Cyberpediaby Brain
ENDEFR

IMSI catcher: the fake cell tower

A rogue mobile base station can sit between your phone and the network. What the sources say about this risk, and what you can do.

In 30 seconds

Where it happens
Within range of a rogue base station, a device able to capture a phone's traffic after it leaves the device1.
What the attacker wants
To sit between the phone and its destination to capture the traffic, or to track its position13.
The reflex
Prefer applications that encrypt their traffic, which can rule out some forms of interception, and keep the system up to date, which makes it harder to register an application as a VPN provider1. These two measures do not protect against a rogue base station with certainty.
If you are highly targeted
CISA urges "highly targeted" individuals to apply the best practices in its guide without delay6.

What it is

This article covers the rogue mobile base station, often called an IMSI catcher. The sources in the file do not use that term. MITRE ATT&CK places in the "Adversary-in-the-Middle" family an attacker who positions themselves between two networked devices, and lists among the means outside the phone a "rogue base station", that is, a pirate base station, or a rogue Wi-Fi access point1.

For an employee, the risk is this: traffic is captured after it has left the phone, on its way to its destination1. This article sticks to what the sources in the file establish. They describe the general principle and the protections, not the detail of each equipment variant.

Straight answers

What is an IMSI catcher?

The sources in the file do not use this word. They speak of a "rogue base station", a pirate base station1. MITRE describes the corresponding family of attacks: an adversary positions themselves between networked devices to manipulate transmitted data or disrupt a device1. The sources in the file do not define the IMSI, but they show that it interests spyware: the MITRE page on network configuration discovery mentions telephony identifiers such as the IMSI, the IMEI and the phone number2.

Does my phone connect to just any tower?

The sources in the file do not describe the procedure by which a phone connects to a tower. They therefore detail neither the forced downgrade to 2G nor the authentication between the phone and the network. The NIST SP 800-187 guide covers the security of the LTE (4G) network and the analysis of the threats that target it4. The text of the page does not allow saying more here.

Can a rogue base station read my messages?

It depends on whether applications encrypt their network traffic. MITRE writes that, if applications properly encrypt their traffic, sensitive data may remain inaccessible to the adversary, depending on where the capture takes place1. The page cites two mechanisms: Application Transport Security at Apple and Network Security Configuration on Android1.

Can I be located with this kind of tool?

Location is one of an attacker's goals on mobile. MITRE mainly describes tracking by malicious applications that obtain location permissions3. One sub-technique on this page is named "Impersonate SS7 Nodes": the attacker imitates nodes of the SS7 signalling network. The page does not detail it in the text retrieved3.

1Inside the attacker's head1 min

The attacker looks for an intermediary position. According to MITRE, this position serves for later actions, such as manipulating transmitted data or denial of service on a device1. A rogue mobile base station reaches it outside the phone, according to MITRE's description1.

The SIM card identifier has value for the attacker. Mobile malware (FakeSpy, SpyDealer, XLoader for Android) and the APT-C-23 group are among the examples MITRE lists for collecting these identifiers2. These cases involve applications installed on the phone, not a rogue base station.

Position also interests the attacker. MITRE cites the case of FrozenCell, which used an online cell-tower geolocation service to track its targets3. Here again, the page describes the use of an online service, not a rogue base station.

2What you see on screen1 min

The sources in the file do not describe any visible sign specific to a rogue base station. They mention neither a network switch to 2G, nor a draining battery, nor lost calls or SMS. None of these symptoms can therefore be presented as an established indicator.

A point of caution does exist on the calls side, with no established link to a rogue base station. For Android applications, MITRE describes an adversary who can place, forward or block calls without the user's consent, for example to eavesdrop or to divert the owner's calls5.

3Under the hoodIT teams1 min

MITRE's text on traffic capture distinguishes two situations. In the first, a malicious application declares itself a VPN client to redirect the device's traffic to adversary resources. This requires user consent on Android and on iOS, and a special authorisation from Apple on iOS1. In the second, the adversary acts outside the phone, with a rogue base station or Wi-Fi access point, and captures the traffic along the way1. On a local network, other methods exist, such as ARP cache poisoning or DHCP spoofing1.

On the identifiers side, Android has tightened access. Since Android 10, only preinstalled applications, carrier applications, the default SMS application and device-owner or profile-owner applications can read telephony identifiers, including the IMSI2. On iOS, collecting network configuration information is not possible without root access2.

The protections MITRE lists against interception are of two types: encrypting network traffic, and using a recent version of the system, because recent versions make it harder to register an application as a VPN provider1.

4Case filesReal cases1 min

The sources in the file report no dated, attributed IMSI catcher incident. Two dated documents serve as reference points.

December 2017: the NIST guide on LTE security

NIST published the final version of SP 800-187, "Guide to LTE Security", in December 20174. The document presents how LTE networks work and their security architecture. It then analyses the threats and the countermeasures4. The page does not say that this guide deals with rogue base stations.

March 2026: the CISA guide on mobile communications

CISA revised its best practice guidance for mobile communications on 13 March 20266. It responds to espionage activities carried out by state-linked actors, in particular actors linked to the Chinese government who target commercial telecommunications infrastructure6. It is aimed at "highly targeted" individuals, such as senior government, military or political officials6. CISA urges these individuals to apply the guide's best practices without delay6. The page does not mention rogue base stations.

5The actions that count1 min

The sources in the file support three actions. The first: update the system, because recent versions make it harder to register an application as a VPN provider1 and restrict access to telephony identifiers on Android2. The second: prefer applications that encrypt their traffic, which can rule out some forms of interception1. The third: if your job exposes you, read and apply the CISA guide6. Disabling 2G is not advice that the sources in the file allow us to give.

Fact sheet

Identifier
CP-083
Wing
1. Attacks and techniques
Brain skill
Securing Devices & Mobile (secure_devices)
Brain reflex
cr-050
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. MITRE ATT&CK, “Adversary-in-the-Middle, Technique T1638 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1638/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “System Network Configuration Discovery, Technique T1422 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1422/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Location Tracking, Technique T1430 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1430/ (accessed 3 November 2026)
  4. NIST, “SP 800-187, Guide to LTE Security | CSRC”, 21 December 2017. https://csrc.nist.gov/pubs/sp/800/187/final (accessed 3 November 2026)
  5. MITRE ATT&CK, “Call Control, Technique T1616 - Mobile | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1616/ (accessed 3 November 2026)
  6. CISA, “Mobile Communications Best Practice Guidance | CISA”. https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance (accessed 3 November 2026)

Cite this article

Brain, “IMSI catcher: the fake cell tower”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/imsi-catcher-fake-cell-tower/

BibTeX 
@misc{brain_cp083_en_2026,
  author = {Brain},
  title = {IMSI catcher: the fake cell tower},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/imsi-catcher-fake-cell-tower/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence