Telco espionage shows perimeter trust still fails critical access

At a glance

What this is: This analysis links the UNC3886 telco espionage case to the failure of perimeter trust, showing how stolen credentials and firewall exploitation still let attackers reach critical internal systems.

Why it matters: It matters because IAM, PAM, and NHI teams cannot rely on perimeter controls alone when privileged access, key material, and internal systems remain reachable after initial compromise.

By the numbers:

• In 2025, SK Telecom in South Korea was the target of a cyberattack which exposed the SIM data of almost 27 million users.

Context

Perimeter trust is the assumption that anything authenticated or filtered at the edge can be trusted deeper inside the environment. In critical infrastructure, that assumption fails when a single firewall weakness or credential theft path becomes enough to reach systems that should be separately governed.

This article uses the UNC3886 telecom espionage case to show why network edge controls are not a sufficient trust boundary for privileged access. The same logic applies across NHI, PAM, and human IAM programmes when access remains valid after the first layer is crossed.

The primary lesson is not that telcos are uniquely exposed. It is that high-value environments still over-rely on perimeter enforcement while leaving internal access paths too permissive, too persistent, and too easy to reuse after compromise.

Key questions

Q: What breaks when firewall trust is treated as enough for critical access?

A: When the firewall becomes the trust boundary, a single edge compromise can unlock internal systems that were never meant to be directly reachable. The model fails because it assumes network location is proof of legitimacy. In practice, identity and privilege controls must still decide whether a session can proceed after the edge has already been crossed.

Q: Why do stolen credentials create such a large risk in telecom environments?

A: Stolen credentials are dangerous because they are already authenticated trust objects, not noisy malware signals. If they carry standing privilege, an attacker can move straight into internal systems and reuse legitimate paths. In telecoms, that can expand from a single compromised device to critical operational infrastructure with broad downstream consequences.

Q: How do teams know if Zero Trust is actually improving access control?

A: Look for runtime evidence, not policy statements. If access decisions change based on device posture, session context, and resource sensitivity, the programme is moving in the right direction. If controls only show up in annual reviews or static diagrams, the architecture may be branded Zero Trust without behaving like it.

Q: What is the difference between perimeter security and least privilege?

A: Perimeter security decides what enters or leaves a network boundary, while least privilege limits what an authenticated identity can do once inside. Both matter, but they solve different problems. Perimeter controls reduce exposure, whereas least privilege reduces blast radius after compromise, which is why critical environments need both.

Technical breakdown

Why perimeter firewalls fail as trust boundaries

A perimeter firewall filters traffic, but it does not prove that a session is safe once an attacker is already on the trusted side. In this case, a zero-day at the edge became the entry point for credential theft, which means the firewall failed as a decision boundary, not just as a packet filter. Zero Trust Architecture treats every access request as untrusted until verified, which is the opposite of classic perimeter trust. The architectural issue is that one externally exposed device can still become a bridge into internal systems when the model assumes the edge is the control point.

Practical implication: move privileged access decisions away from the firewall and toward continuous verification of each request.

Credential extraction turns edge compromise into internal access

Once malware can extract credentials, the attack stops being about a perimeter exploit and becomes about authentication trust. Credentials, tokens, and keys are portable trust artifacts, so whoever controls them can often move past the original breach point and reach systems that were never directly exposed. That is why credential handling sits at the centre of NHI governance and PAM. The telco case shows a familiar pattern: compromise the edge, harvest secrets, and reuse legitimate access paths to enter critical systems without needing broad malware coverage inside the estate.

Practical implication: treat exposed credentials as a governance failure, not just a technical incident.

Least privilege and just-in-time access reduce blast radius

Least privilege limits what a compromised identity can touch, while just-in-time access removes standing permissions when they are not actively needed. In a telco environment, that matters because internal systems, operations tooling, and support access often carry far more reach than teams realise. If a stolen credential has standing access, the attacker inherits whatever scope was granted long before the breach. Zero Trust only works when privilege is small, time-bound, and continuously re-evaluated, not merely authenticated once at the edge.

Practical implication: shrink standing access paths before assuming perimeter hardening will contain a breach.

