Circles
MITRE ATT&CK: S0602 View on attack.mitre.org
Aliases: Circles
- Malware type
- spyware
- Family
- Malware family
- Profile updated
- 2026-07-07 15:29:11
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
Circles reportedly takes advantage of Signaling System 7 (SS7) weaknesses, the protocol suite used to route phone calls, to both track the location of mobile devices and intercept voice calls and SMS messages. It can be connected to a telecommunications company’s infrastructure or purchased as a cloud service. Circles has reportedly been linked to the NSO Group.
Malware & tools used
- Impersonate SS7 Nodes (attack-pattern)
Reports & references
- MITRE ATT&CK — S0602 (report)
- citizenlab.ca — Running In Circles Uncovering The Clients Of Cyberespionage Firm Circles (report)