STA2
STA2 is a surveillance threat actor identified by Citizen Lab as one of two distinct actors, alongside STA1, operating long-running mobile espionage campaigns since at least 2022. Citizen Lab did not directly attribute STA2 to a specific government or organization, but assessed the activity as likely state-sponsored intelligence operations supported by commercial surveillance platforms. The reporting also states that STA2 showed strong technical fingerprints linking it to Fink Telecom Services of Switzerland. STA2 uses a technically distinct mobile surveillance approach that combines network-level signalling abuse with device-level exploitation. In early 2025, including an observed campaign on February 11, 2025, STA2 used SS7 probing together with a SIMjacker-style malicious binary SMS exploiting the SIM card’s S@T Browser. The actor sent specially crafted OTA SMS messages with TP-PID=127 and TP-DCS=22 to invoke TLV bytecode commands on the SIM card, silently collect location-related data including Cell ID, LAC, MCC, and MNC, and exfiltrate that data via an invisible SMS to an SMSC in Liechtenstein identified as FL1. The activity was described as zero-click and leaving no visible trace or requiring user interaction. Observed STA2 tradecraft includes SS7 provideSubscriberInfo probing through Telenabler AB in Sweden; delivery of an SS7 mt-ForwardSM carrying the malicious binary SMS; use of a spoofed SMS sender address mapped to an Airtel Rwanda Global Title range; and follow-on Diameter probing and location-query activity. After the SIM exploitation attempt, STA2 pivoted to Diameter Authentication-Information-Request messages with malformed Visited-PLMN ID 0000 and then to Insert-Subscriber-Data-Request queries. The actor spoofed Diameter identifiers associated with operators in Poland, Switzerland, Morocco, Namibia, Lesotho, and Mozambique, and consistently used the Route-Record host dra1.je211.epc.mnc003.mcc234.3gppnetwork.org, indicating a fixed entry path through Jersey-Airtel infrastructure. Citizen Lab reported that STA2 logged more than 15,700 location-tracking attempts dating back to October 2022. The actor’s operations fit a broader surveillance ecosystem abusing weaknesses in SS7 and Diameter/4G trust relationships, bypassing telecom firewalls, blending into legitimate roaming traffic through third-party interconnect providers, and exploiting weak screening and authentication in global telecom signalling networks.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- SE
- LI
- PL
- CH
- MA
- NA
- LS
- MZ
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting SIMjacker-style mobile subscriber surveillance using SS7 probing, malicious OTA SMS messages, and Diameter spoofing to silently collect and exfiltrate device location data.
Conducting covert mobile surveillance by combining SS7 network probing with a zero-click binary SMS payload and malicious SIM Toolkit commands to extract location data directly from target devices without alerting victims.
Telecom surveillance actor combining SS7 signalling abuse, SIM-based exploitation, SIMjacker-style zero-click binary SMS, and Diameter probing/location tracking to covertly track devices and exfiltrate location data.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.