaddressed telecom-industry risk roughly a decade before the Iran campaign was reported.
  • Israel and the United States began a series of strikes against Iran, opening the 2026 Iran war during which the SS7 location-request surge against US personnel was later documented.
  • US Central Command told Congress it had 'received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater.'
  • Citizen Lab published 'Bad Connection,' documenting two long-running SS7/Diameter commercial-surveillance-vendor tracking campaigns and linking roughly 15,700 tracking attempts to shell carriers and vendors including locked-ioc-7 and locked-ioc-6 — establishing the cross-protocol SS7/Diameter tradecraft later associated with the Iran reporting, though not confirming the same vendors executed the Iran-specific campaign.
  • Senators Wyden and Heinrich and Rep. Harrigan sent a bipartisan letter to DoD CIO Kirsten Davies containing the first DoD confirmation that adversaries were using commercial location data to target US military personnel in an active war zone, calling for advertising-ID and privacy-browser safeguards.
  • CENTCOM gained the technical capability to disable commercial location-data sharing on deployed personnel's devices, according to subsequent Congressional reporting.
  • The April 2026 US/Israel-Iran ceasefire collapsed after renewed attacks by both sides, coinciding with continued reporting on the telecom-tracking campaign against US forces.
  • The Financial Times, via TechCrunch's coverage, reported that Iran had exploited SS7 mobile-network vulnerabilities and commercial ad-tech data to locate US military personnel and contractors in Iraq, Bahrain, and other Gulf states before and during the conflict.
  • Citizen Lab published 'US Military Smartphones Targeted Through Roaming and Ad Tech,' detailing the SS7 and mobile-advertising-identifier tracking vectors used against deployed US personnel.
  • Citizen Lab published 'How Iran Uses Cellular Infrastructure to Target US Military Phones,' with Senior Fellow Gary Miller stating the persistence of SS7 abuse reflects 'a significant security problem within the mobile operator industry.'
  • Senators Wyden and Harrigan requested a DoD Inspector General investigation after finding US troops remained trackable via purchased location data despite the advertising-ID mitigations rolled out earlier in the year.

Sources cited for Iran SS7 military tracking

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats