Rayhunter: Detecting Cell-Site Simulators Across Europe
Discover Rayhunter, EFF's innovative tool for detection of IMSI catchers and malicious cell sites throughout the EU. Protect your privacy.
Rayhunteris an innovative open-source tool designed by the Electronic Frontier Foundation (EFF) to uncover and combat the use of cell-site simulators (CSS), commonly known as IMSI catchers or Stingrays. These covert surveillance devices are frequently used by law enforcement and other entities to track mobile phones without user knowledge. Rayhunteroffers an accessible and affordable way todetectsuspicious cellular activity, making it an essential resource for journalists, activists, and privacy-conscious citizens in Europe and beyond.
How Rayhunter Works
Rayhunter operates by continuously monitoring cellular network interactions for signs of interference. Specifically, the tool runs on an affordable Orbic mobile hotspot, available for less than £20, turning it into a portable surveillance detection unit. It tracks irregular behaviours from mobile base stations, such as attempts to downgrade a phone’s connection to vulnerable 2G networks or suspicious IMSI requests, both common indicators of IMSI catcher usage.
Simplicity and Accessibility
Rayhunter’s installation process is straightforward, requiring minimal technical expertise. Users simply download the latest software release, unzip the files, connect the Orbic hotspot to their computer, and execute a straightforward installation script compatible with Mac and Linux. Once operational, Rayhunter provides clear, immediate visual feedback via a simple user interface: a green (or blue for colourblind mode) indicator for normal operation and a red indicator for detected threats.
How Rayhunter Addresses EU Surveillance Concerns
While initially developed with a strong focus on surveillance within the United States, Rayhunter’s ease of use and affordability makes it particularly suited for deployment across Europe, where surveillance practices can often be less transparent. In countries lacking robust free speech protections, understanding the use and prevalence of CSS becomes even more crucial. Activists, journalists, and privacy advocates in the UK and across Europe can significantly benefit from using Rayhunter, identifying and mapping CSS usage to enhance digital privacy and civil liberties.
Technical Depth: What Rayhunter Detects
Rayhunter specifically monitors for:
- Connection Downgrade Attempts: Detecting unusual base station requests to revert connections to the insecure 2G network.
- Suspicious IMSI Requests: Identifying abnormal requests from base stations attempting to harvest unique identifiers without legitimate cause.
The data collected can be anonymously shared with the broader security community, enabling researchers to better understand, document, and develop defences against CSS threats.
Use Case: Activism and Journalism
Rayhunter’s simplicity and accessibility make it an invaluable tool for activists, journalists, and researchers. Its discreet operation allows users to detect surveillance without raising suspicion, offering real-time alerts that enable swift responses to potential threats. Additionally, the logs generated by Rayhunter can contribute significantly to research on the global prevalence and technical capabilities of IMSI catchers.
Joining the Surveillance Resistance
Rayhunter presents a compelling opportunity for communities across the UK and Europe to reclaim control over personal privacy and resist covert surveillance. By adopting Rayhunter, individuals and organisations can not only protect themselves from unlawful monitoring but also actively contribute to global awareness and improved cybersecurity measures.
Take Action
Interested in defending your digital privacy and supporting surveillance research?
- Get Rayhunter: Purchase an affordable Orbic hotspot, download Rayhunter, and begin detecting IMSI catchers today.
- Contact Cyber Defence: For professional advice on surveillance countermeasures or to explore managed security solutions, contact Cyber Defence today.
- Stay Informed: Explore related articles on Street-Level Surveillance and Digital Privacy Measures
- .
Together, we can uncover surveillance and protect our digital rights.
Further reading
Written by
Founder and Head of Threat Disruption
Founder of UK Cyber Defence. Former Global CISO for a FTSE 100 gaming company and for Microsoft Europe; founded Hedgehog Security in 2009.
Next step
Want this looked at in your own estate?
Thirty minutes with an analyst, not a salesperson. We will tell you whether it matters to you and what to do first.
Related insights
Britain's exposed controllers: a UK exposure report after the French fridge attack
After Sunday's cyberattack on French supermarket refrigeration, we turned the same question on the UK. Over 800 internet-exposed refrigeration and building-management controllers answer directly to the open internet here, across Danfoss, Carel, Copeland and other vendors, and that figure is a floor rather than a ceiling. Here is what we found, why France was hit and not Britain, and what to do this week.
Cyberattack defrosts the fridges at hundreds of French supermarkets
Overnight on 11–12 October 2026, attackers reached into the refrigeration controllers of several hundred French supermarkets and switched the fridges and freezers into a defrost cycle that never ended. Intermarché, Coopérative U, Carrefour and Leclerc lost their chilled and frozen stock, the Paris prosecutor has opened an investigation, and the equipment at the centre of it is sitting on the open internet in the UK too.
Seeing what your SOC sees: the new SIEM section in Pulse
Managed security has a quiet flaw: when it works, there is nothing to look at. The latest release of Pulse, our client portal, changes that. You can now watch the activity our Security Operations Centre records across your estate as it happens, see every monitored machine, and open the same page for each one that our analysts use. Here is what has changed, why we built it this way, and how to get the most from it.