Loading story…
Researchers at i2CAT Foundation, the University of Murcia, and NEC Laboratories Europe introduced 5G-Shark, a low-cost rogue-5G-cell auditing tool that exploits unauthenticated cell-reselection broadcasts to draw nearby idle devices to a fake base station without jamming or malformed traffic. Testing against commercial 5G Standalone networks found that permanent subscriber identities were generally protected, but near-sequential, predictable rotation of temporary GUTI identifiers enabled linkage of 84% to 96% of consecutive registrations in some operator deployments, creating a persistent subscriber-tracking risk.
The researchers also used crafted unauthenticated Registration Reject messages to force radio-access downgrade and denial-of-service conditions. A Samsung Galaxy S23 could be pushed into limited-service 3G, an infinite retry loop, or a modem state requiring manual reset. The study attributes predictable temporary-ID allocation to operator or vendor implementation choices, while exposure to identity requests and pre-authentication rejection messages reflects limitations in the 5G specification; operators should assess identifier-allocation behavior and device resilience to unauthenticated signalling.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Oscar Lasierra, Gines Garcia-Aviles, Antonio Skarmeta, and Xavier Costa-Pérez submitted the 5G-Shark paper as a preprint. The paper describes a low-cost rogue 5G cell that exploits unauthenticated cell reselection without jamming or malformed packets and distinguishes protocol-design limitations from deployment implementation gaps.
Researchers from i2CAT Foundation, the University of Murcia, and NEC Laboratories Europe used the 5G-Shark rogue-cell methodology to assess commercial 5G deployments. They found near-sequential temporary GUTI reassignment in some networks, enabling linkage of 84% to 96% of consecutive registrations, and demonstrated crafted Registration Reject messages that downgraded or caused denial-of-service states on a Samsung Galaxy S23.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab reported two covert surveillance campaigns that exploited weaknesses in global mobile signalling infrastructure to track targets’ locations across borders. The operations, labeled **STA1** and **STA2**, abused legacy `SS7` and newer `Diameter` protocols, with one campaign also using **SIMjacker-style zero-click binary SMS** and malicious SIM Toolkit commands to try to turn a handset into a covert beacon. Researchers said the activity marks the first time real-world attack traffic has been directly linked to mobile operator signalling systems, showing attackers impersonating operators, rotating identities across countries, manipulating routing paths, and evading signalling firewalls while exploiting weak authentication and trusted telecom interconnect relationships. The campaigns were observed using operator identifiers and infrastructure tied to networks in Europe, Africa, the Middle East, and Asia, including telecoms cited as transit or entry points such as **019Mobile**, **Tango Networks U.K.**, and **Airtel Jersey**. Citizen Lab said the activity is consistent with commercial surveillance platforms serving government intelligence customers, and one campaign may have links to an Israeli geo-intelligence provider, though no vendor or operator was conclusively attributed. The researchers warned that abuse of leased or intermediary signalling access, combined with long-standing flaws in roaming trust models, has enabled large volumes of hard-to-detect location tracking that may persist for years across 3G, 4G, and 5G-connected environments.
Aug 24, 2026
Researchers from the University of Birmingham and Fuzzware disclosed that malicious or compromised SIM cards can abuse standards-compliant SIM Toolkit features, including **Proactive SIM** and `RUN AT`, to send AT commands directly to modems in some smartphones and cellular IoT devices. Testing with the **CATana** toolkit found exposed SIM-to-modem command interfaces on a subset of 26 devices, including multiple Qualcomm-based and Quectel-powered designs, enabling attacks such as arbitrary file reads, denial of service, forced shutdowns, persistent downgrades from **5G to 2G**, and in some cases code execution. Demonstrated targets included an **Autel EV charger** using a Quectel `EC25-AFX` module, an **OPPO Reno14 F 5G**, and a **Quectel EG25-G** modem. The broader modem interface issue is being tracked as **`CVE-2026-57550`** and **GSMA `CVD-2026-0122`**, while a related Android flaw that let a hostile SIM open an attacker-controlled website without user interaction was tracked as **`CVE-2025-48618`** and patched by Google for Android 13 through 16 in December 2025. Qualcomm said it offers a hardened configuration that disables the SIM AT interface by default, and Quectel said it mitigated one file-access flaw and had fixed command injection in newer firmware. The researchers warned that vendor-by-vendor fixes may not be enough and urged deprecation of the `RUN AT` feature to reduce the attack surface across phones, EV chargers, industrial routers, and vehicle telematics systems.
Aug 14, 2026
Multiple reports highlight evolving **Android** threats that abuse SMS/telephony access and advanced evasion to enable fraud, surveillance, and account takeover. CloudSEK described a shift from repackaged apps to **runtime manipulation** using the *LSPosed* framework, where a malicious module (e.g., **Digital Lutera**) hooks `SmsManager` and `TelephonyManager` to undermine India’s **UPI SIM-binding** controls. The technique can intercept registration tokens and 2FA, spoof device identity/phone number, and exfiltrate data to **Telegram**; it also uses **Socket.IO** for real-time C2 and can remotely inject fabricated SMS entries into the device’s “Sent” database to make bank backends believe a SIM is present on a different device, enabling scalable payment fraud and account takeover. Separately, Acronis TRU (reported by Hackread) identified a **fake Red Alert** rocket-warning app distributed via SMS lures impersonating Israel’s Home Front Command; the trojanized app displays legitimate alerts to reduce suspicion while requesting extensive permissions to steal **GPS location**, **SMS/OTP**, contacts, installed-app inventory, and on-device account details, then exfiltrates data to a remote server, including via **certificate spoofing** and UI tricks to appear Play Store-installed. Zimperium reported a new Android RAT, **SurxRAT**, that can download and run **LLM modules** from third-party repositories to automate phishing and social engineering and to interact with apps/UI for credential theft and data exfiltration, reinforcing the need for behavior-based mobile detection, tighter app controls, and stronger integrity enforcement (e.g., *Play Integrity API* with `MEETS_STRONG_INTEGRITY`) where applicable.
Jun 29, 2026