Researchers linked two campaigns by unnamed surveillance vendors that posed as legitimate mobile operators to abusively query telecom signalling infrastructure and geolocate targets. The campaigns exploited weaknesses in SS7 and Diameter protocols and used malicious hidden SMS commands and operator-impersonation tactics to steer traffic and mask their activity.
Part of the PlainSec briefing for 2026-04-23