Thirteen mobile network operators, across six regions, for approximately five years — and not one of them found the intrusion through their own security stack. LightBasin, tracked publicly as UNC1945, never phished an employee, never dropped a payload on a corporate laptop, and never once tripped an enterprise EDR alert. It didn't need to. It lived one layer below where enterprise security tooling looks at all: inside the GPRS Roaming Exchange (GRX), the private interconnect fabric mobile operators use to hand off subscriber data traffic to each other while roaming.
This is what makes LightBasin worth studying in detail, beyond its unusual dwell time. It is one of the most complete public case studies of an actor treating the signaling plane — not the IT network — as the primary operating environment. Every stage of its intrusion lifecycle, from reconnaissance to command-and-control, was purpose-built for SIGTRAN, GTP, and the GRX trust model, and every one of those choices is why it took roughly five years and an external responder to find it.
This report reconstructs the LightBasin (UNC1945) intrusion set first disclosed by CrowdStrike in October 2021: a signaling-plane APT, assessed with a Chinese nexus, that maintained access inside at least 13 telecommunications operators across six regions for approximately five years by entering through the GRX roaming fabric rather than the corporate network. We walk the full Lockheed Martin 7-phase kill chain using the actor's actual toolset, map every documented technique to MITRE ATT&CK and FiGHT, and explain the specific GSMA standards-enforcement gap — FS.11 and IR.82 left unenforced at the GRX boundary — that this case exploited from end to end.
I. Who Is LightBasin, and Why Did It Take Five Years to Find?
CrowdStrike's Intelligence team disclosed LightBasin (tracked internally as UNC1945) in October 2021, following incident response engagements across a cluster of telecommunications operators that had nothing obviously in common except one thing: every environment showed evidence of unauthorized access dating back years, entirely through infrastructure that sat outside the scope of standard enterprise security monitoring.
The profile that emerged:
| Attribute | Finding |
|---|---|
| Origin | Chinese-nexus (assessed) — moderate-confidence attribution, no formal state indictment |
| Classification | Signaling-plane APT |
| First observed activity | 2016 |
| Public disclosure | October 2021 (CrowdStrike) |
| Dwell time | ~5 years |
| Confirmed footprint | 13 carriers across 6 regions |
| Entry vector | SSH key reuse via the GRX roaming fabric |
| Lateral movement layer | GPRS/GTP OT VLANs + SS7/SIGTRAN |
| Collection focus | Subscriber location, authentication vectors, SMSC metadata |
The five-year gap between first activity and disclosure is the headline finding, but it isn't the interesting part on its own — plenty of APTs achieve multi-year dwell times against enterprise IT. What makes LightBasin distinct is where that dwell time happened. GPRS and SIGTRAN infrastructure sits in an operational-technology (OT) zone most carriers don't instrument the way they instrument corporate IT: no EDR agents on SS7 signal transfer points, no SIEM ingestion from SGSN GTP interfaces, and — critically — no assumption that a roaming partner's SSH key might belong to someone else.
II. The Entry Vector: SSH Key Reuse and the GRX Trust Assumption
The GPRS Roaming Exchange is a private IP backbone, physically and logically separate from the public internet, that lets mobile operators exchange GPRS/GTP roaming traffic without routing subscriber data across untrusted transit. It exists because the alternative — every operator building bilateral IPsec tunnels to every roaming partner — doesn't scale. A handful of GRX/IPX providers sit in the middle, and every connected operator implicitly trusts every other connected operator's equipment as a legitimate telecom peer.
LightBasin's initial access technique — T1078 Valid Accounts — exploited exactly that assumption. The actor obtained and reused SSH keys on GRX-connected GPRS infrastructure, which is architecturally treated as a closed circle of telecom operators, not as internet-facing attack surface requiring the same credential hygiene as a corporate VPN gateway. Once inside one operator's GPRS-adjacent host with a valid key, the roaming fabric itself became the lateral movement path to the next operator — no additional exploit required, because GRX by design routes GTP and SIGTRAN traffic between all connected carriers.
