# SS7 and Diameter Signaling Abuse: Covert Surveillance Campaigns and Iranian-Linked Tracking of US Personnel Expose Mobile Subscribers to Location Tracking and Interception

> SS7 (2G/3G) and Diameter (4G/5G) inter-carrier signaling lacks robust sender authentication, and is being actively abused for real-time location tracking, IMSI harvesting and SMS/call interception. Citizen Lab (April 2026) documented two long-running covert surveillance campaigns, and Iranian-linked actors were reported to have used SS7 to track US military personnel in the Middle East.

- **Published:** 2026-10-30T14:14:13Z
- **Last reviewed:** 2026-10-30T14:14:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4832
- **ID:** TL-2026-4832
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SS7 is a 1970s signaling protocol used by 2G/3G networks with essentially no process for authenticating requests; any party with access to the interconnect can send messages that the receiving operator treats as coming from a legitimate carrier. Diameter, the 4G/5G successor, supports stronger authentication, but operators deploy protections inconsistently, so equivalent abuse remains possible. Reported abuse classes include real-time location tracking via cell-tower queries, IMSI harvesting for reuse, communication and SMS interception (including two-factor codes) by falsely claiming roaming, impersonation and service blocking using a harvested IMSI, and network disruption through misconfigured signaling messages.

Citizen Lab's report 'Uncovering Global Telecom Exploitation by Covert Surveillance Actors' (Gary Miller and Swantje Lange, 2026-04-23) documents two long-running commercial surveillance campaigns with thousands of attacks against targets in dozens of countries. The same IMSIs were attacked across operations separated by months and years. The first campaign attempted SS7 abuse and shifted to Diameter when SS7 attempts failed, and steered traffic through different network pathways to hide. One actor, STA1, repeatedly tried to track a user while rotating through eleven operator identities in nine countries. The infrastructure of operators in 17 countries/regions was mimicked, including 019Mobile (Israel), Tango Networks UK and Airtel Jersey (now Sure). A second campaign used SIMjacker-style hidden SMS commands to turn the target SIM/device into a covert tracking beacon. Citizen Lab did not name the vendors; secondary reporting notes overlaps with infrastructure previously associated with Fink Telecom Services and Israeli surveillance firms such as Rayzone, which is not confirmed by the primary report. Researcher Gary Miller noted these two campaigns are a small sample of millions of attacks globally.

Separately, the Financial Times and New York Times (July 2026), citing Mobile Surveillance Monitor research, reported that from late February 2026, during the US-Israel air campaign against Iran, Iranian-linked actors sent repeated SS7 location requests (pings) at Middle Eastern telecom networks occasionally used by US military personnel. Regional networks blocked many of these requests. Reports also say Iranian-linked actors bought commercial advertising data to track devices in Iraq's Kurdistan region. A US official disputed the significance of the tracking data for targeting. Public demonstrations include 60 Minutes Australia (SS7 hijack of Congressman Ted Lieu's phone) and a 2025 Veritasium video, in which calls and texts were hijacked using only a phone number. Cape research presented at the 2025 ACM Wireless Security conference found location-data firewalls with velocity checks can be defeated because 250+ networks are reachable within one hour of travel.

Caveats: the originating BleepingComputer article is sponsored content by Cape, so its mitigations (daily IMSI rotation, no SS7 support, device-level Network Lock, continuous penetration testing) are vendor-proposed. No CVE, CVSS score or technical IOCs (global titles, point codes, IPs) were published in the sources reviewed; the IOC set below is therefore entity- and behavior-level only.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1557 Adversary-in-the-Middle
- T1430 Location Tracking
- T1430 Location Tracking
- T1636.004 SMS Messages
- T1582 SMS Control

## Sources

- [SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone (BleepingComputer, sponsored by Cape)](https://www.bleepingcomputer.com/news/security/ss7-and-diameter-attacks-how-signaling-flaws-expose-your-phone/)
- [Uncovering Global Telecom Exploitation by Covert Surveillance Actors (Citizen Lab)](https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/)
- [Surveillance vendors caught abusing access to telcos to track people's phone locations (TechCrunch)](https://techcrunch.com/2026/04/23/surveillance-vendors-caught-abusing-access-to-telcos-to-track-peoples-phone-locations-researchers-say/)
- [Surveillance campaigns use commercial surveillance tools to exploit long-known telecom vulnerabilities (CyberScoop)](https://cyberscoop.com/surveillance-campaigns-use-commercial-surveillance-tools-to-exploit-long-known-telecom-vulnerabilities/)
- [Surveillance companies exploiting telecom systems to track location (The Record)](https://therecord.media/surveillance-companies-exploiting-telecom-systems-to-track-location)
- [US personnel faced phone-tracking campaign during Iran war - FT (Iran International)](https://www.iranintl.com/en/202607146253)
- [Boosting cyber skills, Iran apparently tried to track US military personnel via phones (Times of Israel)](https://www.timesofisrael.com/boosting-cyber-skills-iran-apparently-tried-to-track-us-military-personnel-via-phones-report/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4832