What are the signs that a telecom intrusion campaign is still active after initial containment?

What to look for when containment is not actually containment

A telecom intrusion campaign is still active when the attacker’s original foothold, credentials, or access path remain usable somewhere in the environment. The key signal is not just “more alerts,” but evidence that the operator can still move, authenticate, or change state in systems that should now be quiet. In practice, that means watching for fresh administrative activity, repeated changes that undo remediation, and access in places that should have stabilised after the first response.

Activity that keeps reappearing after cleanup usually indicates the campaign was interrupted, not removed. Telecom environments are especially sensitive because attackers may retain access through exposed management interfaces, weak router credentials, or touched accounts and systems that were never fully swept. When one part of the environment keeps behaving normally while a neighbouring control plane remains noisy, assume the intrusion may still be live.

One useful signal is whether the systems touched by the campaign still show a path for the attacker to return. That can be a stolen credential, a lingering configuration weakness, an uncompensated account, or an unmanaged exposed service that was not part of the initial containment scope. If the answer is yes, containment is partial, not complete.

Why telecom campaigns often survive the first response

Telecom intrusions can persist because responders focus on the most visible compromise point while missing adjacent systems that the attacker can still use. A compromised admin account, an unrotated secret, or a vulnerable router can remain enough for re-entry even after the first infected host is isolated. The operational problem is blast radius: if only some affected systems were remediated, the campaign can continue through the residual trust relationships that were left in place.

Salt Typhoon US telecoms breach is a useful reminder that credential abuse and device weaknesses can coexist, so closing only one path does not end the intrusion. In the same way, signs of continued activity often come from the overlap between infrastructure flaws, account compromise, and later-stage persistence.

If you need a concrete example of the persistence pattern itself, Cisco Active Directory credentials breach shows how credential theft can support lateral movement long after the initial event. For broader context on how reused secrets and overprivileged access sustain compromise, the Ultimate Guide to Non-Human Identities is also relevant because telecom operations often depend on machine-facing credentials and service access that must be revoked and rotated quickly.

One statistic that matters here is that 91.6% of secrets remain valid five days after the targeted organisation is notified, which shows how often response is slower than attacker reuse. In an active campaign, that delay is enough to let a foothold survive remediation and reappear as fresh administrative behaviour.

Risk and Threat Considerations

The main risk is false closure: teams may declare containment before every viable access path has been removed, allowing the campaign to resume through untouched credentials, routers, or management systems. In telecom networks, that creates a particularly dangerous condition because the attacker can use legitimate administrative access to blend in with normal operations.

Failure mechanism: A partial cleanup leaves one or more durable attacker enablers in place, such as stolen credentials, persistent configuration changes, exposed management access, or a vulnerable device that was not rebuilt or patched.

Impact: The intruder can re-enter, continue lateral movement, restore access after resets, or touch high-value systems again, which extends dwell time and increases the chance of service disruption or lawful-intercept exposure.

Practitioner Guidance

What to verify: Treat containment as unproven until you can show that all known attacker paths are closed, not just the system that first triggered the alert. In this scenario, verify credential rotation, router and management-plane patching, account review, and whether any configuration changes were reversed or reintroduced after cleanup.

Decision rule: If you still see unexplained admin actions, new logins in supposedly stable systems, or evidence that high-value accounts were touched, assume the campaign remains active and continue hunting before declaring recovery. If the same access path can still authenticate or administer production systems, the response is not finished.

Practitioner takeaway: In telecom intrusions, the most important question is not whether the initial host is clean, but whether any attacker-capable access path still exists anywhere in the control plane or adjacent infrastructure.

Related resources from NHI Mgmt Group

• What are the signs that SaaS non-human identity abuse is still active after initial remediation?
• What are the signs that an attacker is still active after a password or MFA reset?
• What are the signs that a network security appliance vulnerability still poses active exposure after a patch is available?
• What are the signs that a router-based intrusion campaign is active in an environment?