# Iran Exploits SS7 Cellular Interconnect Infrastructure to Track US Military Personnel

> Citizen Lab, the Financial Times, and the research initiative Mobile Surveillance Monitor report that Iran exploited long-standing SS7/Diameter telecom-interconnect weaknesses, combined with commercially purchased mobile-advertising location data, to track US military personnel and contractors roaming on regional carriers in Iraq, Bahrain, and other Gulf states before and during the 2026 Iran war. The Pentagon has since confirmed receiving multiple threat reports of the activity and, per Congressional oversight letters, disabled advertising identifiers on government devices, though as of September 2026 lawmakers say the underlying exposure remains only partially addressed.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2609
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-iran-ss7-military-tracking-tl-2026-2609.webp?v=df1b21da (Threadlinqs threat intel: Iran Exploits SS7 to Track Troops: Analysis & Hunting (TL-2026-2609) — High severity, 7 IOCs, 9 detection rules.)
- **ID:** TL-2026-2609
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

Between the build-up to the February 2026 US/Israel strikes on Iran and the collapse of the April ceasefire in July 2026, security researchers documented a surge in SS7 (Signaling System No. 7) location-request traffic across Middle East telecom networks aimed at roaming devices belonging to US military personnel and contractors stationed in Iraq, Bahrain, and other Gulf countries. SS7, the decades-old inter-carrier signalling protocol still used to route calls and SMS globally, was designed on a model of implicit trust between operators and lacks robust source authentication or encryption, allowing any party with signalling access to query a subscriber's approximate location by number alone.

Citizen Lab Senior Fellow Gary Miller — who also leads the nonprofit research initiative Mobile Surveillance Monitor — found that rather than attacking military communications systems directly, the campaign abused commercial roaming infrastructure that regional carriers use to service visiting subscribers. Iran reportedly supplemented SS7 queries with commercially purchased advertising data: smartphones broadcast unique mobile advertising identifiers (MAID/AAID/IDFA) into real-time-bidding (RTB) ad-exchange auctions whenever an app serves a targeted ad, and these identifiers — sold onward by data brokers with no buyer vetting — can be correlated into a historical location trail for a device with no compromise of the device itself.

This reporting builds on Citizen Lab's broader April 2026 'Bad Connection' investigation, which separately catalogued how commercial surveillance vendors (CSVs) and 'ghost' front companies posing as legitimate mobile network operators lease Global Title (GT) signalling identifiers from real carriers to inject SS7 and Diameter (the 4G/LTE-era signalling protocol) tracking queries, in some cases pivoting between the two protocols via a device's 'combined attach' 3G/4G registration to bypass Diameter-only firewalls — establishing the general SS7/Diameter tradecraft that outlets subsequently described as being used against US forces, without Citizen Lab confirming the same named vendors executed the Iran-specific campaign.

US officials acknowledged the threat while disputing its operational significance: USCENTCOM told Congress on 2026-04-14 that it had 'received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater,' and a DoD official separately told the Financial Times that claims the tracking meaningfully influenced strike targeting were 'a departure from the facts.' Bipartisan lawmakers (Sens. Wyden and Heinrich, Rep. Harrigan, and others) wrote to DoD CIO Kirsten Davies on 2026-05-28 — the first DoD confirmation that adversaries were using commercial location data against US personnel in an active war zone — calling for advertising IDs to be disabled DoD-wide, privacy-protective browsers to replace default browsers on government devices, and enrollment of servicemembers in data-broker opt-out programs. Military branches subsequently disabled advertising identifiers on government-issued devices (the Army since roughly February 2026, other branches by mid-2026), but a follow-up Congressional letter in September 2026 requesting a DoD Inspector General investigation found troops remained trackable, attributing the gap to late rollout of the mitigations, ad-ID disabling alone being insufficient against non-ad-tech SS7 querying, and continued exposure via personal devices.

