Iran Used a 40-Year-Old Phone Network Flaw to Hunt US Troops in the Middle East

Iran allegedly used a telecom vulnerability older than the smartphone itself to hunt down American troops.

According to the Financial Times, citing telecom data, cybersecurity experts, and officials familiar with the matter, Iran or Iranian-aligned actors ran a coordinated campaign to track US military personnel and contractors across the Middle East. The campaign started in the build-up to the US-Israeli attacks on Iran in late February and continued into the early days of the war.

The tool: SS7, or Signaling System 7. It's the protocol backbone that's connected global telecom networks since the 2G and 3G era, and it has a well-documented flaw. Anyone with the right access can send an SS7 "ping" and get back a rough location on a target phone. No malware or hacking of the device itself is required.

How It Worked

Regional telecom networks in the Middle East fielded repeated SS7 location requests aimed at specific phones roaming outside their home networks, according to the FT, which cited data from the Mobile Surveillance Monitor research project. Two cybersecurity experts who reviewed that data told the paper the pattern looked coordinated, not random.

Gary Miller, a senior research fellow at Citizen Lab, put it bluntly to the FT: "Iran absolutely has capabilities to get real-time, immediate, and continuous location information. It would surprise me very much if Iran were not using SS7, or mobile network access in the region, to track US users." Miller added the targeting looked specific: "They are targeting specific devices."

Persian Gulf officials suspect Iran or allied groups exploited roaming agreements between Iranian mobile operators and regional carriers to pull this off, a person familiar with the matter told the FT. Iranian telecom providers have roaming deals across the Gulf, which gives them a technical foothold to send SS7 requests beyond Iran's borders.

At least some of the blocked tracking attempts were tied to an Iranian mobile operator through a shared technical fingerprint, according to the FT's reporting.

The Ad-Tech Angle

SS7 wasn't the only tool. A US official told the FT that Iran-linked actors are believed to have also tapped commercial advertising databases, the same ones that track phones for targeted ads, to locate personnel in Iraqi Kurdistan specifically. Advertising identifiers baked into smartphones can reveal a device's location without ever touching the phone's security.

The FT reported Iran also used this ad-tech method to identify hotels housing US government employees and contractors. TechCrunch, citing the same FT reporting, noted the resulting strikes on US personnel at bases and hotels in Iraq, Bahrain, and elsewhere in the region caused several injuries.

What's Proven, What Isn't

US Central Command told Congress back in April that it had received multiple threat reports about adversaries exploiting commercial location data to monitor or target US personnel in the region. That's confirmed and on the record.

What's not confirmed: a direct causal link between the tracking and specific missile or drone strikes. A US official told the FT there's no evidence data tracking played a significant role in the attacks. Centcom says it has taken force-protection measures to safeguard forces, though it hasn't detailed what those measures are.

Iran had the capability and, per multiple experts and officials, very likely used it. Whether that tracking led directly to specific strikes that injured US personnel is not established in the available reporting.

Congress Already Knew About This

This isn't a surprise to Capitol Hill. Senator Ron Wyden, an Oregon Democrat, told the FT he's warned both Democratic and Republican administrations for years about the national security risk of foreign adversaries tracking US personnel through commercial and telecom data. Wyden cited a Department of Homeland Security presentation that named Iran as one of the "primary countries" using SS7 to target US subscribers.

Republican Representative Pat Harrigan told the FT legislation is needed to address the gap, according to the report.

The SS7 vulnerability isn't new. It's been a known weakness in global telecom infrastructure for years, exploited by intelligence agencies and criminal actors alike. The fact that the Pentagon's own personnel remained exposed to it during an active shooting war, despite years of warnings from lawmakers in both parties, is the part that deserves scrutiny.

Centcom hasn't detailed what its "force-protection measures" actually consist of, and no congressional hearing has yet been scheduled specifically on the SS7 findings in this report. Whether lawmakers move beyond warnings this time, after years of Wyden flagging the same hole to two administrations, is the open question.