>In order to maintain an uninterrupted connection to a target’s phone, the Harris software also offers the option of intentionally degrading (or “redirecting”) someone’s phone onto an inferior network, for example, knocking a connection from LTE to 2G. [1]

>In its most basic functionality, the [LTE] IMSI catcher receives connection/attach request messages from all mobiledevices in its vicinity. These attach messages are forced to disclose the SIM’s IMSI, thus allowing the IMSI catcher to retreive the IMSI for all devices in its vicinity... a fully LTE-based IMSI catcher is possible, very simple and very cheap to implement without requiring to jam the LTE and 3G bands to downgrade the service to GSM. [2]

Exploits on 5G to retrieve the IMSI. [3]

[1] https://theintercept.com/2016/09/12/long-secret-stingray-man...

[2] https://arxiv.org/abs/1607.05171

[3] https://arxiv.org/abs/1809.06925