STA1

STA1 is a covert telecom surveillance threat actor engaged in long-running targeted location-tracking espionage by abusing weaknesses in global mobile signalling systems. The actor has been active since at least 2022 and has been observed conducting hundreds of surveillance events against high-value mobile subscribers across multiple countries. STA1’s operations are characterized by persistent, technically sophisticated abuse of SS7 and Diameter/4G roaming infrastructure rather than exploitation of endpoint software vulnerabilities. STA1 uses multi-stage signalling attacks to identify and track targets. Observed tradecraft includes reconnaissance with SS7 routing queries, follow-on location requests using provideSubscriberInfo, escalation to anyTimeInterrogation, and pivots into Diameter signalling such as Insert-Subscriber-Data-Request. The actor rapidly switches between SS7 and Diameter to test defensive gaps, evade signalling firewalls, and continue tracking when one protocol path is blocked. STA1 also manipulates routing metadata and spoofs operator identities, hostnames, and realms to make malicious requests resemble legitimate roaming traffic and to steer messages through alternate interconnect paths. A defining feature of STA1 is its use of third-party telecom interconnect access and recurring transit networks to blend into trusted signalling ecosystems. The actor has been observed rotating operator identities across multiple countries and exploiting mismatches between claimed operator identity and actual routing characteristics, consistent with use of leased or brokered signalling access. This tradecraft aligns with a centralized commercial telecom surveillance platform or service model supporting intelligence collection. Known activity includes a coordinated November 2024 campaign against a high-profile subscriber at a Middle Eastern operator. In that operation, STA1 combined SS7 reconnaissance, repeated subscriber-location probes, Diameter-based signalling abuse, and renewed SS7 escalation in a sustained attempt to obtain location information. Broader telemetry links STA1 to targeting of subscribers in Thailand, South Africa, Norway, Bangladesh, Denmark, Sweden, Malaysia, Montenegro, and multiple Sub-Saharan African countries. STA1 has not been directly attributed to a specific government. Available evidence supports assessment of a surveillance actor operating in the commercial lawful-intercept or telecom intrusion ecosystem and likely supporting state intelligence objectives. No confirmed aliases or sub-groups beyond the designation STA1 are currently available.