Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions
Nation-state actors abuse SS7, BGP, and unpatched telecom routers, including Salt Typhoon persistence via GRE tunnels.
Cyble describes how nation-state operators abuse telecom trust assumptions in SS7, Diameter, and BGP rather than relying only on zero-days. DHS has said U.S. carriers are exposed to SS7 and Diameter attacks, and a 2010 China Telecom BGP incident briefly drew about 15 percent of internet destinations through Chinese servers. A 2025 CISA advisory says PRC actors, including the Salt Typhoon cluster, hit backbone and edge routers using CVE-2024-21887, CVE-2023-46805, CVE-2024-3400, CVE-2023-20273, and CVE-2023-20198, then maintained access with GRE tunnels.
- SS7 and Diameter lack strong caller authorization, enabling tracking and interception.
- China Telecom's 2010 BGP incident diverted about 15 percent of destinations.
- Salt Typhoon used known Ivanti, Palo Alto, and Cisco flaws, then GRE tunnels.
- CISA says PRC actors persist on telecom backbone and edge routers.
- The FCC pushed RPKI-based BGP security plans for large providers.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1572 Protocol TunnelingT1199 Trusted RelationshipT1557 Adversary-in-the-Middle
- Threat actors
- Salt Typhoon
- Organizations
- CISADepartment of Homeland SecurityFCCCyble
- Countries
- United StatesChinaRussiaIsraelIran
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) | 10.0 | 100% | KEV | KEV |
| CVE-2023-20273 | Authenticated Command Injection (Root) in Cisco IOS XE Web UI | 7.2 | 93% | KEV | KEV |
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-3400 | Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
4 min read at cyble.com
Nation-state operators rarely need a zero-day to get inside a carrier. Much of the telecom stack still runs protocols designed when every participant was a known, trusted operator. SS7 assumes that the node sending a request has a legitimate reason to send it.
By Ashish Khaitan · cyble.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.