Telecoms Incident Response Guide: Core Network Intrusions, Subscriber Data and Regulator Notification

When an operator finds an intruder on its routers, signalling platforms or lawful intercept systems, the standard enterprise playbook breaks: you cannot reimage the core, the attacker may be reading the network you would use to coordinate, and several regulators may expect a report before anyone knows what was taken. This guide is about running that incident. It covers triage of core and management plane intrusions, containment that keeps calls and data flowing, evidence from network devices, subscriber data exposure, and the regulator clocks in the US, UK, EU, India and Australia run as one process. It is written for operator security leads, network operations managers and incident commanders at mobile, fixed and wholesale carriers. Prevention and hardening are covered in the Telecom Network Security Guide; the individual reporting rules have their own guides, linked below.

Key takeaways

• Assume the management plane is watched. In the campaign behind the December 2024 joint guidance from CISA, NSA, FBI and Five Eyes partners, intruders lived on carrier network equipment; coordinate the response out of band, not over the corporate network or email you are investigating.
• Contain without switching off the network. Telecoms containment is credential rotation, ACL tightening and configuration rollback from a trusted golden source, done in maintenance windows where possible, because pulling a core router is itself a significant outage.
• Treat device configurations as evidence. Running configs, local accounts, AAA logs and flow records are the core network's disk image; capture them before you change anything.
• One classification meeting, many clocks. A single compromise can start an Ofcom report, NIS2 early warning, CPNI law enforcement notice and other national rules; decide once and log who decided when.
• Subscriber harm follows the intrusion. Exposed subscriber records fuel SIM swap and impersonation fraud, so tighten port-out and SIM change checks as soon as subscriber data is in scope.

What makes telecoms incidents different

Most enterprise incident response assumes you can isolate a host, wipe it and restore. Operators face four constraints that change the plan.

The threat actors behind these incidents, from state espionage to SIM swap crews, are profiled in the Telecoms Threat Actors Guide.

How core network intrusions show up

The December 2024 CISA-led guidance on communications infrastructure stresses that the activity it describes used existing weaknesses rather than new techniques. That means the early signals are ordinary ones that are easy to dismiss in a busy network operations centre.

• Configuration drift: changes outside change management, including new local users, modified ACLs, unusual route updates or weak protocols re-enabled (the guidance names Telnet, TFTP, SNMPv1 and v2c among protocols to disable).
• Unexpected tunnels and services: new GRE or IPsec tunnels, or open ports on forward-facing devices that nobody requested.
• Account anomalies: logins by service accounts from new sources, dormant accounts becoming active, or local emergency accounts used outside a logged break-glass event.
• Configuration exfiltration: large config pulls or copies to unusual destinations, mapped to MITRE ATT&CK T1602.002 Network Device Configuration Dump.
• Edge exploitation: exploitation of internet-facing devices and remote access (T1190 Exploit Public-Facing Application, T1133 External Remote Services) followed by use of valid accounts (T1078).
• Subscriber data pulls: unusual volumes through customer APIs or care tools. The T-Mobile API breach ran for about six weeks before detection, which is what missing per-client volume alerting looks like.

The log sources behind these signals are covered in the Network Device Syslog and Configuration Change Detection Guide.

Triage: the first questions

1. Which plane? Customer-facing IT (billing, CRM, care portals), management plane (AAA, jump hosts, network management systems), signalling (SS7, Diameter, GTP), or the user plane. The answer sets the evidence and the regulators.
2. Is lawful intercept or a government-sensitive system in scope? If yes, invoke the restricted handling path immediately and limit the investigation team.
3. Is the management network trusted? If AAA servers, jump hosts or the network management system may be compromised, move coordination to out-of-band channels before discussing the incident. See the Out-of-Band Communications for Incident Response Guide.
4. Has subscriber data or CPNI been accessed? This starts privacy and CPNI processes and the fraud workstream.
5. Has service been significantly affected, or could the access enable that? Section 105K expressly covers compromises that could enable a later significant compromise, not only those already causing harm.
6. Which suppliers have access? Managed service providers, equipment vendors with remote support and roaming partners need to be in or out of the trust boundary for this incident.

The regulator clocks in one table

Each rule below has its own guide on this site with full detail. This table is for the classification meeting; confirm current wording against the official text before relying on it.

Section 105K lists the factors for judging significance: duration, number of users affected, size and location of the area affected, and how far users' activities are disrupted. Record each factor in the decision log. Data protection breach rules (for example UK GDPR Article 33) run alongside these. The full jurisdiction list is in the Telecoms Security Laws Map.

Containment that keeps the network running

Containment in a carrier network is sequenced, because each step can drop traffic. The order below is our recommendation for a suspected management plane intrusion.

1. Snapshot first. Pull running and startup configurations, local user lists, AAA and syslog records and flow data from affected and neighbouring devices, and hash them (see Evidence below).
2. Cut the attacker's access paths. Tighten VTY and management ACLs to known administrative sources, disable outbound connections from devices (the joint guidance recommends this to limit lateral movement), and remove unexpected tunnels.
3. Rotate credentials in a planned wave. AAA shared secrets (TACACS+ and RADIUS keys), local emergency accounts, SNMPv3 credentials, SSH host and user keys, API tokens for network management and orchestration systems, and supplier remote access accounts. Rotating one without the others leaves a way back in.
4. Restore from a trusted golden configuration. The guidance says devices should not be the source of truth for their own configuration; compare running configs against the central store and push known-good versions.
5. Verify software integrity. Compare device image hashes with vendor-published values from an authenticated source and replace any that do not match.
6. Fence suppliers. Suspend non-essential supplier remote access until their accounts and jump paths are confirmed clean.