No CVE applies: this is an architectural weakness in globally deployed signalling protocols and in the advertising-technology supply chain, not a flaw in a single vendor's product.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1036 Masquerading
- T1583 Acquire Infrastructure
- T1650 Acquire Access
- T1591.001 Determine Physical Locations
- T1430 Location Tracking
- T1430.002 Impersonate SS7 Nodes
- T1638 Adversary-in-the-Middle
- T1599 Network Boundary Bridging
- T1590.006 Network Security Appliances
- T1095 Non-Application Layer Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SS7 MAP Location-Request Flood Against Roaming Subscriber Identifiers** (`TL-2026-2609-SPL-001`)

Detects a burst of SS7 MAP location-disclosing opcodes (anyTimeInterrogation, provideSubscriberInfo, sendRoutingInfoForSM, sendRoutingInfo) issued against a roaming subscriber from a Global Title that is not a recognized roaming/billing partner, consistent with Citizen Lab's reporting on Iran's SS7 query surge against roaming US military/contractor devices in Iraq, Bahrain, and other Gulf states. Flags device-location harvesting by number alone, without any device compromise.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1591.001, T1430, T1430.002
- **Data sources:** ss7-map-signalling-firewall, stp-cdr-logs, interconnect-roaming-logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=telecom sourcetype="ss7:map" (opcode="anyTimeInterrogation" OR opcode="provideSubscriberInfo" OR opcode="sendRoutingInfoForSM" OR opcode="sendRoutingInfo")
| eval roaming_flag=if(visited_network!=home_network,1,0)
| where roaming_flag=1
| bin _time span=15m
| stats count as query_count, dc(opcode) as opcode_diversity, values(opcode) as opcodes, values(calling_gt) as calling_gts by _time, msisdn, home_network, visited_network
| where query_count >= 5
| lookup gt_reputation.csv calling_gt OUTPUT gt_owner, gt_country, gt_risk_score
| where gt_risk_score >= 70 OR isnull(gt_owner)
| table _time, msisdn, home_network, visited_network, query_count, opcode_diversity, opcodes, calling_gts, gt_owner, gt_country, gt_risk_score
| sort - query_count
```

### Microsoft KQL

```kql
let LocationOpcodes = dynamic(["anyTimeInterrogation","provideSubscriberInfo","sendRoutingInfoForSM","sendRoutingInfo"]);
SS7SignallingLogs_CL
| where TimeGenerated > ago(24h)
| where Opcode_s in (LocationOpcodes)
| where VisitedNetwork_s != HomeNetwork_s
| summarize QueryCount = count(), OpcodeDiversity = dcount(Opcode_s), Opcodes = make_set(Opcode_s), CallingGTs = make_set(CallingGT_s) by bin(TimeGenerated, 15m), MSISDN_s, HomeNetwork_s, VisitedNetwork_s
| where QueryCount >= 5
| project TimeGenerated, MSISDN_s, HomeNetwork_s, VisitedNetwork_s, QueryCount, OpcodeDiversity, Opcodes, CallingGTs
| order by QueryCount desc
```

### Sigma

