[{"data":1,"prerenderedAt":432},["ShallowReactive",2],{"news-doc-ss7-location-tracking-carrier-advisory":3,"content-query-JcrLskH9C2":258},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"category":12,"tags":13,"body":19,"_type":252,"_id":253,"_source":254,"_file":255,"_stem":256,"_extension":257},"\u002Fnews\u002Fss7-location-tracking-carrier-advisory","news",false,"","SS7 Cross-Border Location Tracking Tactics Observed Against Tier-1 Operators","Detailed breakdown of sophisticated MAP ProvideSubscriberInfo and SendRoutingInfo attacks circumventing legacy STP SMS firewalls.","2026-09-10","TelcoSec Threat Research Team","SS7 \u002F SIGTRAN Security",[14,15,16,17,18],"SS7","MAP","Location Tracking","SIGTRAN","Interconnect",{"type":20,"children":21,"toc":245},"root",[22,30,73,80,85,91,105,172,181,187,221,227],{"type":23,"tag":24,"props":25,"children":27},"element","h1",{"id":26},"ss7-cross-border-location-tracking-tactics-observed-against-tier-1-operators",[28],{"type":29,"value":8},"text",{"type":23,"tag":31,"props":32,"children":33},"p",{},[34,40,42,46,51,53,56,61,63,66,71],{"type":23,"tag":35,"props":36,"children":37},"strong",{},[38],{"type":29,"value":39},"Publication Date:",{"type":29,"value":41}," September 10, 2026",{"type":23,"tag":43,"props":44,"children":45},"br",{},[],{"type":23,"tag":35,"props":47,"children":48},{},[49],{"type":29,"value":50},"Author:",{"type":29,"value":52}," TelcoSec Threat Research Team",{"type":23,"tag":43,"props":54,"children":55},{},[],{"type":23,"tag":35,"props":57,"children":58},{},[59],{"type":29,"value":60},"Advisory ID:",{"type":29,"value":62}," TS-ADV-2026-003",{"type":23,"tag":43,"props":64,"children":65},{},[],{"type":23,"tag":35,"props":67,"children":68},{},[69],{"type":29,"value":70},"Target Protocols:",{"type":29,"value":72}," GSM MAP \u002F TCAP \u002F SCCP",{"type":23,"tag":74,"props":75,"children":77},"h2",{"id":76},"overview",[78],{"type":29,"value":79},"Overview",{"type":23,"tag":31,"props":81,"children":82},{},[83],{"type":29,"value":84},"Recent telemetry collected from international telecom signaling research nodes indicates a surge in categorized Category 1 & Category 2 GSMA FS.11 bypass maneuvers. Adversaries utilizing leased Global Title (GT) routes are chaining multiple MAP queries to bypass keyword-based signaling firewalls.",{"type":23,"tag":74,"props":86,"children":88},{"id":87},"attack-sequence-analysis",[89],{"type":29,"value":90},"Attack Sequence Analysis",{"type":23,"tag":31,"props":92,"children":93},{},[94,96,103],{"type":29,"value":95},"Rather than issuing single ",{"type":23,"tag":97,"props":98,"children":100},"code",{"className":99},[],[101],{"type":29,"value":102},"AnyTimeInterrogation",{"type":29,"value":104}," (ATI) messages—which are commonly blocked by modern carrier STPs—attackers are staging queries in a three-phase reconnaissance cycle:",{"type":23,"tag":106,"props":107,"children":108},"ol",{},[109,128,138],{"type":23,"tag":110,"props":111,"children":112},"li",{},[113,118,120,126],{"type":23,"tag":35,"props":114,"children":115},{},[116],{"type":29,"value":117},"Phase 1: IMSI Resolution",{"type":29,"value":119},": Sending ",{"type":23,"tag":97,"props":121,"children":123},{"className":122},[],[124],{"type":29,"value":125},"sendRoutingInfoForSM",{"type":29,"value":127}," (SRI-SM) with randomized SCCP Calling Party Addresses (CgPA) mimicking legitimate roaming SMS centers.",{"type":23,"tag":110,"props":129,"children":130},{},[131,136],{"type":23,"tag":35,"props":132,"children":133},{},[134],{"type":29,"value":135},"Phase 2: Serving MSC\u002FVLR Identification",{"type":29,"value":137},": Harvesting the target's current