SS7 Protocol Fraud Detection for Telecom SOC Teams
How DKTrace's telco-monitor detects SIM swap fraud, location tracking, and call interception by analysing MAP messages for anomalous operation sequences — with no lawful intercept required.
DKTrace Research Team
Security Engineering · Threat Research
What Is SS7?
SS7 (Signalling System 7) is the protocol stack that enables phone calls and SMS between carriers worldwide. Despite being 40+ years old, it remains the backbone of global telephony — designed before cybersecurity existed as a discipline.
DKTrace's telco-monitor (port 8117) parses live SS7 MAP messages via SIGTRAN M3UA/SCTP. No lawful intercept required — only the SS7 signalling plane is monitored.
Attack Pattern 1: SIM Swap (UpdateLocation)
An attacker with SS7 access sends an UpdateLocation message to the target's HLR, claiming the subscriber's IMSI is now registered on their rogue MSC. Incoming calls and SMS (including 2FA codes) are redirected.
DKTrace Detection:
Attack Pattern 2: Location Tracking (SendRoutingInfo)
Attackers query HLR/VLR for subscriber location without the subscriber's knowledge. Used for physical surveillance, journalism targeting, and corporate espionage.
DKTrace Detection:
Attack Pattern 3: Call Interception (RegisterSS)
Unconditional Call Forwarding set via SS7 without the subscriber initiating it. All calls silently forwarded to attacker-controlled number.
DKTrace Detection:
Deployment for Telco SOC Teams
DKTrace telco-monitor connects to your STP (Signal Transfer Point) or HLR probe via:
No changes to your signalling network required. Passive monitoring only.
See It Live
Watch DKTrace detect this threat in your environment
Our engineers will run a live detection simulation against a sample of your log telemetry — no agents, no commitment.
Request a Live Demo