TL;DR: Telecom carriers remain exposed because SS7 and BGP still trust participating networks by design, letting attackers who gain signaling or routing access track subscribers, reroute traffic and persist inside carrier infrastructure, according to Cyble. That makes signalling and routing validation a governance problem, not just a network engineering issue.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Cyble's report: SS7 and BGP trust models still let nation-state operators hide inside carrier and routing infrastructure for long periods.
Why it matters: Telecom security teams must treat signalling trust, route origination, and router hygiene as identity-adjacent control points because attacker access often looks legitimate until persistence is established.
By the numbers:
- The Department of Homeland Security concluded in 2017 that all U.S. carriers are vulnerable to SS7 and Diameter exploits.
Context
Telecom infrastructure still carries a structural trust problem: protocols were built for a closed operator community, not for hostile or compromised peers. When a signalling network accepts requests or a routing system accepts announcements on trust alone, attackers can blend into ordinary traffic and stay invisible for long periods.
That gap matters because telecom compromise is not only about subscriber impact. It also creates a path into broader enterprise and government communications, especially where roaming, legacy signalling, and provider edge equipment remain in use. Telecom network security is therefore as much about trust validation and partner vetting as it is about packet handling.
Key questions
Q: How do SS7 attacks work against mobile networks?
A: SS7 attacks exploit a protocol that trusts participating nodes to act legitimately. An attacker with signalling access can query subscriber location, reroute SMS, or intercept authentication-related traffic because the protocol lacks strong origin verification. Defenders need signalling firewalls, partner vetting, and strict control over which networks can reach the signalling plane.
Q: What makes BGP hijacking possible?
A: BGP hijacking is possible because BGP trusts route announcements from peers unless operators filter prefixes and verify route origin. Weak prefix limits, absent route origin validation, and poor policy on route advertisements let a malicious or mistaken neighbour attract traffic for a network it does not control.
Q: Why do attackers target carrier routers for persistence?
A: Attackers target carrier routers for persistence because routers sit on trusted control planes, often have long-lived administrative access, and can keep forwarding traffic even when servers are rebuilt. Compromising router credentials, management interfaces, or configuration lets them preserve access through route changes and selective logging gaps.
Q: How should telecom teams spot signalling abuse early?
A: Telecom teams should spot signalling abuse early by watching for abnormal protocol messages, unusual roaming or routing patterns, and mismatches between expected and observed control-plane behaviour. External visibility from probes, logs, and network analytics helps detect fraud, misrouting, and covert traffic manipulation before service impact spreads.
Technical breakdown
Why SS7 requests are easy to impersonate
SS7 was designed around operator trust, so a node with signalling access can issue Mobile Application Part queries and request subscriber location or message rerouting without strong built-in origin assurance. Leased Global Titles, weak roaming partner vetting, and compromised operators all become practical entry paths. Because the protocol does not validate entitlement at the message layer, malicious requests can look operationally normal even when they are abusive. See the SS7 and Diameter Signalling Security Guide.
Practical implication: Treat signalling access as a privileged trust boundary and enforce partner vetting and SS7 firewalls against abusive MAP traffic.
How BGP accepts routes on trust
BGP distributes reachability information between autonomous systems, but it does not inherently verify that the announcer truly owns the prefix it advertises. That means a false route or a more specific prefix can redirect traffic through an attacker-controlled network if neighbouring systems accept it. RPKI and route origin validation exist to add cryptographic proof to what BGP otherwise accepts as a convention of trust. See the BGP and Routing Security Guide.
Practical implication: Use route origin validation to separate legitimate route announcements from hijacks or accidental leaks.
Why router compromise creates long-lived persistence
When attackers reach carrier routers, they can modify configurations, establish GRE tunnels, and use trusted network paths to pivot laterally. The device itself becomes the persistence layer, which is harder to evict than endpoint malware because it sits below normal EDR visibility and often runs on aging infrastructure with limited patchability. That makes the router a control point for both access and concealment.
Practical implication: Hunt for unauthorised tunnels, mirrored traffic, and AAA changes on backbone and edge routers.
Threat narrative
Attacker objective: The objective is to control or observe carrier traffic while remaining indistinguishable from legitimate network operations.
- Entry begins through signalling access, route announcement abuse, or router exploitation rather than a traditional endpoint compromise.
- Credential and trust abuse follow when attackers use legitimate-looking network access, compromised operator relationships, or exploited appliances to issue normalised traffic.
- Escalation occurs as the intruder reroutes, mirrors, or tunnels traffic through carrier infrastructure and extends access across connected systems.
- Impact is long-term surveillance, traffic interception, subscriber tracking, and persistent access inside telecom networks.
Breaches seen in the wild
- Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SS7 and BGP are not just legacy protocols, they are trust systems that assume the caller is legitimate. That assumption creates a governance gap when hostile actors can obtain signalling access, leased routing relationships, or compromised operator credentials. The important question is not whether the protocol is old, but whether the control plane still validates who is allowed to speak. Practitioners should treat protocol trust as an explicit risk surface, not a background property.