┌──────────────────────────────────────────────────────────────────────┐
│ THE GRX TRUST ASSUMPTION │
│ │
│ [Carrier A GPRS Host] ── SSH (reused key) ──▶ [GRX Backbone] │
│ │ │
│ trusted peer ◀────┴────▶ trusted │
│ relationship peer │
│ │ │ │
│ [Carrier B] [Carrier C] │
│ ...11 more operators, same fabric │
└──────────────────────────────────────────────────────────────────────┘
III. The Kill Chain: A Phase-by-Phase Reconstruction
CrowdStrike's reporting, mapped here against the Lockheed Martin 7-phase model, shows an actor that engineered every phase specifically for the constraints of telecom OT infrastructure — SIGTRAN and GTP protocol awareness, not generic enterprise tradecraft.
Phase 1 — Reconnaissance
SCTP and M3UA port scanning across GRX roaming interconnects using CordScan, paired with SS7 Global Title enumeration through SIGTRANslator. This is protocol-native reconnaissance: standard IT port scanners don't parse M3UA/SCTP session state or resolve SS7 Global Titles, so this phase required tooling built specifically for signaling infrastructure.
Techniques: FGT5030 Signaling Network Recon, T1046 Network Service Discovery
Phase 2 — Weaponization
A custom SIGTRAN-aware toolchain built around the operational constraints of telecom OT VLANs — segmented, low-bandwidth, closely monitored for anomalies only at the protocol layer, not the host layer. No CVE dependency anywhere in the chain; every capability operates against protocol-layer trust rather than a software flaw.
Techniques: FGT5013 SS7 Network Exploitation, FGT5019 GTP Network Exploitation
Phase 3 — Delivery
Entry via SSH key reuse on GRX-connected GPRS infrastructure. The roaming partner relationship itself is the delivery mechanism — no email, no watering-hole site, no supply-chain compromise. The "delivery" is simply presenting a valid (stolen or reused) credential to infrastructure engineered to trust it.
Techniques: T1078 Valid Accounts
Phase 4 — Exploitation
SS7 MAP SendRoutingInfoForSM-class queries to extract subscriber location directly from the HLR, paired with SendAuthenticationInfo queries to harvest authentication vectors. The latter is the more consequential of the two: authentication vectors (RAND/SRES/Kc triplets or Milenage quintets, depending on generation) captured in bulk enable retrospective decryption of previously recorded GSM traffic — turning historical passive intercept into readable communications long after the fact.
Techniques: FGT5013 SS7 Network Exploitation, T1040 Network Sniffing
Phase 5 — Installation
Three implants doing three different jobs. sDNS masqueraded as SGSN eDNS traffic to establish the persistence that ultimately spanned five years — DNS-shaped traffic on a GPRS host draws none of the scrutiny a raw reverse shell would. TinyShell provided a lightweight reverse-shell fallback. PDPlugin operated as a loader specifically on GPRS hosts, positioned to survive resets of the packet-data infrastructure it lived alongside.
Techniques: T1098 Account Manipulation, T1071.004 Application Layer Protocol: DNS
Phase 6 — Command and Control
Two covert channels, both engineered to be indistinguishable from legitimate GPRS-adjacent traffic at a casual glance: PingPong, tasking operators via command/response payloads riding inside ICMP echo requests, and a DNS tunnel through sDNS. Neither channel resembles the HTTPS beaconing that most network detection is tuned to catch — both hide in protocols carriers already treat as background noise on OT VLANs.
Techniques: T1071.004 Application Layer Protocol: DNS
Phase 7 — Actions on Objectives
Mass SS7 location tracking across the full footprint, authentication-vector harvesting at scale (enabling the retrospective GSM decryption noted above), and SMSC metadata collection — repeated across all 13 confirmed operators.
