Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions
Threat Actors
Excerpt
Nation-state operators rarely need a zero-day to get inside a carrier. Much of the telecom stack still runs protocols designed when every participant was a known, trusted operator. SS7 assumes that the node sending a request has a legitimate reason to send it. BGP assumes a network announcing a route actually owns it. Attackers who understand those assumptions can operate inside a carrier for years without triggering a single alert. For telecom CISOs and SOC teams,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2023-46805 | High | Score 63/100 | First seen |
| CVE | CVE-2023-20273 | Medium | Score 51/100 | First seen |
| CVE | CVE-2023-20198 | Medium | Score 53/100 | First seen |
| CVE | CVE-2024-21887 | High | Score 63/100 | First seen |
| CVE | CVE-2024-3400 | High | Score 79/100 | First seen |
IOC Relationship Graph
Building graph…