Persistent carrier access depends on infrastructure that outlives normal detection windows. Once attackers reach routers or signalling infrastructure, they can hide inside traffic patterns that resemble roaming, provisioning, or standard route changes. That makes attack surface management relevant to telecom operations because the externally reachable edge often becomes the first and most durable foothold. Carrier defence therefore depends on exposure visibility as much as on patching.
Long-lived telecom compromise is a failure of trust verification, not simply a patching problem. The article shows that legacy protocols, trusted peers and ageing router estates combine to let attackers remain embedded for years. That means the security programme has to measure who can issue requests, who can announce routes, and which devices can preserve invisible persistence. In practice, telecom governance must align signalling, routing and device controls under one risk model.
Network identity is now a first-class security issue in telecoms. SS7 nodes, BGP speakers and carrier routers act like identities with delegated authority, yet many operators still govern them as generic infrastructure. That is precisely why NHI thinking matters here: machine trust, partner trust and routing trust all need inventory, validation and revocation logic. Security teams should model these assets as privileged non-human entities with enforcement around who can act, what they can claim, and how long they can persist.
What this signals
Protocol trust is the real attack surface in telecoms. When a network assumes that the sender is legitimate, security moves from authentication to relationship management. That is why partner vetting, route validation and signalling controls need to be governed together rather than as separate engineering domains.
Carrier infrastructure now behaves like a distributed identity fabric. Router roles, signalling peers and upstream providers each carry delegated authority, which means a compromise at one trust point can propagate into others. The operational lesson is to inventory, validate and revoke network trust relationships with the same seriousness used for privileged accounts.
For practitioners
- Enforce signalling partner vetting Require strict approval for Global Title partners, roaming connections and any entity that can issue SS7 or Diameter requests.
- Deploy route origin validation Publish Route Origin Authorizations and validate BGP origins before accepting external route announcements.
- Audit carrier router tunnels and AAA Check every GRE tunnel, mirror session and AAA configuration against an approved baseline, then investigate any drift.
- Expand external exposure monitoring Track exposed management interfaces, leaked device configurations and underground forum mentions tied to your carrier infrastructure.
Key takeaways
- Legacy telecom protocols still privilege trust over verification, which leaves carriers exposed to stealthy abuse by skilled operators.
- SS7 signalling, BGP route origination and router configuration integrity are the three control points that determine whether intrusion becomes persistence.
- Telecom defenders need a unified trust model that covers partners, routing and device state, not isolated fixes for each layer.
Related NHI Mgmt Group resources: Telecom Network Security Guide · BGP and Routing Security Guide · OSINT and Reconnaissance Guide · Attack Surface Management Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008; TA0040 — Credential Access; Lateral Movement; Impact | The intrusion pattern relies on credential or trust abuse, lateral movement through carrier infrastructure, and long-term impact. |
| Recommendation — Map telecom intrusion indicators to TA0006, TA0008 and TA0040 to prioritise detection of access abuse and persistence. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Carrier signalling and routing trust depend on correct authorisation boundaries for peers and devices. |
| Recommendation — Apply PR.AA-05 to restrict which networks, devices and partners can issue privileged signalling or routing actions. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on trusted operator access, stolen logins and long-lived privileged paths. |
| Recommendation — Use CIS-5 to inventory, validate and remove stale privileged access across telecom operators and router estates. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential and key handling are central where attackers exploit operator logins and AAA configurations. |
| Recommendation — Enforce IA-5 to manage, rotate and revoke authenticator material used by telecom operators and network devices. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of Cryptography | Route and signalling protections depend in part on cryptographic validation and trusted channel integrity. |
| Recommendation — Apply A.8.24 where cryptographic validation supports routing trust and secure signalling exchange. | ||
Key terms
- BGP: BGP is the routing protocol that exchanges reachability information between autonomous systems on the internet. Attackers can abuse misconfigured BGP to divert, intercept, or blackhole traffic, while defenders monitor route origin, prefix announcements, and policy changes to reduce hijacking and accidental route leaks.
- AAA Configuration: AAA Configuration is the setup of authentication, authorisation and accounting controls on a network device or access system. It defines how users prove identity, what they are allowed to do, and which actions are logged for audit and troubleshooting.
- Signaling System 7 (SS7): Signalling System 7 is a set of telephony signalling protocols used by public switched telephone networks to set up calls, route messages and manage network services. It carries control messages separately from voice traffic, and weaknesses in SS7 can allow call interception, location tracking or message redirection if carriers do not restrict signalling access.
- Diameter: Diameter is a protocol for authentication, authorisation and accounting in carrier and network access systems. It carries requests and answers between network devices and policy servers using attribute-value pairs, and can transport subscriber identity, session state and charging data across IP networks.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps practitioners connect delegated trust with the controls that stop persistence and abuse.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org