Rayzone Group is an Israeli surveillance vendor headquartered in Herzliya, founded in 2014, that markets a portfolio of geolocation, signals intelligence, and intercept products to government customers. The company’s Piranha product is an IMSI catcher and tactical signals intelligence platform; its ECHO product is a passive geolocation platform that uses the SS7 telecommunications signalling system to locate mobile devices globally without target cooperation. Rayzone’s customer base, partially disclosed through investigative reporting, includes governments in Africa, Asia, and Latin America.
What it means in practice
Piranha intercepts mobile communications at the cell tower level, identifying which devices are in range, capturing identifying information from those devices, and in some configurations intercepting voice and text traffic. ECHO operates differently: it uses the international telecommunications signalling system, which mobile operators use to roam customers across networks, to query the location of any mobile number globally. The ECHO query returns a location result within seconds, without alerting the target’s device or carrier.
Specific things to know
Rayzone’s SS7-based geolocation capability is part of a small market segment shared with vendors including Circles (an NSO Group affiliate), 1stWAP, and a handful of other Israeli and European companies. The 2020 Citizen Lab report on Circles documented similar SS7 abuse, and the broader telecommunications industry has been working to close the access vector through firewalls and operator-level filtering. Some carriers have implemented these mitigations; many have not. Rayzone has not been subject to public US export restrictions of the kind imposed on NSO Group.
Change today
If your phone number is known to a potentially adversarial party, you should assume that SS7-class geolocation is available against you regardless of device-level hardening. The operational defence is to compartmentalise: a sensitive operational phone number should not be the same number that is shared with potential adversaries. For high-risk individuals, this means using a separate eSIM or operational SIM for sensitive communications, and treating the public-facing phone number as a target surface rather than a private contact channel.
Related articles
See our coverage of SS7-based mobile geolocation, the Citizen Lab Circles investigation, and the operational defences against carrier-level signalling abuse.