Threat reportVulnerabilityTL-2026-4832
SS7 and Diameter Signaling Abuse: Covert Surveillance Campaigns and Iranian-Linked Tracking of US Personnel Expose Mobile Subscribers to Location Tracking and Interception
SS7 and Diameter Signaling Abuse (TL-2026-4832), also tracked as Covert telecom surveillance campaigns, is a medium-severity software vulnerability, first published 2026-10-30. It is linked to a Iran-nexus actor with low confidence, affects Mobile network operators (GSMA interconnect) SS7 signaling (2G/3G), maps to 9 MITRE ATT&CK techniques (T1111, T1430, T1557), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4832
- Threat ID
- TL-2026-4832
- Also known as
- Covert telecom surveillance campaigns, Ghost operators
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, government administration, military, individuals-high-value-targets
- Target regions
- Middle East, Global, Europe, North America, Asia
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in SS7 and Diameter Signaling Abuse
Malware and tooling: SIMjacker
How SS7 and Diameter Signaling Abuse works
SS7 (2G/3G) and Diameter (4G/5G) inter-carrier signaling lacks robust sender authentication, and is being actively abused for real-time location tracking, IMSI harvesting and SMS/call interception. Citizen Lab (April 2026) documented two long-running covert surveillance campaigns, and Iranian-linked actors were reported to have used SS7 to track US military personnel in the Middle East.
SS7 is a 1970s signaling protocol used by 2G/3G networks with essentially no process for authenticating requests; any party with access to the interconnect can send messages that the receiving operator treats as coming from a legitimate carrier. Diameter, the 4G/5G successor, supports stronger authentication, but operators deploy protections inconsistently, so equivalent abuse remains possible. Reported abuse classes include real-time location tracking via cell-tower queries, IMSI harvesting for reuse, communication and SMS interception (including two-factor codes) by falsely claiming roaming, impersonation and service blocking using a harvested IMSI, and network disruption through misconfigured signaling messages.
Citizen Lab's report 'Uncovering Global Telecom Exploitation by Covert Surveillance Actors' (Gary Miller and Swantje Lange, 2026-04-23) documents two long-running commercial surveillance campaigns with thousands of attacks against targets in dozens of countries. The same IMSIs were attacked across operations separated by months and years. The first campaign attempted SS7 abuse and shifted to Diameter when SS7 attempts failed, and steered traffic through different network pathways to hide. One actor, STA1, repeatedly tried to track a user while rotating through eleven operator identities in nine countries. The infrastructure of operators in 17 countries/regions was mimicked, including 019Mobile (Israel), Tango Networks UK and Airtel Jersey (now Sure). A second campaign used SIMjacker-style hidden SMS commands to turn the target SIM/device into a covert tracking beacon. Citizen Lab did not name the vendors; secondary reporting notes overlaps with infrastructure previously associated with Fink Telecom Services and Israeli surveillance firms such as Rayzone, which is not confirmed by the primary report. Researcher Gary Miller noted these two campaigns are a small sample of millions of attacks globally.
Separately, the Financial Times and New York Times (July 2026), citing Mobile Surveillance Monitor research, reported that from late February 2026, during the US-Israel air campaign against Iran, Iranian-linked actors sent repeated SS7 location requests (pings) at Middle Eastern telecom networks occasionally used by US military personnel. Regional networks blocked many of these requests. Reports also say Iranian-linked actors bought commercial advertising data to track devices in Iraq's Kurdistan region. A US official disputed the significance of the tracking data for targeting. Public demonstrations include 60 Minutes Australia (SS7 hijack of Congressman Ted Lieu's phone) and a 2025 Veritasium video, in which calls and texts were hijacked using only a phone number. Cape research presented at the 2025 ACM Wireless Security conference found location-data firewalls with velocity checks can be defeated because 250+ networks are reachable within one hour of travel.
Caveats: the originating BleepingComputer article is sponsored content by Cape, so its mitigations (daily IMSI rotation, no SS7 support, device-level Network Lock, continuous penetration testing) are vendor-proposed. No CVE, CVSS score or technical IOCs (global titles, point codes, IPs) were published in the sources reviewed; the IOC set below is therefore entity- and behavior-level only.