Techniques: T1560 Archive Collected Data, FGT5019 GTP Network Exploitation
IV. The Toolset: Purpose-Built for the Signaling Plane
Unlike enterprise-IT-focused APTs that reach for widely available offensive frameworks, LightBasin's toolkit was custom-engineered around SIGTRAN and GTP:
| Tool | Function |
|---|---|
| SIGTRANslator | SS7 Global Title enumeration and SIGTRAN protocol translation — reconnaissance-phase mapping of target signaling topology |
| CordScan | SCTP/M3UA port and session scanner purpose-built for GRX roaming interconnects |
| sDNS | DNS-tunneling implant masquerading as SGSN eDNS traffic; the primary persistence and C2 mechanism behind the 5-year dwell time |
| PingPong | ICMP-based C2 channel — operator tasking and responses carried in echo-request/echo-reply payloads |
| TinyShell | Lightweight reverse-shell backdoor used as an installation-phase fallback |
| PDPlugin | Loader deployed specifically on GPRS hosts, positioned alongside packet-data infrastructure |
| LightBasin Tunneler | Tunneling utility supporting pivoting across the GRX fabric between operator environments |
The common thread across all seven tools is that none of them look out of place to a GTP or SIGTRAN protocol analyzer glancing at traffic shape alone — DNS queries, ICMP echoes, and SCTP sessions are exactly what a GPRS/SGSN environment is expected to carry. That is the entire point.
V. ATT&CK / FiGHT Technique Mapping
| Technique ID | Name | Tactic |
|---|---|---|
| T1078 | Valid Accounts | Initial Access |
| FGT5030 | Signaling Network Recon | FiGHT (5G/SS7) |
| T1046 | Network Service Discovery | Discovery |
| FGT5013 | SS7 Network Exploitation | FiGHT (5G/SS7) |
| FGT5019 | GTP Network Exploitation | FiGHT (5G/SS7) |
| T1040 | Network Sniffing | Credential Access |
| T1098 | Account Manipulation | Persistence |
| T1071.004 | Application Layer Protocol: DNS | Command and Control |
| T1560 | Archive Collected Data | Collection |
Three of these nine techniques (FGT5013, FGT5019, FGT5030) are FiGHT telecom-specific techniques with no ATT&CK equivalent — a direct reflection of how much of LightBasin's tradecraft has no enterprise-IT analog at all. Any SOC mapping this actor purely against standard ATT&CK coverage will miss a third of the kill chain.
VI. The Standards Gap: FS.11 and IR.82 Left Unenforced at the GRX Boundary
GSMA has published the controls that would have stopped this intrusion for years. FS.11 (SS7 Interconnect Security Monitoring Guidelines) defines SCCP Global Title screening and anomaly detection for signaling traffic. IR.82 (SS7 and SIGTRAN Network Security) extends that guidance specifically to the SIGTRAN transport layer LightBasin operated in — M3UA, SCTP, and the GRX-adjacent infrastructure that carried its C2 and reconnaissance traffic.
Neither standard is exotic or new. Both predate LightBasin's first observed activity in 2016. The gap this case exposes isn't a missing specification — it's that GRX interconnects, treated as closed circles of mutually trusting telecom operators, frequently have IR.82-class SIGTRAN monitoring and FS.11-class GT screening either absent or unenforced at the actual interconnect boundary. An operator can be fully FS.11-compliant on its SS7-facing HLR interfaces and still have zero visibility into SSH access, M3UA session anomalies, or SCTP scanning on the GRX-facing GPRS hosts LightBasin used as its foothold — because that infrastructure sits in a documentation and ownership gray zone between the network operations team and the security team.
SSH credential hygiene on GRX-facing infrastructure: Treat every SSH key on GPRS/GRX-connected hosts as if it were internet-facing — because functionally, across the roaming fabric, it is. Rotate on a defined schedule, enforce per-host keys, and alert on any key reused across more than one GRX-adjacent system.