VLR address from the SRI-SM response.",{"type":23,"tag":110,"props":139,"children":140},{},[141,146,148,154,156,162,164,170],{"type":23,"tag":35,"props":142,"children":143},{},[144],{"type":29,"value":145},"Phase 3: Real-Time Cell ID Extraction",{"type":29,"value":147},": Directly querying the visited MSC using ",{"type":23,"tag":97,"props":149,"children":151},{"className":150},[],[152],{"type":29,"value":153},"provideSubscriberInfo",{"type":29,"value":155}," (PSI) requesting ",{"type":23,"tag":97,"props":157,"children":159},{"className":158},[],[160],{"type":29,"value":161},"locationInformation",{"type":29,"value":163}," and ",{"type":23,"tag":97,"props":165,"children":167},{"className":166},[],[168],{"type":29,"value":169},"ageOfLocationEstimate",{"type":29,"value":171},".",{"type":23,"tag":173,"props":174,"children":176},"pre",{"code":175},"Attacker (GT Leased) ----[ MAP SRI-SM ]----> Carrier HLR\nCarrier HLR        ----[ IMSI + VLR GT ]---> Attacker\nAttacker (GT Leased) ----[ MAP PSI ]-------> Visited MSC\u002FVLR\nVisited MSC\u002FVLR    ----[ CGI (Cell ID) ]---> Attacker (Location Fixed)\n",[177],{"type":23,"tag":97,"props":178,"children":179},{"__ignoreMap":7},[180],{"type":29,"value":175},{"type":23,"tag":74,"props":182,"children":184},{"id":183},"recommended-defense-configuration",[185],{"type":29,"value":186},"Recommended Defense Configuration",{"type":23,"tag":188,"props":189,"children":190},"ul",{},[191,196,201],{"type":23,"tag":110,"props":192,"children":193},{},[194],{"type":29,"value":195},"Implement GSMA FS.11 Cat 1\u002F2\u002F3 multi-layer filtering at all international STP \u002F ITP edge gateways.",{"type":23,"tag":110,"props":197,"children":198},{},[199],{"type":29,"value":200},"Enforce strict MAP screening for PSI messages arriving from international interconnect links (PSI should never originate outside the subscriber's home network).",{"type":23,"tag":110,"props":202,"children":203},{},[204,206,212,213,219],{"type":29,"value":205},"Utilize TelcoChisel's ",{"type":23,"tag":97,"props":207,"children":209},{"className":208},[],[210],{"type":29,"value":211},"sigploit",{"type":29,"value":163},{"type":23,"tag":97,"props":214,"children":216},{"className":215},[],[217],{"type":29,"value":218},"sctpscan",{"type":29,"value":220}," to continuously validate interconnect firewall policy rules.",{"type":23,"tag":74,"props":222,"children":224},{"id":223},"educational-lab-access",[225],{"type":29,"value":226},"Educational Lab Access",{"type":23,"tag":31,"props":228,"children":229},{},[230,232,244],{"type":29,"value":231},"Full packet traces and emulation scripts are available inside the ",{"type":23,"tag":35,"props":233,"children":234},{},[235],{"type":23,"tag":236,"props":237,"children":241},"a",{"href":238,"rel":239},"https:\u002F\u002Fapp.telcosec.net",[240],"nofollow",[242],{"type":29,"value":243},"TelcoSec Academy Signaling Security Module",{"type":29,"value":171},{"title":7,"searchDepth":246,"depth":246,"links":247},2,[248,249,250,251],{"id":76,"depth":246,"text":79},{"id":87,"depth":246,"text":90},{"id":183,"depth":246,"text":186},{"id":223,"depth":246,"text":226},"markdown","content:news:ss7-location-tracking-carrier-advisory.md","content","news\u002Fss7-location-tracking-carrier-advisory.md","news\u002Fss7-location-tracking-carrier-advisory","md",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"category":12,"tags":259,"body":260,"_type":252,"_id":253,"_source":254,"_file":255,"_stem":256,"_extension":257},[14,15,16,17,18],{"type":20,"children":261,"toc":426},[262,266,298,302,306,310,320,371,378,382,409,413],{"type":23,"tag":24,"props":263,"children":264},{"id":26},[265],{