Use maintenance windows where the attacker is not actively causing harm, and emergency change where they are. The Network Device Management Plane Hardening Guide covers the controls to put back permanently.

Evidence from network elements

Keep a chain of custody record for each artefact, as set out in the Evidence Handling and Chain of Custody Guide. The joint guidance also recommends encrypted log forwarding and off-site copies that cannot be altered or deleted, which is what makes these records usable after an intrusion.

Subscriber data and fraud workstream

When subscriber records are exposed, the harm continues after the intruder is gone. Give fraud and customer operations their own lead in incident command.

• Raise verification for SIM change and port-out on affected accounts, and add a hold period where your process allows. See the SIM Swap Response Playbook.
• Brief care agents on impersonation scripts that may use the exposed fields.
• Coordinate customer notice timing with law enforcement where CPNI rules or an agency request require a delay.
• Watch for signalling abuse against affected numbers, such as location tracking or SMS interception attempts. See the SS7 and Diameter Signalling Security Guide.

Where identity fits

Most of the credentials in a carrier core are not people: AAA shared secrets, SNMP community strings and v3 users, SSH keys used by automation, API tokens for orchestration and OSS/BSS integrations, and certificates on signalling interfaces. They are the keys an intruder uses to stay in, and the hardest to rotate in a hurry because nobody owns them. Keep an inventory of these machine credentials with an owner and a tested rotation procedure before you need it, and keep the network AAA separate from the corporate identity store, as the joint guidance recommends. The operator identity estate is covered in the Telecoms Identity Security Guide.

Implementing the process

The steps below are NHI Mgmt Group recommendations.

1. Write a telecoms annex to your incident plan with the plane-based triage questions and the clocks table above, beneath your main Incident Response Plan Template.
2. Stand up out-of-band coordination that does not depend on the corporate network or management plane.
3. Build the evidence kit: scripts or runbooks to pull configs, AAA and flow data, held in the central configuration system, with read-only access tested.
4. Pre-agree containment playbooks with network operations, scored for service impact, including who can authorise emergency change at night.
5. Exercise twice a year with a management plane scenario and a subscriber data scenario, timing the regulator decisions against each clock. Roll back any playbook step that causes an unplanned outage in testing and redesign it.

For small operators and MVNOs, much of the core sits with a host network: the plan is mostly contracts, contacts and the subscriber workstream. Large operators need the full evidence kit and a standing network forensics capability.

Detection and measurement

• Percentage of network devices whose running configuration is compared with the central store at least daily.
• Percentage of devices forwarding logs off-device to protected storage.
• Time from classification meeting to each regulator decision in exercises, against the shortest applicable clock.
• Time to rotate all AAA secrets and local emergency accounts for one region, measured in drills.
• Machine credentials in the network estate with a named owner and tested rotation procedure.

Framework mapping

For the general response method see the NIST SP 800-61 Incident Response Guide; NIST SP 800-61 Rev. 3 (April 2025) frames incident response as a CSF 2.0 Community Profile.

Common failure patterns

• Coordinating on a compromised channel: discussing the intrusion over corporate email and chat that the intruder can read.
• Rotating some secrets: changing admin passwords but leaving AAA shared secrets, SNMP credentials and automation keys unchanged.
• Changing before capturing: reloading or reconfiguring devices before configs and short local logs are pulled.
• Waiting for root cause to classify: section 105K and NIS2 clocks run from awareness or significance, not from the forensic report.
• Forgetting suppliers: vendor and managed service remote access left open during containment.
• Ignoring subscriber harm: treating the incident as closed while exposed customers face SIM swap and impersonation fraud.

Practitioner checklist

• Telecoms annex to the incident plan with plane-based triage and a single clocks table.
• Out-of-band coordination channel tested and independent of the management network.
• Central configuration store is the source of truth; daily diffs against running configs.
• Off-device, tamper-resistant log storage for network elements and AAA.
• Evidence kit for configs, AAA, flow and image hashes, with chain of custody forms.
• Inventory of network machine credentials with owners and a rotation runbook.
• Pre-scored containment playbooks agreed with network operations.
• Restricted handling path for lawful intercept and government-sensitive systems.
• Subscriber fraud workstream with SIM change and port-out escalation steps.
• Twice-yearly exercises timed against the shortest regulator clock.

Standards and references

• CISA, NSA, FBI and partners: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
• NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• UK legislation: Communications Act 2003, section 105K
• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• eCFR: 47 CFR 64.2011, Notification of customer proprietary network information security breaches
• Federal Register of Legislation: Security of Critical Infrastructure Act 2018
• MITRE ATT&CK: Network Device Configuration Dump

Related NHI Mgmt Group resources: Incident Response Guide · Telecom Network Security Guide · Telecoms Threat Actors Guide · Digital Forensics (DFIR) Guide