```yaml
title: SS7 MAP Location Request Flood Against Roaming Subscriber
id: 7a3f9c2e-1b4d-4e7a-9c1f-2d8a6b5e4f01
status: experimental
description: Detects a burst of SS7 MAP location-disclosing opcodes against a single roaming subscriber from a non-partner Global Title, consistent with commercial-surveillance-vendor and nation-state SS7 location tracking of roaming subscribers.
references:
  - https://citizenlab.ca/how-iran-uses-cellular-infrastructure-to-target-us-military-phones/
  - https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
  - attack.reconnaissance
  - attack.t1591.001
  - attack.collection
  - attack.t1430
  - attack.discovery
  - attack.t1430.002
  - attack.tool.ss7_map_scanner
logsource:
  category: application
  product: ss7-firewall
detection:
  selection_opcode:
    Opcode:
      - 'anyTimeInterrogation'
      - 'provideSubscriberInfo'
      - 'sendRoutingInfoForSM'
      - 'sendRoutingInfo'
  selection_roaming:
    VisitedNetwork|exists: true
  filter_known_partner:
    CallingGT_RegisteredPartner: true
  condition: selection_opcode and selection_roaming and not filter_known_partner | count(MSISDN) by CallingGT > 5 within 15m
falsepositives:
  - Legitimate roaming-partner billing or emergency-services (E911/E112) location queries
  - Steering-of-roaming platform traffic from the subscriber's actual home network operator
level: high
```

**Known false positives:**

- Legitimate roaming-partner location queries for emergency services (E911/E112) or billing/rating verification
- Steering-of-roaming (SoR) platform queries legitimately issued by the subscriber's actual home network during normal roaming registration

**Tuning notes:** Seed gt_reputation.csv / GT registry lookup from GSMA IR.21-aligned interconnect records for carriers actually serving the deployed AOR (Iraq, Bahrain, Gulf states); raise the 15-minute query_count threshold for high-traffic MVNOs and lower it for low-traffic bilateral roaming partners.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SS7 MAP Location-Request Flood Against Roaming Subscriber Identifiers (locked: unlock with TL Creds)
- Diameter-to-SS7 Combined-Attach Downgrade Bypassing Diameter Signalling Firewall (locked: unlock with TL Creds)
- Leased Global Title Masquerading as Legitimate MNO Combined with RTB Ad-ID Beaconing to Known Ad-Exchange Infrastructure (locked: unlock with TL Creds)
- SS7 MAP Location-Request Flood Against Roaming Subscriber Identifiers (locked: unlock with TL Creds)
- Diameter-to-SS7 Combined-Attach Downgrade Bypassing Diameter Signalling Firewall (locked: unlock with TL Creds)
- Leased Global Title Masquerading as Legitimate MNO Combined with RTB Ad-ID Beaconing to Known Ad-Exchange Infrastructure (locked: unlock with TL Creds)
- Diameter-to-SS7 Combined-Attach Downgrade Bypassing Diameter Signalling Firewall (locked: unlock with TL Creds)
- Leased Global Title Masquerading as Legitimate MNO Combined with RTB Ad-ID Beaconing to Known Ad-Exchange Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [How Iran Uses Cellular Infrastructure to Target US Military Phones](https://citizenlab.ca/how-iran-uses-cellular-infrastructure-to-target-us-military-phones/)
- [US Military Smartphones Targeted Through Roaming and Ad Tech](https://citizenlab.ca/us-military-smartphones-targeted-through-roaming-and-ad-tech/)
- [Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors](https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/)
- [Iran abused mobile networks' vulnerabilities to locate U.S. military in the Middle East, report says](https://techcrunch.com/2026/07/14/iran-abused-mobile-networks-vulnerabilities-to-locate-u-s-military-in-the-middle-east-report-says/)
- [Surveillance vendors caught abusing access to telcos to track people's phone locations, researchers say](https://techcrunch.com/2026/04/23/surveillance-vendors-caught-abusing-access-to-telcos-to-track-peoples-phone-locations-researchers-say/)
- [Iran Exploited Telecom Flaws to Track US Military Personnel, Researchers Say](https://securityboulevard.com/2026/07/iran-exploited-telecom-flaws-to-track-us-military-personnel-researchers-say/)
- [Iran used ad tracking to hunt American soldiers: Report](https://reason.com/2026/07/16/iran-used-ad-tracking-to-hunt-american-soldiers-report/)
- [Troops' phones gave away location data to foreign adversaries](https://www.theregister.com/security/2026/05/28/troops-phones-leaked-location-data-to-foreign-adversaries/5248108)
- [US troops can still be tracked by purchased location data, and Congress wants to know why](https://www.theregister.com/public-sector/2026/09/06/us-troops-can-still-be-tracked-by-purchased-location-data-and-congress-wants-to-know-why/5294652)
- [In letter to DoD, Heinrich Reveals That Foreign Adversaries Are Using Commercial Location Data to Target U.S. Servicemembers in the Middle East](https://www.heinrich.senate.gov/newsroom/press-releases/in-letter-to-dod-heinrich-reveals-that-foreign-adversaries-are-using-commercial-location-data-to-target-us-servicemembers-in-the-middle-east-calls-on-dod-to-adopt-commonsense-safeguards-to-protect-us-troops)
- [Commercial location data is being used to target US servicemembers, lawmakers warn](https://www.nextgov.com/cybersecurity/2026/05/commercial-location-data-being-used-target-us-servicemembers-lawmakers-warn/413851/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2609