SS7 abuse caught in the wild: spy vendors tracked a VVIP across 11 operators
Citizen Lab fingerprints two commercial surveillance vendors abusing SS7 and Diameter signalling to silently track phones across operator networks. One campaign chased a single VVIP executive's device across 11 operator identities in nine countries, riding genuine carrier interconnect paths to hide. Worse, a malicious SMS smuggled hidden SIM commands to turn the target's phone into a covert location beacon. Operator identifier reuse spanning years shows the abuse is persistent, not a one-off smoke test.