Iran Linked to Sophisticated Tracking Campaign Against US Military Personnel via Telecom Networks

DNI SUMMARY — KEY POINTS

• US military personnel and contractors stationed across the Middle East were targeted by a coordinated digital surveillance campaign during recent regional escalations.
• Investigators discovered that actors linked to Iran exploited aging SS7 signaling protocols to obtain real-time location data of mobile devices roaming within the Gulf region.
• Reports indicate that mobile roaming agreements and ad-tech databases were utilized to pinpoint specific devices located in proximity to sensitive military installations and air bases.
• Cybersecurity experts have highlighted the severe vulnerabilities of global telecommunications infrastructure that remain susceptible to exploitation by state-aligned intelligence units for kinetic targeting purposes.
• While the US military has implemented protective measures for its forces, the incident has renewed urgent debates regarding national security and the commercial exploitation of location data.

A sophisticated and coordinated digital surveillance campaign allegedly targeted US military personnel and contractors throughout the Middle East during the period surrounding recent regional missile strikes. Cybersecurity experts and officials familiar with the matter have revealed that the Islamic Revolutionary Guard Corps or its affiliates systematically exploited global telecommunications infrastructure to track the movements of foreign forces. By leveraging deep interconnections within mobile networks, these actors were reportedly able to monitor device locations in near real-time, raising significant concerns about the susceptibility of standard mobile roaming agreements to state-sponsored intelligence operations.

Legacy Protocols Facilitating Digital Espionage

The primary mechanism behind this tracking operation involves the exploitation of the SS7 protocol, a legacy signaling standard developed in the 1970s that continues to facilitate global roaming and call routing. Despite its age, the protocol lacks robust authentication, allowing unauthorized entities to send silent queries to foreign networks to determine the location of specific mobile devices. Experts from Citizen Lab and other security organizations noted that the ability to ping devices through these interconnections provides a precise and continuous stream of data that can be weaponized to monitor high-value targets across international borders.

Beyond the reliance on traditional signaling protocols, investigations suggest that Iranian-linked actors also harvested data from commercial advertising databases to supplement their intelligence gathering. This method, often described as part of the broader ad-tech landscape, allows users to purchase location history or device identifiers that are broadcasted by mobile applications. By correlating these advertising data points with known geographical coordinates of military bases and hotels, attackers could effectively identify the presence and movement patterns of US personnel, creating an additional layer of visibility beyond standard cellular signaling vulnerabilities.

Commercial Ad Tech As Intelligence Tool

The institutional involvement of telecommunications operators has come under intense scrutiny, particularly regarding the role of MTN Irancell in facilitating these connections. As one of the largest digital companies in the region, the provider maintains roaming agreements and submarine cable links with major Gulf telecommunications carriers that serve US military bases. Security analysts argue that this standing signals intelligence platform allows the IRGC to access critical signaling networks that provide visibility into the operational status of military installations, thereby bridging the gap between digital surveillance and physical kinetic targeting.

Strategic assessments following the late February strikes on facilities such as Al Udeid Air Base indicate that the precision of these attacks demanded high-quality targeting intelligence. Satellite imagery has documented significant damage to communication terminals, radar systems, and air-defense infrastructure, suggesting that the collected location data may have played a role in refining the accuracy of missile and drone strikes. While US officials have maintained that there is no definitive evidence showing that data tracking was the primary factor in the success of the attacks, the operational risk remains substantial.

Telecom Infrastructure Under Serious Scrutiny

The security of the US Central Command and its deployed forces has necessitated rapid force-protection adjustments in response to these emerging digital threats. Commanders have been alerted to the reality that common consumer devices, when used in overseas roaming environments, can function as inadvertent beacons for adversarial intelligence networks. This challenge is compounded by the fact that mobile networks are inherently designed for open connectivity, a feature that state actors now exploit to bypass traditional perimeter defenses and gain localized awareness of sensitive military personnel movements.

International security discourse is now shifting toward the systemic risks posed by outdated telecommunications architectures that underpin the modern global economy. The reliance on Signaling System 7 has long been identified as a vulnerability, yet the difficulty of updating global network standards has allowed the issue to persist for decades. Policymakers are being urged to reconsider the security implications of interconnect agreements, especially those involving state-aligned entities in nations that host foreign military assets, to prevent further exploitation of commercial infrastructure for hostile state objectives.

New Paradigm Of Modern Warfare

Looking forward, the integration of cyber-enabled kinetic targeting represents a new paradigm in modern warfare that demands immediate countermeasures from both private industry and defense organizations. As commercial technology continues to merge with military operational requirements, the ability to protect metadata and location information will become a critical component of force protection. The recent events serve as a stark warning to military planners that the digital footprint of their personnel is no longer just a privacy issue, but a fundamental matter of operational and national security.