According to a report by the Financial Times, at the beginning and during the 40-day war, Iranian cyber attackers attempted to locate devices belonging to US forces in the Middle East for targeting.

The report states that at the beginning of the conflict, regional telecommunications networks were hit with a wave of requests known as “SS7 pings”. By using these pings, an attacker can determine the location of a device that is roaming outside of its home network – a sign of a coordinated campaign – with Iran or its allies exploiting roaming agreements with local telecommunication providers to locate US forces in the region which were subsequently added to Iran’s target list.

In addition, it’s been reported that Iran also took advantage of commerical advertising databases and digital advertising IDs to track phones and devices in Iraqi Kurdistan. It is worth noting that an attacker can still determine the location of a victim’s device by exploiting digital advertising technology and advertising IDs even if they don’t have direct access. In recent years, this method of espionage has become more common and shows how the boundaries between the physical and cyber battlefield are increasingly intertwined.