Iranian cyberattacks exploited vulnerabilities in outdated network technology to locate the phones of U.S. personnel in the Middle East, data released on Tuesday suggested.
The Mobile Surveillance Monitor, a research initiative that studies mobile espionage, detected a wave of signals across multiple networks in the Middle East at the outset of the United States and Israel’s war against Iran in February. Gary Miller, a cybersecurity researcher who founded the nonprofit that runs the research initiative, said the data was indicative of a “coordinated attack campaign.”
Tens of thousands of U.S. military personnel are stationed in the Middle East, including in Gulf nations like Bahrain, one of the countries where Mr. Miller said telecommunications networks were flooded with information requests.
Experts who reviewed the information, reported earlier by The Financial Times, said it appeared that Iran had used cellphone signals to track U.S. military personnel and contractors in the Middle East.
Iran’s dispersed network of hackers has long used cyberattacks to project power across the Middle East and to challenge — or at least annoy — the United States. But analysts say the latest reports of Iran tracking U.S. personnel across the region illustrate how dangerous its cyberwarfare capabilities have become.
The data showed a wave of signals sent through SS7 protocols, a low-security telecommunications technology developed in the 1970s, seeking location information about devices across the region. Mr. Miller said the signals seemed to target phones connected to local networks, which U.S. military members sometimes use.
Nikita Shah, a cybersecurity researcher at the Center for Strategic and International Studies, said Iran’s use of phone network signals to locate targets indicated that its cyberwarfare capabilities had become more advanced — and potentially dangerous for U.S. personnel stationed within striking distance of Iranian missiles.
“Iran has become quite creative in the last couple of years, and especially in this conflict,” Ms. Shah said. “For me, this signals a step up in sophistication.”
Cyberattackers from Iran, Russia, China and other countries have long exploited vulnerabilities in the SS7 telecommunications system to spy on targets, Ms. Shah said.
Last year, researchers at Enea, a cybersecurity company based in Sweden, discovered that a surveillance company in the Middle East had exploited similar vulnerabilities to locate specific mobile phone users.
U.S. lawmakers and government agencies recently warned that Iran could use American service members’ cellphone data to target them with strikes.
Senator Ron Wyden, Democrat of Oregon, and Representative Pat Harrigan, Republican of North Carolina, sent a letter signed by a dozen other members of Congress to the Defense Department in May, expressing concern that the department had not adequately protected U.S. military personnel from cybersecurity threats in the Iran war. In April, the letter said, U.S. Central Command said it had “received multiple threat reports” about adversaries using commercially available location data to target U.S. personnel.
Asked about data suggesting Iran tracked U.S. personnel using SS7 vulnerabilities, a spokesman for U.S. Central Command said on Tuesday that he was “not tracking such reports,” and declined to answer questions about how the military was defending against Iran’s phone-tracking capabilities.
While typically less advanced than campaigns linked to Russia or China, Iranian cyberattacks have remained a persistent challenge to U.S. personnel in the region and closer to home. In February, a group affiliated with Iranian intelligence took responsibility for the release of emails and photographs stolen from a personal account of Kash Patel, the F.B.I. director.
And in April, the U.S. Cybersecurity and Infrastructure Security Agency warned of Iran-based cyberattacks on government services and water and energy systems that had led to “operational disruption and financial loss.”
Iran has also used phone location data to track and intimidate its own citizens. After security forces led a lethal crackdown on widespread protests in Iran that began in December, the authorities sent ominous messages to people accused of taking part in the demonstrations.