– LONDON, UK
Iranian-linked actors conducted a systematic surveillance campaign against US military personnel and contractors across the Middle East, exploiting vulnerabilities in regional mobile telecommunications networks and commercial data systems, both before and during Iran’s 2026 war.
The operation primarily used weaknesses in the SS7 signaling protocol, a known vulnerability in international mobile networks. Leveraging roaming agreements with local telecom providers, the attackers were able to send location queries that revealed the approximate position of targeted devices. Regional telecom operators responded by blocking suspicious repeated signals, indicating the intensity and persistence of the tracking efforts. Iran has documented capabilities to access real-time location information using these types of mobile network methods.
In addition to exploiting signaling vulnerabilities, the campaign incorporated data from commercial advertising databases to monitor and locate devices linked to US military and government personnel. This approach enabled the precise identification of individuals in specific locations, including hotels in the Iraqi Kurdistan Region and locations throughout the Persian Gulf. The dual strategy combined traditional telecommunications vulnerabilities with modern digital tracking technologies as part of a broader intelligence-gathering effort.
Telecommunications logs and analysis by cybersecurity researchers revealed the coordinated nature of these activities. The campaign highlights the significant risks posed by interconnected mobile systems and data ecosystems in conflict zones, where the operational security of deployed forces can be compromised by indirect technical means, rather than by simple direct intrusions.
These events underscore the constantly evolving hybrid nature of modern warfare, where cyber intelligence tools play a critical role alongside conventional operations. As conflicts increasingly incorporate advanced tracking methods, military and government entities face ongoing challenges in safeguarding communications and personnel movements in high-risk environments across the region.