Telecoms Threat Actors Guide: State Espionage, SIM Swap Crews and Lawful Intercept Targeting

Telecoms operators are targeted by two very different kinds of attacker at once: state services that want long, quiet access to the network itself, and criminal crews that want a single customer's phone number for an afternoon. Both end up abusing the same thing, which is the operator's own privileged access, whether that is a router administrator account, a TACACS+ server or a retail manager's login to the SIM change tool. This guide maps the actor types that government advisories and MITRE ATT&CK document against carriers and internet service providers, what each one wants, how it gets in, and which controls break its path. It is written for security leads, network operations and fraud teams at mobile, fixed and wholesale operators and their managed service partners. Detailed actor profiles and control guides are linked rather than repeated.

Key takeaways

• Two threat models, one control plane: state espionage targets core and edge network devices, while SIM swap crews target care, retail and insider access; both succeed by using legitimate operator credentials.
• The network is the target, not just the IT estate: the August 2025 joint advisory AA25-239A, sealed by agencies from 13 countries, describes actors changing router configurations, redirecting TACACS+ authentication and building tunnels for collection and exfiltration.
• Lawful intercept and call records are prized: the FBI and CISA stated that PRC-affiliated actors stole customer call records and copied information subject to US law enforcement requests made under court orders.
• Criminals buy insiders: the US Cyber Safety Review Board reported that Lapsus$ offered up to USD 20,000 per week for SIM swaps and used telecom employee and contractor accounts to perform them.
• Known flaws and weak device hygiene do most of the work: the advisories point to known exploited edge vulnerabilities, default SNMP strings, weak stored device passwords and logging gaps rather than novel techniques.

Why attackers pick telecoms

• Collection at scale: call detail records, subscriber data and location data on millions of people sit in one operator. Access to a carrier is access to the communications of its customers, including officials.
• Lawful intercept capability: operators run systems built to deliver interception to authorities. An intruder who reaches them learns who is under investigation. See the Lawful Intercept System Security guide.
• Phone numbers are identity tokens: banks, email providers and crypto exchanges still send one-time codes by SMS, so control of a number unlocks other accounts. ATT&CK for Mobile records this as T1451 SIM Card Swap.
• A vast, long-lived edge: routers, firewalls and VPN concentrators run for years, are often managed in-band and hold shared administrator credentials.
• Large, distributed workforces: retail stores, outsourced care centres and field engineers all hold some ability to change customer accounts, which creates a large insider and social engineering surface.
• Downstream reach: carriers provide connectivity to government and enterprises, so a compromised provider edge can see or redirect customer traffic.

The actor map

The table lists actors with the strongest public record against telecoms. Group IDs and aliases are from MITRE ATT&CK v20; attribution is as stated by MITRE or the named government source.

See the Salt Typhoon Threat Actor Profile, Volt Typhoon Threat Actor Profile, Lapsus$ Threat Actor Profile and Scattered Spider Threat Actor Profile for group detail.

State espionage against the network

AA25-239A, first published on 27 August 2025 by NSA, CISA, FBI and partner agencies, is the most detailed public account of how state actors operate inside carrier networks. It lists telecommunications and ISPs alongside government, transport, lodging and military infrastructure, and names three Chinese companies that provide services to Chinese intelligence services. Agencies note that industry names such as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor overlap with, but may not match exactly, the activity described.

How they get in

• Edge device exploitation (T1190): the advisory names five known exploited vulnerabilities in VPN gateways, firewalls and router operating systems, all patchable. See the Edge Device Exploitation by Threat Actors Guide.
• Valid accounts (T1078): stolen or weak administrator credentials, default SNMP community strings such as "public" and "private", and reversible stored device passwords.
• Trusted relationships (T1199): provider-to-provider and provider-to-customer links let the actor move from one network into another.

What they do once inside

The FBI and CISA joint statement on PRC targeting of commercial telecommunications reported theft of customer call records, compromise of private communications of a limited number of people mainly involved in government or political activity, and copying of information subject to US law enforcement requests under court orders. That is why lawful intercept platforms and mediation systems belong in the highest protection tier.

SIM swap crews, insiders and care channels

Criminal groups rarely touch the core network. They work the customer account layer, where a single change moves a phone number and its incoming codes to the attacker.

• Social engineering of care and retail (T1684.001 Impersonation): callers pose as customers or as internal staff and use readily available personal data to pass weak checks.
• Insider recruitment: the CSRB found that threat actors paid telecom employees and contractors to hand over credentials, approve MFA requests or perform SIM swaps directly.
• Fraudulent data requests: the CSRB also describes fraudulent emergency disclosure requests used to obtain customer details, including customer proprietary network information.
• Stolen retail devices and tools: the CSRB recommended better asset management at retail points of sale, including remote wipe of stolen tablets used for account changes.
• Bulk data theft through APIs: criminals also harvest subscriber records at scale. In the T-Mobile API breach of 2023, one abused API returned data on about 37 million accounts over roughly six weeks.

In the United States, FCC rules adopted in November 2023 and effective from January 2024 (with some sections delayed pending further notice) require wireless providers to use secure authentication before a SIM change or port-out, notify customers immediately, offer a free account lock, keep staff who handle inbound contacts from seeing customer CPNI until the customer is authenticated, and keep records of SIM change requests for at least three years. See the SIM Swap Fraud Guide and FCC CPNI and Telecom Data Breach Rule Guide.

