Loading story…
Investigators suspect Iran or Iranian-aligned actors used commercial advertising data and vulnerable cellular infrastructure to help locate U.S. military personnel during the recent Iran-U.S. conflict. Reporting cited by multiple sources says troops moved from bases into hotels and civilian buildings in locations including Iraqi Kurdistan and Bahrain, where repeated mobile app bid requests may have exposed device identifiers and precise movement patterns through real-time bidding systems. Researchers said social media, human sources, and telecom signaling data were also likely part of the targeting picture, although attribution for specific strikes or attacks remains unconfirmed.
Citizen Lab said the activity reflects a long-running weakness in global mobile networks, where SS7-style attacks and broader telecom interconnect abuse can still be used to track phones despite years of warnings. The combined reporting underscores that commercially available location data and insecure carrier infrastructure can create a persistent intelligence exposure for deployed personnel, allowing state actors and surveillance vendors to identify, monitor, and potentially target sensitive movements outside traditional military facilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Reporting cited in the references says investigators suspect Iran or Iranian-aligned forces used commercial advertising data, SS7 telecom signaling data, social media, and human sources to help locate U.S. military personnel. The sources note attribution remains unconfirmed as to which specific attacks, if any, were guided by ad-data targeting.
During the recent Iran-U.S. conflict, U.S. troops reportedly relocated from bases into hotels and civilian buildings in locations including Iraqi Kurdistan and Bahrain. Investigators later suspected some of these sites may have been identified through commercial ad-tech location data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran allegedly exploited weaknesses in global telecommunications infrastructure and the mobile advertising ecosystem to track U.S. military personnel during the Iran war, according to reporting and research cited by SC Media and Citizen Lab. The activity reportedly relied on **SS7** signaling weaknesses in legacy `2G` and `3G` roaming networks to obtain location data on U.S. forces across Iraq, Bahrain, and other Middle Eastern locations, while ad-tech mechanisms were also used to monitor targeted cellphone users. Citizen Lab said the targeting appeared highly specific and that at least some tracking attempts could be linked to an Iranian mobile phone operator. Researcher Gary Miller told the *Financial Times* that Iran has the capability to obtain real-time, continuous location information through SS7 or regional mobile network access, and the reported surveillance was said to have supported military strikes that caused several injuries, highlighting persistent risks in telecom signaling systems and ad-tech data collection.
Jul 20, 2026
The U.S. Department of Defense has confirmed that foreign adversaries used commercially available location data to target and surveil American military personnel in operational theaters, including the Middle East. A newly disclosed U.S. Central Command letter said it had received multiple threat reports involving hostile actors exploiting data collected from phones and computers through the advertising and data-broker ecosystem. Lawmakers led by Senator Ron Wyden and Representative Pat Harrigan said the disclosures amount to the first public confirmation that purchased commercial geolocation data was used against U.S. troops in active war zones, and warned that the ad-tech industry now poses a **national security threat**. The reports say Pentagon safeguards were insufficient: service members were allowed to use personal devices in operational areas, no policy required geolocation to be disabled in active war zones, and even government-issued devices did not fully block advertising-related tracking. Critics said the risk had been documented for years, citing contractor briefings dating back to 2016, demonstrations tracing personnel from U.S. bases to a covert site in Syria, and later studies showing brokers could easily sell sensitive data on service members. The Pentagon said it is moving to a new mobile device management system to better disable location services, but lawmakers warned that broader use of bring-your-own-device policies and weak regulation of data brokers continue to leave troops exposed.
Jun 29, 2026
Citizen Lab reported two covert surveillance campaigns that exploited weaknesses in global mobile signalling infrastructure to track targets’ locations across borders. The operations, labeled **STA1** and **STA2**, abused legacy `SS7` and newer `Diameter` protocols, with one campaign also using **SIMjacker-style zero-click binary SMS** and malicious SIM Toolkit commands to try to turn a handset into a covert beacon. Researchers said the activity marks the first time real-world attack traffic has been directly linked to mobile operator signalling systems, showing attackers impersonating operators, rotating identities across countries, manipulating routing paths, and evading signalling firewalls while exploiting weak authentication and trusted telecom interconnect relationships. The campaigns were observed using operator identifiers and infrastructure tied to networks in Europe, Africa, the Middle East, and Asia, including telecoms cited as transit or entry points such as **019Mobile**, **Tango Networks U.K.**, and **Airtel Jersey**. Citizen Lab said the activity is consistent with commercial surveillance platforms serving government intelligence customers, and one campaign may have links to an Israeli geo-intelligence provider, though no vendor or operator was conclusively attributed. The researchers warned that abuse of leased or intermediary signalling access, combined with long-standing flaws in roaming trust models, has enabled large volumes of hard-to-detect location tracking that may persist for years across 3G, 4G, and 5G-connected environments.
Jun 29, 2026