A new report reveals that covert surveillance actors used telecom signalling systems and SIM-based attacks to track their targets, and a VPN can't stop that.