Loading story…
Iran allegedly exploited weaknesses in global telecommunications infrastructure and the mobile advertising ecosystem to track U.S. military personnel during the Iran war, according to reporting and research cited by SC Media and Citizen Lab. The activity reportedly relied on SS7 signaling weaknesses in legacy 2G and 3G roaming networks to obtain location data on U.S. forces across Iraq, Bahrain, and other Middle Eastern locations, while ad-tech mechanisms were also used to monitor targeted cellphone users.
Citizen Lab said the targeting appeared highly specific and that at least some tracking attempts could be linked to an Iranian mobile phone operator. Researcher Gary Miller told the Financial Times that Iran has the capability to obtain real-time, continuous location information through SS7 or regional mobile network access, and the reported surveillance was said to have supported military strikes that caused several injuries, highlighting persistent risks in telecom signaling systems and ad-tech data collection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The reported surveillance capabilities were said to have supported Iranian military strikes that caused several injuries to U.S. forces during the early phase of the conflict. The reporting presents this as an operational consequence of the location-tracking activity.
During the buildup to and early days of the Iran War, Iran allegedly exploited SS7 weaknesses in 2G/3G roaming infrastructure and used advertising technology to monitor and locate U.S. military personnel in Iraq, Bahrain, and elsewhere in the Middle East. Citizen Lab reporting also linked at least some tracking attempts to an Iranian mobile phone operator and described the activity as highly targeted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab reported two covert surveillance campaigns that exploited weaknesses in global mobile signalling infrastructure to track targets’ locations across borders. The operations, labeled **STA1** and **STA2**, abused legacy `SS7` and newer `Diameter` protocols, with one campaign also using **SIMjacker-style zero-click binary SMS** and malicious SIM Toolkit commands to try to turn a handset into a covert beacon. Researchers said the activity marks the first time real-world attack traffic has been directly linked to mobile operator signalling systems, showing attackers impersonating operators, rotating identities across countries, manipulating routing paths, and evading signalling firewalls while exploiting weak authentication and trusted telecom interconnect relationships. The campaigns were observed using operator identifiers and infrastructure tied to networks in Europe, Africa, the Middle East, and Asia, including telecoms cited as transit or entry points such as **019Mobile**, **Tango Networks U.K.**, and **Airtel Jersey**. Citizen Lab said the activity is consistent with commercial surveillance platforms serving government intelligence customers, and one campaign may have links to an Israeli geo-intelligence provider, though no vendor or operator was conclusively attributed. The researchers warned that abuse of leased or intermediary signalling access, combined with long-standing flaws in roaming trust models, has enabled large volumes of hard-to-detect location tracking that may persist for years across 3G, 4G, and 5G-connected environments.
Jun 29, 2026
The U.S. Department of Defense has confirmed that foreign adversaries used commercially available location data to target and surveil American military personnel in operational theaters, including the Middle East. A newly disclosed U.S. Central Command letter said it had received multiple threat reports involving hostile actors exploiting data collected from phones and computers through the advertising and data-broker ecosystem. Lawmakers led by Senator Ron Wyden and Representative Pat Harrigan said the disclosures amount to the first public confirmation that purchased commercial geolocation data was used against U.S. troops in active war zones, and warned that the ad-tech industry now poses a **national security threat**. The reports say Pentagon safeguards were insufficient: service members were allowed to use personal devices in operational areas, no policy required geolocation to be disabled in active war zones, and even government-issued devices did not fully block advertising-related tracking. Critics said the risk had been documented for years, citing contractor briefings dating back to 2016, demonstrations tracing personnel from U.S. bases to a covert site in Syria, and later studies showing brokers could easily sell sensitive data on service members. The Pentagon said it is moving to a new mobile device management system to better disable location services, but lawmakers warned that broader use of bring-your-own-device policies and weak regulation of data brokers continue to leave troops exposed.
Jun 29, 2026
Amid Israeli and US strikes on Iran and subsequent regional escalation, an apparently compromised Android prayer-timing app (*BadeSaba Calendar*, reported as having **5M+** Google Play downloads) pushed coordinated political/psychological messages to users in Iran, including calls for Iranian military personnel to **surrender** and promises of **amnesty**. The notifications arrived in rapid succession over roughly 30 minutes shortly after explosions were reported in Tehran; no actor publicly claimed responsibility, and the incident highlights the risk of mass-notification channels in widely installed mobile apps being abused for influence operations during kinetic conflict. Separately, reporting described Iran’s recent, unusually severe communications blackout as part of a government crackdown on protests: beyond typical censorship, connectivity was disrupted across **mobile networks, SMS, and landlines**, and even **Starlink** access was reportedly blocked; when limited domestic services returned, social/interactive features were selectively removed to reduce coordination. A third item focused on the UAE’s layered missile-defense architecture (e.g., **THAAD** and **Patriot**) used to intercept Iranian ballistic missiles, which is contextually related to the broader conflict but not directly tied to the cyber/information-operations and communications-control developments.
Jun 29, 2026