Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions

2026-09-25 at 11:50

By Ashish Khaitan

Nation-state operators rarely need a zero-day to get inside a carrier. Much of the telecom stack still runs protocols designed when every participant was a known, trusted operator. SS7 assumes that the node sending a request has a legitimate reason to send it.

BGP assumes a network announcing a route actually owns it. Attackers who understand those assumptions can operate inside a carrier for years without triggering a single alert. For telecom CISOs and SOC teams, defending this environment starts with understanding how these attacks actually work.

SS7: A Protocol That Trusts Every Caller

SS7 is roughly 40 years old and still underpins 2G and 3G SMS and phone services as well as international roaming. Its weakness is architectural. Any node with signaling access can send Mobile Application Part (MAP) queries asking where a subscriber is, or tell the network to route that subscriber’s SMS elsewhere.

SS7 has no built-in way to confirm the request came from someone entitled to make it. Access is also easier to get than many assume. Leased Global Titles, loosely vetted roaming partners, and compromised operators all provide an entry point.

The consequences are well documented. SS7 can enable location tracking, interception of voice data and multi-factor authentication keys, and can even serve as a spyware delivery vector. Moving to newer generations doesn’t solve the problem. The 4G and 5G Diameter protocol has its own location tracking weaknesses, and 4G and 5G users can be downgraded to SS7 when roaming.

U.S. government assessments are blunt. The Department of Homeland Security concluded in 2017 that all U.S. carriers are vulnerable to SS7 and Diameter exploits, and a DHS presentation named Russia, China, Israel and Iran as the primary countries reportedly using other nations’ telecom assets to exploit U.S. subscribers.

These attacks often travel indirectly. According to that material, the traffic was being routed through third-country networks. The tooling is also spreading. Cyble’s dark web researchers have confirmed that SS7 and Diameter exploits and services are still routinely discussed on underground forums, including detailed attack exploits.

BGP: Internet Routing on the Honor System

BGP has the same trust problem at internet scale. The FCC has noted that the protocol was designed decades ago and offers no intrinsic way to verify route origination. If a network announces a prefix it doesn’t own, or a more specific slice of one, its neighbors will often accept the announcement and send the traffic to it.

The best-known case is still a warning for the industry. According to the U.S.-China Economic and Security Review Commission’s 2010 report to Congress, China Telecom advertised erroneous routes for about 18 minutes on April 8, 2010, pulling traffic for roughly 15 percent of internet destinations through Chinese servers, including traffic to U.S. government and military sites.

Regulators are now responding. In 2024, the FCC proposed that broadband providers build BGP security plans based on RPKI, with the nine largest filing those plans confidentially and publishing quarterly progress data.

The Router Layer: Where Persistence Lives

Signaling and routing abuse are only part of the picture. The most serious recent intrusions have targeted the hardware that carries the traffic. A 2025 joint advisory from CISA and allied agencies found that PRC state-sponsored actors focus on large backbone routers of major telecom providers, along with provider edge and customer edge routers, and use compromised devices and trusted connections to pivot into other networks.

They often modify routers to maintain persistent, long-term access.

Initial access typically came through known vulnerabilities, not novel ones. The advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication bypass to achieve root-level code execution.

Once inside, the Salt Typhoon cluster implanted malicious code on network devices and configured GRE tunnels to pull data through compromised routers.

Aging infrastructure makes eviction harder. U.S. Senator Mark Warner, describing carrier networks, said there is equipment “so old it’s unpatchable”.

Why Detection Lags

These intrusions have a common pattern. SS7 abuse looks like normal roaming traffic. A hijacked prefix looks like an ordinary route update. A rogue GRE tunnel looks like legitimate provisioning. None of them runs on an endpoint where EDR can see it.

By the time anomalous activity shows up internally, the attacker has usually already mapped the network and started moving laterally.

Defending this environment takes several layers working together:

Signaling: Deploy SS7 and Diameter firewalls and vet Global Title partners strictly.

Routing: Publish Route Origin Authorizations and enforce RPKI origin validation.

Router hygiene: Patch the CVEs above immediately, and audit every tunnel, mirror session, and AAA configuration against an approved baseline.

External visibility: Track what happens outside your perimeter, where attacks are often planned before they launch.

Where Cyble Vision Fits

External visibility is the gap Cyble Vision closes. It tracks underground forums where SS7 exploits and signaling access are traded, and flags leaked credentials and device configurations tied to your infrastructure.

It maps exposed management interfaces across your attack surface and prioritizes the edge-device vulnerabilities state actors are actively exploiting.

Threat actor intelligence connects those signals to the groups behind them, so your SOC can act on early indicators instead of reconstructing a breach after the fact.

See intrusions before lateral movement starts. Book a Cyble Vision demo →