The Silent Threat: How Hackers Are Outsmarting Mobile Networks with New SS7 Bypass Attacks

Mobile networks rely on complex signaling protocols like SS7 (Signaling System No. 7) to route calls, messages, and data. But what happens when attackers discover hidden weaknesses in these systems? Cybersecurity researchers have just uncovered a new, highly sophisticated method to bypass mobile network security by exploiting vulnerabilities in the TCAP (Transaction Capabilities Application Part) encoding. This revelation shows how cybercriminals continue to evolve, using intricate technical loopholes to access sensitive subscriber data undetected.

Unveiling the New SS7 Bypass Technique

Since 2017, the SS7 protocol has been a favorite target for hackers aiming to evade security measures implemented by mobile operators worldwide. The latest breakthrough attack focuses on the TCAP layer, a critical part of SS7 responsible for carrying application data between network nodes. Researchers from Enea’s Threat Intelligence Unit discovered that attackers manipulate how Information Elements (IEs), especially the IMSI (International Mobile Subscriber Identity), are encoded within TCAP messages.

The exploit leverages the flexibility of ASN.1 BER encoding, which allows the same data to be encoded in multiple ways, unlike the stricter DER encoding. By using an extended tag technique defined in the ITU Q.773 standard, attackers hide the IMSI field behind a multi-octet tag that many older or less sophisticated SS7 security stacks fail to decode. This “invisible” IMSI means that surveillance firms or malicious actors can send unauthorized requests and still bypass security checks designed to block such behavior.

This attack technique is not just theoretical. It has been actively used since late 2024 to track mobile users’ locations, circumventing defenses that mobile operators have painstakingly set up. The finding has been reported to industry groups like GSMA, urging network providers to tighten their detection systems and block malformed message structures.

The Growing Threat of SS7 Exploits in Mobile Security

Mobile networks are under constant threat as attackers invent new ways to exploit protocol weaknesses. SS7, a signaling protocol designed decades ago, was never built with modern cybersecurity challenges in mind. Its layered architecture, particularly the TCAP segment, has proven a rich ground for attackers to innovate. Early bypass methods such as Global Opcode manipulation or Extended Application Context exploits paved the way for the current wave of complex encoding attacks.

The TCAP

What Undercode Say:

The newly exposed SS7 bypass method serves as a stark reminder that mobile network security is a constantly shifting battlefield. Attackers exploit the very standards and protocols designed for flexibility and backward compatibility to slip past defenses. The TCAP encoding flaw exemplifies how technical complexity can mask serious vulnerabilities that legacy systems fail to address.

For mobile operators, this means a fundamental re-evaluation of SS7 security is overdue. Many existing security stacks are based on outdated assumptions, failing to decode or flag extended tag encodings because such codes were rarely used in legitimate traffic. This blind spot enables attackers to operate under the radar, extracting sensitive subscriber information like location data without triggering alarms.

Addressing this requires not only patching software to recognize and block malformed PDUs but also rethinking how telecom security frameworks interpret signaling data. Operators must embrace dynamic, behavior-based detection methods that go beyond static pattern recognition. In addition, continuous intelligence sharing within the GSMA and among global telecom providers is critical to stay ahead of these fast-evolving attack vectors.

This new attack also underscores the broader challenge of securing legacy protocols within modern telecom infrastructure. The complexity of SS7, combined with its wide deployment, makes complete overhauls difficult. However, network providers must prioritize incremental improvements that close known loopholes while planning for longer-term migration to safer protocols such as Diameter or 5G’s more secure alternatives.

Finally, this incident highlights the importance of transparency and collaboration. The swift communication of the vulnerability to operators and security communities is essential to reduce the window of opportunity for attackers. As surveillance companies and threat actors adopt increasingly subtle methods, mobile networks must adapt equally sophisticated defensive strategies.

🔍 Fact Checker Results

✅ The vulnerability in TCAP encoding affecting SS7 protocol is accurately reported.
✅ The attack technique has been actively used since Q4 2024 for location tracking.
❌ No evidence suggests that this method compromises call content or SMS messages directly.

📊 Prediction

With attackers continuously exploiting signaling protocol weaknesses like TCAP encoding, mobile operators will accelerate security upgrades focused on protocol-level defenses. We anticipate increased adoption of AI-driven anomaly detection systems that analyze signaling patterns in real-time. Industry-wide collaboration through organizations like GSMA will become the cornerstone of rapid vulnerability response. However, until legacy systems are fully replaced, these SS7 bypass methods will persist as a significant risk, especially for location privacy of mobile subscribers.