"type":29,"value":8},{"type":23,"tag":31,"props":267,"children":268},{},[269,273,274,277,281,282,285,289,290,293,297],{"type":23,"tag":35,"props":270,"children":271},{},[272],{"type":29,"value":39},{"type":29,"value":41},{"type":23,"tag":43,"props":275,"children":276},{},[],{"type":23,"tag":35,"props":278,"children":279},{},[280],{"type":29,"value":50},{"type":29,"value":52},{"type":23,"tag":43,"props":283,"children":284},{},[],{"type":23,"tag":35,"props":286,"children":287},{},[288],{"type":29,"value":60},{"type":29,"value":62},{"type":23,"tag":43,"props":291,"children":292},{},[],{"type":23,"tag":35,"props":294,"children":295},{},[296],{"type":29,"value":70},{"type":29,"value":72},{"type":23,"tag":74,"props":299,"children":300},{"id":76},[301],{"type":29,"value":79},{"type":23,"tag":31,"props":303,"children":304},{},[305],{"type":29,"value":84},{"type":23,"tag":74,"props":307,"children":308},{"id":87},[309],{"type":29,"value":90},{"type":23,"tag":31,"props":311,"children":312},{},[313,314,319],{"type":29,"value":95},{"type":23,"tag":97,"props":315,"children":317},{"className":316},[],[318],{"type":29,"value":102},{"type":29,"value":104},{"type":23,"tag":106,"props":321,"children":322},{},[323,337,345],{"type":23,"tag":110,"props":324,"children":325},{},[326,330,331,336],{"type":23,"tag":35,"props":327,"children":328},{},[329],{"type":29,"value":117},{"type":29,"value":119},{"type":23,"tag":97,"props":332,"children":334},{"className":333},[],[335],{"type":29,"value":125},{"type":29,"value":127},{"type":23,"tag":110,"props":338,"children":339},{},[340,344],{"type":23,"tag":35,"props":341,"children":342},{},[343],{"type":29,"value":135},{"type":29,"value":137},{"type":23,"tag":110,"props":346,"children":347},{},[348,352,353,358,359,364,365,370],{"type":23,"tag":35,"props":349,"children":350},{},[351],{"type":29,"value":145},{"type":29,"value":147},{"type":23,"tag":97,"props":354,"children":356},{"className":355},[],[357],{"type":29,"value":153},{"type":29,"value":155},{"type":23,"tag":97,"props":360,"children":362},{"className":361},[],[363],{"type":29,"value":161},{"type":29,"value":163},{"type":23,"tag":97,"props":366,"children":368},{"className":367},[],[369],{"type":29,"value":169},{"type":29,"value":171},{"type":23,"tag":173,"props":372,"children":373},{"code":175},[374],{"type":23,"tag":97,"props":375,"children":376},{"__ignoreMap":7},[377],{"type":29,"value":175},{"type":23,"tag":74,"props":379,"children":380},{"id":183},[381],{"type":29,"value":186},{"type":23,"tag":188,"props":383,"children":384},{},[385,389,393],{"type":23,"tag":110,"props":386,"children":387},{},[388],{"type":29,"value":195},{"type":23,"tag":110,"props":390,"children":391},{},[392],{"type":29,"value":200},{"type":23,"tag":110,"props":394,"children":395},{},[396,397,402,403,408],{"type":29,"value":205},{"type":23,"tag":97,"props":398,"children":400},{"className":399},[],[401],{"type":29,"value":211},{"type":29,"value":163},{"type":23,"tag":97,"props":404,"children":406},{"className":405},[],[407],{"type":29,"value":218},{"type":29,"value":220},{"type":23,"tag":74,"props":410,"children":411},{"id":223},[412],{"type":29,"value":226},{"type":23,"tag":31,"props":414,"children":415},{},[416,417,425],{"type":29,"value":231},{"type":23,"tag":35,"props":418,"children":419},{},[420],{"type":23,"tag":236,"props":421,"children":423},{"href":238,"rel":422},[240],[424],{"type":29,"value":243},{"type":29,"value":171},{"title":7,"searchDepth":246,"depth":246,"links":427},[428,429,430,431],{"id":76,"depth":246,"text":79},{"id":87,"depth":246,"text":90},{"id":183,"depth":246,"text":186},{"id":223,"depth":246,"text":226},1790363495945]