Iran Exploits Mobile Network Vulnerabilities to Target US Military Personnel

TL;DR

• **Coordinated Tracking Campaign:** The Iranian government hacked mobile networks across the Middle East to track the real-time locations of U.S. military personnel and contractors before and during the recent conflict, according to a Financial Times report citing telecom data and cybersecurity experts.
• **Exploited Network Weaknesses:** Iran utilized known vulnerabilities in mobile signaling protocols, specifically **SS7** (Signaling System 7), and abused commercially available advertising databases and roaming agreements to intercept location data and messages.
• **National Security Implications:** U.S. lawmakers and officials warn that these cyber vulnerabilities, including reliance on smartphone advertising technology and roaming systems, have left the military vulnerable to kinetic attacks and pose a significant risk to national security.

Iran Exploits Mobile Network Vulnerabilities to Target US Military Personnel

US military personnel and contractors operating in the Middle East were the targets of a sophisticated, coordinated phone-tracking campaign orchestrated by the Iranian government prior to and throughout the recent war with Iran. The Financial Times reported on Tuesday that this campaign leveraged hacked mobile networks across the region to pinpoint the locations of American forces, drawing on telecommunications data from the Mobile Surveillance Monitor research project and testimony from cybersecurity experts.

The operation was not merely a case of opportunistic surveillance but a deliberate effort to exploit the interconnected nature of global telecommunications. Officials in Gulf nations suspected Iran or its allies of exploiting roaming agreements with local phone providers to locate US personnel, while a US official confirmed that actors linked to Iran had abused commercially available advertising databases to track phones in northern Iraq’s semiautonomous Kurdish region.

The Technical Mechanism: SS7 and Roaming Agreements

The backbone of Iran’s tracking capability relies on the exploitation of **SS7 (Signaling System 7)**, a legacy protocol that governs how mobile networks communicate. The Electronic Frontier Foundation has long warned that SS7 was not built with security protocols like authentication or encryption, making it vulnerable to interception by governments and cyber mercenaries.

Iran’s largest mobile operator, **MTN Irancell**, plays a central role in this architecture. The operator maintains roaming agreements, submarine cable links, and SS7 signaling connections with every major Gulf telecommunications carrier that hosts a US military base. Because these connections are legitimate and necessary for global connectivity, they provide the Islamic Revolutionary Guard Corps (IRGC) with access to the signaling networks serving US military installations in the region.

SS7 vulnerabilities allow attackers to not only track location data in real-time but also intercept SMS messages and, in some configurations, voice calls. Gary Miller, a senior research fellow at the cybersecurity watchdog Citizen Lab, stated after reviewing the data that Iran possesses the capability to obtain "real-time, immediate and continuous location information," and it would be surprising if they were not using SS7 or mobile network access in the region to track US users.

The Corporate Link: From Telecom to Missile Guidance

A critical and alarming dimension of this cyber-enabled kinetic targeting is the corporate structure behind Iran’s mobile network. The majority owner of MTN Irancell is **Iran Electronics Industries (IEI)**, a company that manufactures the missile guidance systems used to strike US bases on February 28, 2026.

This creates a direct architecture where the telecommunications infrastructure serves as a standing signals intelligence platform for the IRGC. The legitimate interconnect relationships between MTN Irancell and Gulf carriers provide the military with the precise data needed to guide kinetic weapons, effectively turning the mobile network into a targeting system.

US Lawmakers Alarmed by Advertising and Roaming Vulnerabilities

The revelation of these tracking capabilities has sparked alarm among US lawmakers, who are now warning that the military’s reliance on modern consumer technology has created new security gaps. The primary vulnerabilities identified include **roaming systems** and **smartphone advertising technology**, which have left personnel exposed to location tracking.

A US official speaking anonymously to the Financial Times noted that actors linked to Iran had abused commercially available advertising databases to track phones in the Kurdish region of northern Iraq. These databases, often used by advertisers to target users based on location, can be repurposed by state actors to monitor the movements of military personnel without them needing to be on a specific Iranian network, as the data is aggregated across multiple providers.

Implications for National Security and Future Defense

The implications of this cyber campaign extend far beyond the recent conflict, highlighting a systemic risk to national security. The ability of a state actor to acquire continuous location data on military personnel undermines the fundamental principle of operational security and increases the risk of targeted kinetic attacks.

Defenders are now urged to anticipate noisy activity, such as DDoS attacks and defacements, which Iranian APT groups like **Seedworm** (also known as MuddyWater) may use to amplify psychological and economic pressure alongside their tracking operations. With the escalation between the US and Iran, critical infrastructure sectors including energy, transportation, and defense contractors remain at high risk.

To mitigate these threats, cybersecurity experts and agencies like CISA recommend rapidly mitigating external vulnerabilities in network edge devices, avoiding the direct connection of control systems to the public internet, and implementing phishing-resistant multi-factor authentication (MFA) for accessing sensitive networks. The incident serves as a stark reminder that in the modern era, the security of mobile networks is not just a telecommunications issue but a frontline component of national defense.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.