SIGTRAN/SCTP session monitoring (IR.82): Deploy anomaly detection on M3UA and SCTP sessions traversing GRX interconnects — unexplained new sessions, scanning patterns consistent with CordScan-class tooling, and session establishment from GTs outside the confirmed roaming partner list.
DNS and ICMP baseline anomaly detection on OT VLANs: sDNS and PingPong both succeeded by hiding inside protocols nobody was baselining on GPRS/SGSN segments. Establish a traffic-volume and query-pattern baseline for DNS and ICMP on every OT VLAN, and alert on deviation — not just on known-bad signatures.
Authentication-vector query rate limiting: Bulk SendAuthenticationInfo queries at a volume consistent with mass harvesting (rather than legitimate per-subscriber authentication) should trigger an FS.11 Category 2 signaling-firewall alert, independent of the requesting GT's apparent legitimacy.
VII. Frequently Asked Questions
CrowdStrike assessed a Chinese nexus with moderate confidence based on tooling, targeting pattern, and infrastructure overlaps, but there has been no formal government indictment or state attribution comparable to, for example, the US DOJ's APT41 indictment. "Chinese-nexus (assessed)" reflects that confidence level rather than a confirmed state actor designation.
Because the entire intrusion lifecycle ran on GRX/GPRS/SIGTRAN infrastructure that sits outside standard enterprise security tooling. There were no EDR agents on the affected hosts, no SIEM correlation rules covering SCTP/M3UA session anomalies, and no assumption that SSH keys used between roaming partners needed the same scrutiny as a corporate VPN. The tooling (sDNS, PingPong) was also specifically designed to resemble ordinary DNS and ICMP traffic on those segments.
The specific SSH key reuse LightBasin exploited is an operational failure, not a permanent architectural flaw — it is fixable with credential hygiene and IR.82-class SIGTRAN monitoring. However, the underlying trust model — GRX-connected operators implicitly trusting each other's infrastructure as legitimate telecom peers — has not fundamentally changed industry-wide, and audits continue to find inconsistent enforcement of FS.11/IR.82 controls at GRX boundaries. See the SS7 SRI-for-SM case study for a related example of a standards-exists-but-isn't-enforced gap on the SS7 side of the same trust model.
The collection focus documented in CrowdStrike's reporting — subscriber location tracking, authentication-vector harvesting, and SMSC metadata — points to signals-intelligence-style collection rather than financial fraud. Authentication vectors in particular have a specific downstream use: they enable retrospective decryption of GSM traffic that may already have been passively intercepted and stored, meaning the value of this access extended backward in time, not just forward.
LightBasin and Salt Typhoon target the same industry from opposite ends of the network. LightBasin lived entirely in the signaling/GRX plane and never touched enterprise IT. Salt Typhoon, disclosed in 2024, entered through a management-plane vulnerability (an unpatched edge router) and pivoted through a flat IP credential domain to reach CALEA lawful-intercept systems. Both demonstrate that carriers' most consequential exposure often sits in infrastructure — signaling fabric, management VLANs — that falls outside standard enterprise security coverage. See our telecom penetration testing methodology for how a systematic assessment covers both attack surfaces.
Conclusion
LightBasin's five-year run inside 13 carriers is not a story about a sophisticated zero-day or a novel exploitation primitive — there is no CVE anywhere in this case. It is a story about an actor that correctly identified where telecom security investment stops: at the edge of the GRX roaming fabric, where an SSH key handed between trusted operators is treated as settled business rather than a credential requiring the same scrutiny as an internet-facing login. Every tool in its kit — SIGTRANslator, CordScan, sDNS, PingPong, TinyShell, PDPlugin, LightBasin Tunneler — exists to exploit that one assumption at every phase of the kill chain.
TelcoSec's assessments specifically test the GRX/GPRS and SIGTRAN boundary this case exploited — SSH credential hygiene on roaming-facing infrastructure, IR.82 SIGTRAN session monitoring, and FS.11 GT/SCCP screening — against your live interconnects, not just your enterprise perimeter.
