Bad Connection: Global Telecom Exploitation by Covert Surveillance Actors

Citizen Lab’s Bad Connection report documents two long-running surveillance campaigns. STA1 has been abusing SS7/Diameter signalling since at least November 2022, spoofing operator identities, rotating country codes, and abusing “combined attach” for silent 3G/4G location tracking. STA2 fires SIMjacker-style binary SMS at the S@T browser to pull location with zero user interaction. The SIM-side trick is an old one: AdaptiveMobile Security, now part of Enea, described Simjacker back in 2019 as an exploit built by a private company that works with governments to monitor individuals, already used to pull the location of thousands of devices. Named gateways include 019Mobile (Israel) as a recurring entry point, Airtel Jersey as a 4G first-hop proxy, and Tango Networks UK as secondary, with operator footprints across Cambodia, Mozambique, Sweden, Italy, Liechtenstein, Uganda, Israel, UK, Thailand, and Jersey. The unifying finding: carriers still trust their interconnect peers like it’s 1998 and skip TLS/authentication on the signalling plane, which is exactly why the campaigns ran for years.