Security Report · github.com/jacobdjwilson

Citizen Lab Uncovers Global Telecom Surveillance Using SS7, Diameter and SIMjacker

Oct 21, 2026 · Original Report (PDF) ↗

Summary

Citizen Lab identified two surveillance campaigns abusing telecom signalling and operator infrastructure for location tracking. Historical telemetry traces activity to 2022; one blocked attempt used a SIMjacker SMS to request location data.

Key points

Citizen Lab correlated signalling firewall logs and packet captures with operator filings, DNS records and BGP routing data to investigate two surveillance clusters, STA1 and STA2.
STA1 combined SS7 and Diameter location queries with spoofed operator identities and routing manipulation. Historical telemetry linked it to more than 500 tracking attempts dating back to November 2022.
Routing analysis showed 019Mobile infrastructure remained reachable through Partner Communications despite absent authoritative IPX DNS resolution. Researchers assessed these networks as likely transit paths, not evidence that 019Mobile conducted the attacks.
STA2 combined SS7 reconnaissance, a binary SIMjacker SMS and Diameter queries. The SMS instructed the SIM’s S@T browser to collect cell-location information and return it silently by SMS.
The February 11, 2025 attack messages were flagged and blocked by a signalling firewall. The malicious SMS never reached the phone, and no location-data exfiltration SMS was sent.
Historical telemetry linked STA2 to more than 15,700 location-tracking attempts since October 2022. Shared identifiers and operational patterns suggested links to Fink Telecom Services, but researchers did not directly attribute the campaign and could not rule out spoofing.
The report identifies weak signalling authentication, interconnect screening and oversight as enabling factors, calling for enforceable interconnect controls and greater transparency in commercial network access.

Article Details

Publisher: Citizen Lab
Scope: Cross-protocol mobile surveillance investigated through signalling firewall telemetry, packet captures, operator records, DNS, and routing data.
Sample Size: Two surveillance actor clusters; total telemetry sample size not disclosed.
Key Statistics: Historical telemetry attributed more than 500 threat events to STA1 since November 2022.
Historical SS7 and Diameter telemetry associated with STA2 identifiers revealed more than 15,700 location-tracking attempts dating back to October 2022.
Between October 2023 and April 2025, more than 1,700 additional SS7 attacks originated from GT 467647531812; more than 92% of its traffic was linked to location tracking.
The spoofed sender identifier 250730091970 had a history of more than 600 events since 2022, exclusively involving location-tracking operations.
During the blocked STA2 operation on 2025-02-11, the actor sent 10 Authentication-Information-Request messages using five operator network identifiers.
Recommendations: Authenticate signalling traffic rather than relying on inter-operator trust.
Screen interconnect traffic and enforce interconnect security controls.
Increase transparency in commercial access to mobile operator networks.
Establish regulatory accountability for abuse of the international telecom interconnect ecosystem.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`cst001[.]epc[.]mnc053[.]mcc234[.]3gppnetwork[.]org`	Valid Tango Networks operator-controlled hostname repeatedly used in STA1 surveillance traffic. Citizen Lab assessed that this suggested sustained infrastructure access, likely through a commercial arrangement.
HOSTNAME	`dra1[.]je211[.]epc[.]mnc003[.]mcc234[.]3gppnetwork[.]org`	Fixed Jersey-Airtel Route-Record host used by STA2 to route surveillance traffic into the IPX backbone.