MITRE ATT&CK techniques used in TL-2026-4832
Credential Access
T1111 Multi-Factor Authentication Interception
Discovery
Collection
T1430 Location Tracking; T1557 Adversary-in-the-Middle; T1636.004 SMS Messages
Impact
Resource Development
Reconnaissance
T1589 Gather Victim Identity Information; T1590 Gather Victim Network Information
Defense Evasion
Affected products and versions in SS7 and Diameter Signaling Abuse
- Mobile network operators (GSMA interconnect) — SS7 signaling (2G/3G)
Vulnerable versions: Networks accepting unauthenticated interconnect SS7 traffic - Mobile network operators (GSMA interconnect) — Diameter signaling (4G/5G)
Vulnerable versions: Networks without consistently deployed Diameter protections - Mobile subscribers — SIM cards susceptible to SIMjacker-style hidden SMS commands
Vulnerable versions: Not specified in sources
Remediation for SS7 and Diameter Signaling Abuse
Immediate actions
- Operators: monitor and block inappropriate SS7/Diameter signaling at the interconnect (e.g., unexpected location queries, roaming claims from unrelated networks)
- Operators: deploy signaling firewalls with checks beyond simple velocity/location checks, since 250+ networks are reachable within one hour of travel
- Enterprises/high-risk users: avoid SMS-based two-factor authentication for sensitive accounts
Workarounds
- Vendor-proposed (Cape): daily IMSI rotation, no SS7 support, device-level Network Lock verification
- Prefer app-based or hardware-token MFA and end-to-end encrypted messaging over SMS/voice
Longer-term hardening
- Operators: apply GSMA-style signaling security consistently across Diameter (4G/5G) interconnects
- Restrict or phase out SS7 support where possible
- Continuous signaling penetration testing using current exploitation techniques (vendor-proposed)
- Regulatory oversight of telecom signaling security (FCC probe opened 2024; Sen. Wyden requested a CISA report)
Weaknesses (CWE) in SS7 and Diameter Signaling Abuse
Timeline of SS7 and Diameter Signaling Abuse
- Public demonstrations of SS7 abuse circulate: Veritasium (2025) hijacks a tech influencer's calls/texts using only a phone number, following the earlier 60 Minutes Australia demonstration against Congressman Ted Lieu; Cape presents penetration-testing research at the ACM Wireless Security conference (2025). Dates are year-level only.
- Reported Iranian-linked SS7 location-ping activity against Middle Eastern networks used by US personnel begins in late February 2026 (exact day not stated; end-of-month placeholder), coinciding with the US-Israel air campaign.
- TechCrunch, CyberScoop and The Record report on the Citizen Lab findings; vendors remain unnamed; Sure reports monitoring and blocking inappropriate signaling.
- Citizen Lab publishes 'Uncovering Global Telecom Exploitation by Covert Surveillance Actors', documenting two long-running covert surveillance campaigns abusing SS7, Diameter and SIMjacker-style SMS, with operator identities from 17 countries/regions mimicked.
- Financial Times and New York Times report, citing Mobile Surveillance Monitor, that Iranian-linked actors used SS7 pings to track US military personnel in the Middle East; CENTCOM reportedly implemented force-protection measures.
- BleepingComputer publishes Cape-sponsored article summarizing SS7/Diameter risks and vendor-proposed mitigations.
Sources cited for SS7 and Diameter Signaling Abuse
- SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone (BleepingComputer, sponsored by Cape)
- Uncovering Global Telecom Exploitation by Covert Surveillance Actors (Citizen Lab)
- Surveillance vendors caught abusing access to telcos to track people's phone locations (TechCrunch)
- Surveillance campaigns use commercial surveillance tools to exploit long-known telecom vulnerabilities (CyberScoop)
- Surveillance companies exploiting telecom systems to track location (The Record)
- US personnel faced phone-tracking campaign during Iran war - FT (Iran International)
- Boosting cyber skills, Iran apparently tried to track US military personnel via phones (Times of Israel)
Detection coverage for TL-2026-4832
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4832 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.