Baseband RCE and SIMurai: The New Frontier of Zero-Click Mobile Surveillance

The Silent Threat: Modem-Level Remote Code Execution (RCE)\n\nBaseband vulnerabilities represent the most significant 'blind spot' in modern mobile security, operating beneath the visibility of standard operating systems and security software. A baseband processor is a dedicated chip in a mobile device that handles all cellular communication protocols, including 4G LTE and 5G. Unlike the Application Processor (AP) which runs Android or iOS, the baseband runs its own proprietary real-time operating system (RTOS). The recent disclosure of CVE-2026-0120, a critical Remote Code Execution (RCE) vulnerability in the Google Android modem component, underscores the severity of this attack vector. This flaw, caused by an out-of-bounds write, allows an attacker to execute arbitrary code on the modem without any user interaction, a technique known as a zero-click exploit.\n\nFor corporate and investigative professionals, the implications of modem-level RCE are profound. Because the baseband manages the device's connection to the cellular network, a compromise at this level allows for sophisticated cellular interception. An attacker can bypass the encryption layers of the main OS, potentially accessing raw voice data and SMS traffic before it is even processed by the user's apps. This is why high-assurance encrypted phones are increasingly designed to isolate the baseband from the rest of the system. When a modem is compromised, the device effectively becomes a tool for mobile surveillance, capable of tracking location and intercepting metadata with near-total stealth.\n\n## SIMurai and the Vulnerability of the Trusted Element\n\nWhile the baseband is the gateway, the SIM card is the 'trusted element' that authenticates the user to the network. Recent research, notably the SIMurai platform presented at USENIX, has revealed that SIM cards are far from the secure enclaves they were once thought to be. A SIM card is essentially a computer-within-a-computer, running its own Java Card operating system and hosting applications via the SIM Toolkit (STK). The SIMurai research identified high-severity vulnerabilities, such as CVE-2024-27209, which allow for the unauthorized sending of SMS messages and the potential for remote exploitation via the radio interface.\n\nThese vulnerabilities are particularly dangerous because they can be exploited via hardware surveillance techniques. By emulating a base station or using specialized hardware to interact with the SIM's application layer, attackers can trigger legacy functions like the S@T Browser to execute commands. This can lead to the installation of mobile malware or the silent redirection of traffic. For those relying on encrypted communications, the threat of SIM cloning or SIM-based tracking remains a persistent risk, especially in regions where legacy 2G and 3G protocols—which lack mutual authentication—are still active. The ability to clone a SIM's identity (IMSI and Ki) allows an attacker to impersonate a target, effectively hijacking their cellular identity for further downstream attacks.\n\n## The Pivot: From Cellular Interception to Total Device Compromise\n\nThe ultimate goal of a baseband exploit is the 'pivot'—moving from the compromised modem to the main Application Processor. This is the mechanism used by the most advanced spyware for phones, including state-sponsored tools like Pegasus. When an attacker achieves RCE on the baseband, they attempt to exploit vulnerabilities in the kernel drivers that manage the interface between the modem and the AP. If successful, the attacker gains kernel-level privileges on the main OS, rendering standard security measures like sandboxing and app-level encryption moot.\n\nOnce this pivot is achieved, the device is fully compromised. The attacker can extract photos, record ambient audio, and bypass encrypted communications by capturing data directly from the screen or keyboard buffer. This level of access is what makes baseband exploits a preferred Pegasus spyware alternative for sophisticated threat actors. Furthermore, these attacks are notoriously difficult to detect during mobile forensics investigations. Because the initial exploit occurs in the modem's volatile memory, it often leaves no trace on the device's primary storage, making it a 'ghost' in the machine that can persist across reboots if a baseband bootkit is successfully installed.\n\n## Defensive Architectures and the Limits of Software Security\n\nIn response to these escalating threats, manufacturers are beginning to implement hardware-level hardening. Google's recent updates for the Pixel 9, for instance, include a hardened baseband architecture designed to mitigate modem-level attacks. These defenses include improved memory protection and stricter isolation between the modem and the AP. However, for professionals in high-risk environments, software updates alone may not be sufficient. The complexity of the Radio Resource Control (RRC) layer and the sheer volume of legacy code in modem firmware mean that new vulnerabilities, such as the CVE-2025-43706 Denial-of-Service (DoS) flaw in Samsung Exynos modems, will continue to emerge.\n\nTrue security in the face of mobile surveillance requires a multi-layered approach. This includes the use of hardware-modified phones that provide physical kill switches for the microphone and camera, as well as the deployment of a C2 dashboard for enterprise-level monitoring of device health and anomalous network behavior. Organizations must also move away from SMS-based two-factor authentication, which is easily intercepted via baseband or SS7-level attacks, in favor of hardware security keys or app-based TOTP. As the cellular landscape evolves toward 5G, the attack surface only grows, making the proactive identification of baseband flaws a critical component of any robust cybersecurity posture.\n\n## Key Takeaway\n\nThe discovery of zero-click RCE vulnerabilities like CVE-2026-0120 and the SIMurai research confirms that the cellular modem and SIM card are the primary frontiers for modern mobile exploitation. Security professionals must recognize that traditional OS-level protections are insufficient against hardware-level attacks. Protecting sensitive data now requires a transition to specialized hardware and isolated communication environments that treat the cellular network as an inherently untrusted medium.\n\nThis analysis is intended for security professionals and compliance officers; all surveillance technologies must be used in accordance with applicable local and international laws.