Where identity fits

Every actor above reaches its goal through an operator identity. Mapping the identity populations to actors tells you where to spend first.

See the Telecoms Identity Security Guide for the full control set by population.

Implementing the defences: a phased plan

1. Weeks 1 to 4, find exposure: inventory every internet-reachable management interface and edge device with firmware versions; check them against the CISA Known Exploited Vulnerabilities catalogue; list every local device account and every system holding shared AAA or SNMP secrets.
2. Weeks 1 to 6, hunt first: before changing anything, compare running configurations with an authoritative central copy, look for unknown TACACS+ servers, tunnels, mirror sessions and access list entries, and preserve evidence. See the Edge Device Compromise Investigation Playbook.
3. Months 2 to 3, close the management plane: move device management to an out-of-band network or dedicated management VRF with default-deny control-plane access lists, disable Telnet, HTTP, SNMPv1 and v2c and unused services, and require SSHv2. Pilot on one region and keep console access for rollback. See the Network Device Management Plane Hardening Guide.
4. Months 2 to 4, harden account change flows: require secure authentication and a second approver for SIM change and port-out on high-risk accounts, enforce free account locks, and alert on agents whose change volumes depart from their peers.
5. Months 3 to 6, tier the crown jewels: treat lawful intercept, mediation, call record stores and AAA servers as tier zero, with separate administrators, separate credentials and access reviews each quarter (our recommended cadence).
6. Ongoing, intelligence-led review: track new joint advisories for the sector, map new techniques to your detection coverage, and retire end-of-life devices on a dated plan.

Decision guidance

• Large national carrier: fund a dedicated network threat hunting capability, since state actors here are assessed as persistent for years. Configuration integrity monitoring at scale gives the best return.
• Regional operator or MVNO: the biggest exposure is often the care and retail channel and the host network relationship. Focus on SIM change authentication, agent monitoring and contract terms that give you logs from the host operator.
• Wholesale and transit providers: prioritise routing integrity, peer authentication and provider-edge configuration control, since trusted links are the route into customers.
• Hunt before you harden, or harden first? If indicators already match an advisory, hunt and preserve evidence first, because hardening can tip off the actor and destroy traces. With no indicators, harden in parallel with hunting.

Detection and measurement

• Configuration drift: percentage of devices whose running configuration is checked daily against the central authoritative copy. Target 100% of edge and core devices.
• Logging coverage: share of network devices sending syslog and AAA command accounting to central storage, and the number of devices with gaps over 24 hours. See the Network Device Syslog and Configuration Change Detection Guide.
• Known exploited exposure: count of edge devices with an unpatched KEV-listed vulnerability, and median days to patch.
• Legacy protocols: devices still answering on Telnet, SNMPv1 or v2c, or storing weak password types.
• SIM change integrity: fraudulent SIM changes and port-outs per 100,000 subscribers, and the share of changes on locked or high-risk accounts that went through step-up checks.
• Agent anomalies: number of care or retail agents flagged for unusual change volumes, and median time to review.

Framework mapping

For sector regulation see the Telecoms Security Laws Map and the UK Telecommunications Security Act Guide.

Common failure patterns

• Treating routers as plumbing: edge and core devices sit outside endpoint detection and vulnerability programmes, so a compromised device can go unnoticed for years.
• AAA tied to the corporate directory: one stolen corporate credential then reaches network devices. The December 2024 joint hardening guidance asks for a separate AAA service with MFA.
• Configurations trusted from the device: without a central authoritative copy, an actor's access list entry looks like any other line.
• Knowledge-based checks in care: date of birth, address or recent payment details are easy to obtain and the FCC rule says they do not count as secure authentication.
• No insider view of retail: agents with change rights are not monitored for volume or pattern, so a paid insider can work for months.
• Lawful intercept managed as ordinary IT: shared administrator accounts and broad access to mediation systems turn an intrusion into a counter-intelligence loss.

Practitioner checklist

• Map the actor table above to your own network, care and retail estate and record which paths apply.
• Check every internet-facing network device against the CISA KEV catalogue and patch or isolate within your agreed window.
• Hunt for unknown TACACS+ servers, tunnels, mirror sessions and access list entries before major hardening work.
• Move device management out of band, separate AAA from the corporate directory and require phishing-resistant MFA for administrators.
• Disable SNMPv1 and v2c, Telnet and HTTP management; replace weak stored password types.
• Require secure authentication and step-up approval for SIM change and port-out, with free account locks for all customers.
• Monitor care and retail agents for unusual change volumes and investigate within one working day (our recommended target).
• Put lawful intercept, mediation, call record and AAA systems in tier zero with separate administrators.
• Subscribe to sector advisories and review detection coverage against each new one.

Standards and references

• NSA, CISA, FBI and partners: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (AA25-239A)
• CISA and partners: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
• FBI and CISA: Joint Statement on PRC Targeting of Commercial Telecommunications Infrastructure
• CISA: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
• Cyber Safety Review Board: Review of the Attacks Associated with Lapsus$ and Related Threat Groups
• Federal Register: Protecting Consumers From SIM-Swap and Port-Out Fraud
• US Department of the Treasury: Sanctions on Sichuan Juxinhe Network Technology for Salt Typhoon
• MITRE ATT&CK: GALLIUM (G0093)

Related NHI Mgmt Group resources: Telecom Network Security Guide · Telecoms Identity Security Guide · SIM Swap Response Playbook · Threat Actor Groups Guide