New SS7 Exploits Bypass Telecom Security for Covert Mobile Surveillance

The Evolution of SS7 Signaling Exploits

Recent intelligence indicates that the threat landscape surrounding Signaling System No. 7 (SS7)—the aging protocol suite responsible for global mobile network interoperability—has shifted toward more sophisticated, evasive techniques. As of July 2025, security researchers at Enea have identified a novel attack vector that successfully bypasses existing SS7 firewall protections to perform covert location tracking [2, 9]. This development underscores the persistent vulnerability of core network signaling, where attackers manipulate the Transaction Capabilities Application Part (TCAP) layer to disguise malicious requests [3, 9].

Unlike traditional brute-force methods, this new technique utilizes "extended tag encoding" to hide GSM-MAP (Mobile Application Part) commands, specifically the ProvideSubscriberInfo (PSI) request [2, 3]. By structuring these packets in a way that standard security systems fail to decode, malicious actors can trick telecommunications infrastructure into disclosing a subscriber's precise location [2, 9]. This bypass demonstrates that even when operators implement defensive measures, the inherent trust model of SS7 remains a significant liability for encrypted communications.

IMSI Catchers and the Radio-Side Threat

While SS7 exploits target the core network, the radio-side threat remains equally potent. An IMSI catcher—often referred to as a "Stingray"—functions by masquerading as a legitimate cell tower, forcing nearby mobile devices to connect to it [6]. Once a device is lured, the attacker can intercept traffic or perform localized tracking [4, 6]. Despite the transition to 5G, research confirms that radio-side capture remains a viable attack vector, particularly when attackers exploit paging protocols to force device identification [4, 5].

For professionals concerned with hardware-modified phones, the risk is compounded by the fact that these devices are often susceptible to both core-network signaling attacks and localized radio-side interception. The persistence of these vulnerabilities necessitates a defense-in-depth strategy, as relying solely on network-level security is insufficient against adversaries capable of deploying spyware for phones or sophisticated interception hardware.

The Convergence of Mobile Surveillance and Malware

Modern mobile surveillance is rarely limited to a single vector. We are seeing an increasing convergence where cellular interception techniques are used to facilitate the delivery of mobile malware or to track targets for Pegasus spyware alternative deployments. By using SS7 to identify a target's location or network status, an attacker can time their zero-click exploit delivery with surgical precision, minimizing the window for detection.

Furthermore, the lack of visibility into the C2 dashboard used by these surveillance firms makes it difficult for compliance and investigative teams to attribute attacks. As signaling protocols continue to be abused, the reliance on standard mobile security features is no longer a viable strategy for high-risk individuals. Organizations must prioritize hardened communication channels that operate independently of the vulnerable cellular signaling core.

Key Takeaway

The exploitation of SS7 and IMSI catchers has evolved from simple interception to highly evasive, protocol-level manipulation that bypasses modern telecom firewalls. Protecting sensitive data now requires moving beyond standard mobile security, utilizing hardened hardware, and assuming that the underlying cellular network is inherently compromised. Lawful use of these technologies is strictly limited to authorized government and law enforcement agencies under specific legal frameworks.