Threat narrative

Attacker objective: The objective was espionage-driven access to critical internal systems and technical data inside telecommunications infrastructure.

1. Entry occurred through exploitation of a zero-day vulnerability at the perimeter firewall protecting telco infrastructure.
2. Credential harvesting followed when malware extracted credentials that could be reused for internal access.
3. Escalation happened as those credentials opened access to several critical internal systems inside the telcos.
4. Impact was limited to technical data extraction, but the same path could have enabled service disruption or wider critical infrastructure reach.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Perimeter trust is the wrong security assumption for critical access. A firewall can filter traffic, but it cannot prove that the next internal request is legitimate once credentials are stolen. The UNC3886 case shows that the edge is only one control point, not a trustworthy boundary. Practitioners should stop treating perimeter enforcement as a substitute for continuous identity verification.

Credential theft converts a network breach into an identity breach. The key failure is not only that an attacker entered the environment, but that extracted credentials retained enough authority to matter inside it. That is a governance problem across NHI, PAM, and human access because the stolen identity becomes the real attack path. The implication is that credential scope and lifecycle must be treated as core risk surfaces, not back-office administration.

Standing privilege creates the blast radius that espionage groups exploit. If access persists after the original use case ends, any valid credential can become a reusable bridge into critical systems. That is exactly why Zero Trust and just-in-time access matter together: one governs trust decisions, the other limits how long a trust decision survives. Practitioners should rethink access duration as aggressively as access scope.

Critical infrastructure needs identity controls that assume partial compromise. Telecommunications environments cannot rely on a single defensive layer because the business impact extends into banking, transport, and healthcare. Once an attacker reaches internal systems, the question is no longer whether the perimeter held, but whether downstream access was constrained enough to absorb the breach. The implication is that internal segmentation, privilege minimisation, and credential governance must be designed for failure at the edge.

Zero Trust becomes meaningful only when access is continuously reevaluated. The article’s own framing points to least privilege, continuous authentication, and context-based policy as the practical answer to perimeter failure. Those principles are not abstract architecture language here. They are the mechanisms that prevent one credential theft event from becoming a telecom-wide internal access problem.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Identity trust now has to survive the loss of the perimeter. For telco, critical infrastructure, and other high-consequence environments, the real design question is no longer whether the edge can be hardened enough. It is whether privileged access still behaves safely after the edge is bypassed, because that is where the breach path becomes operationally meaningful.

Perimeterless access changes the governance burden for PAM and NHI teams. When credentials can be extracted and reused from edge systems, access policy must be written as if compromise has already happened. That pushes teams toward least privilege, short-lived access, and tighter control over internal trust paths rather than reliance on a single defensive border.

For practitioners

• Harden the perimeter as an exposure point, not a trust boundary Treat firewalls and edge appliances as high-risk entry surfaces, then enforce separate identity checks before any internal privileged session is accepted.
• Reduce standing privilege for critical internal systems Review telco operator, admin, and service access that persists beyond immediate need, then remove any access that does not require continuous use.
• Protect credentials as reusable attack paths Inventory secrets, keys, and account credentials that could be extracted from edge systems, then prioritise rotation and revocation for the highest-value access paths.
• Segment critical infrastructure access by business impact Separate operations, support, and administrative routes so compromise of one access path does not automatically reach core telecom services.

Key takeaways

• The article shows that telco espionage can begin with a firewall zero-day but become an identity and access problem once credentials are extracted.
• Its broader warning is that critical infrastructure still contains standing trust paths that let one compromise reach internal systems.
• The most effective limit on this kind of intrusion is not edge filtering alone, but reduced privilege, shorter access duration, and stronger internal segmentation.

Key terms

• Perimeter trust: Perimeter trust is the assumption that a successful login at the edge remains valid for broad internal access. In practice, it turns one authentication event into a durable entitlement. That model is fragile because any flaw in the gateway or session token can expose the full network, not just one application.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Credential Reuse: Credential reuse happens when the same password, token, or secret can unlock multiple systems or sessions. It increases breach impact because one stolen credential can become a wide-ranging access path. The control problem is not only theft, but the amount of trust packed into each reusable secret.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.