Loading threat actor…
STA2 is a surveillance threat actor engaged in long-running mobile espionage operations that exploit weaknesses in the global telecommunications signalling ecosystem. The actor has been observed since at least 2022 conducting covert location-tracking activity against mobile subscribers by combining legacy SS7 signalling abuse, 4G Diameter signalling abuse, and device-level SIM exploitation. STA2’s tradecraft is distinct from pure signalling-only operators because it blends network-layer probing with a zero-click binary SMS designed to trigger malicious SIM Toolkit behavior through the S@T Browser, effectively attempting to turn a target handset into a silent location beacon. Observed STA2 operations begin with SS7 reconnaissance, including subscriber-information queries used to validate target reachability and positioning. The actor then delivers a specially crafted over-the-air binary SMS that silently invokes SIM-resident commands without user interaction or visible notification. This SIMjacker-style technique is used to collect cellular location metadata from the device and exfiltrate it through SMS. STA2 has also been observed pivoting back into Diameter after the SIM-based stage, using spoofed operator identities and malformed or non-standard signalling elements to continue location tracking and to obscure operational origin. The actor abuses trusted telecom interconnect relationships, manipulates routing data, and blends malicious traffic into legitimate roaming and signalling flows to evade screening and attribution. The activity is consistent with a sophisticated commercial-surveillance-enabled espionage capability rather than ordinary cybercrime. Strong technical overlaps have been reported between STA2 and Fink Telecom Services, a Swiss telecom surveillance vendor, although the operations themselves have been assessed as likely supporting state intelligence customers rather than being conclusively attributed to a specific government. STA2 is one of two related surveillance clusters tracked alongside STA1, but it is differentiated by its use of SIMjacker-style exploitation and higher-volume, persistent targeting. Historical telemetry has linked STA2 to more than 15,700 location-tracking attempts over multiple years.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting SIMjacker-style mobile subscriber surveillance using SS7 probing, malicious OTA SMS messages, and Diameter spoofing to silently collect and exfiltrate device location data.
Conducting covert mobile surveillance by combining SS7 network probing with a zero-click binary SMS payload and malicious SIM Toolkit commands to extract location data directly from target devices without alerting victims.
Telecom surveillance actor combining SS7 signalling abuse, SIM-based exploitation, SIMjacker-style zero-click binary SMS, and Diameter probing/location tracking to covertly track devices and exfiltrate location data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.