Most telecom threat actors pick a protocol generation and stay there. Salt Typhoon went after management-plane routers. LightBasin lived entirely inside the GRX roaming fabric. Liminal Panda did something rarer: it worked both legacy SS7 and its supposed successor, Diameter, against the same class of target — carriers across South-East Asia and Africa — for more than four years before CrowdStrike's November 2024 disclosure named the operation.
That dual-protocol targeting is the story here. The industry narrative around 4G/LTE was that Diameter's TLS-capable, IPsec-ready design would retire the interconnect trust problem that made SS7 abuse possible. Liminal Panda's operational history is a direct rebuttal: an actor with deep signaling expertise did not need to choose one protocol over the other, because both still grant the same thing to whoever holds a trusted interconnect position — unauthenticated access to subscriber location, call detail records, and SMS content. Neither protocol generation solved the underlying problem; the actor simply carried the same tradecraft across the migration.
This profile documents what CrowdStrike's public reporting establishes: the actor's origin and timeline, why targeting both SS7 MAP and Diameter S6a/SLh in parallel matters operationally, the kill-chain phases that are actually documented (several are not — that gap is reported honestly rather than padded), the SEABESQUE / MESSAGETAP / GPSMEX toolset, the ATT&CK/FiGHT technique mapping, and the standards gap — GSMA FS.11 and IR.83 controls that were not deployed at the affected carriers.
This report profiles Liminal Panda, a China-nexus, telecom-specialist threat actor first disclosed by CrowdStrike in November 2024. Active since at least 2020, the actor exploited both SS7 and Diameter roaming interconnects to harvest CDR metadata, subscriber location, and SMS content from carriers in South-East Asia and Africa, sustaining access for more than four years without any confirmed CVE dependency.
I. Attribution and Timeline
CrowdStrike assesses Liminal Panda as a China-nexus actor (assessed, not formally attributed at the nation-state level the way Salt Typhoon or Volt Typhoon have been). The classification in CrowdStrike's registry is explicit: SS7 / Diameter APT — a designation earned by the actor's operational focus rather than a broad "telecom-targeting" label.
| Field | Detail |
|---|---|
| First observed activity | 2020 |
| Public disclosure | November 2024 (CrowdStrike) |
| Assessed dwell time | 4+ years |
| Targets | Telecom operators in South-East Asia and Africa |
| Entry vector | Telecom interconnect exploitation — SS7 and Diameter |
| Movement layer | SS7 and Diameter roaming interfaces |
| Collection | CDR metadata, subscriber location, SMS interception |
| CVE dependency | None confirmed — protocol-layer abuse of legitimate signaling operations |
The four-year gap between first activity and disclosure places Liminal Panda in the same dwell-time bracket as LightBasin (~5 years) rather than the shorter operational windows seen in router-exploit campaigns like Salt Typhoon (~12 months). That pattern is consistent across telecom-specialist actors generally: signaling-plane abuse produces none of the artifacts enterprise security tooling is built to catch, so detection depends entirely on the carrier's own SS7/Diameter monitoring — which, per the standards gap below, was not in place at the targeted operators.
II. Why Dual-Protocol Targeting Matters
The significance of Liminal Panda's profile isn't any single technique — it's the choice to maintain tradecraft on two signaling generations simultaneously. Side by side, the two interfaces the actor abused return functionally identical categories of subscriber data through structurally identical trust failures:
| SS7 MAP | Diameter S6a / SLh | |
|---|---|---|
| Core network element queried | HLR (Home Location Register) | HSS (Home Subscriber Server) |
| Trust model | Any Global Title routable to the HLR is treated as a legitimate SMSC/VLR peer | Peer authenticated at the realm level (Destination-Realm), not per-MME identity |
| Location disclosure | Serving MSC/VLR address via SRI-for-SM, refined via ATI | Serving-Node (MME) AVP via Update-Location-Answer |
| Subscriber identity leak | IMSI | MSISDN, full subscription profile |
| Content interception path | UpdateLocation re-registration → SMS redirection | SLh/S6a location + signaling metadata correlated with SMS capture at the carrier |
| Governing standard | GSMA FS.11 (SS7 interconnect filtering) | GSMA FS.19 / IR.83 (Diameter interconnect security) |
The practical consequence is that an actor with SS7 tradecraft did not need to develop an entirely new operational discipline to work Diameter — the object of interest (serving-node address, subscriber identifier, CDR/SMS content) is the same, and the interconnect trust failure that exposes it is architecturally the same, just carried by a newer transport. Our SRI-for-SM case study and Diameter ULR case study each document one half of this picture in isolation; Liminal Panda is the documented case of an actor running both halves against the same target class concurrently.
III. The Kill Chain — Documented Phases Only
CrowdStrike's public profile does not establish every phase of the Lockheed Martin seven-phase kill chain for this actor. Five phases are documented: reconnaissance, delivery, exploitation, installation, and actions on objectives. Weaponization and command-and-control tradecraft were not confirmed in the disclosed reporting. That is reported here as-is — a documented gap, not an implied absence of activity CrowdStrike simply chose not to describe.
| Phase | What's documented |
|---|---|
| Reconnaissance | SS7 and Diameter reconnaissance of roaming interconnects to map the target operator's signaling architecture — both protocol surfaces probed in the same reconnaissance effort |
| Delivery | Access obtained via telecom roaming trust relationships (T1078 Valid Accounts) — no corporate network entry point required |
| Exploitation | SS7 MAP queries and Diameter SLh/S6a queries used interchangeably to pull subscriber location, CDR data, and SMS content |
| Installation | MESSAGETAP deployed directly on SS7 infrastructure for passive SMS/CDR capture at the carrier level |
| Actions on objectives | Subscriber tracking, SMS interception targeting high-value individuals, CDR graph analysis |
| Weaponization | Not documented in the public profile |
| C2 | Not documented in the public profile |
That gap is itself informative. Actors like Salt Typhoon and GALLIUM left C2 channel details in the record because their campaigns crossed IP-based management infrastructure where C2 beaconing is observable. Liminal Panda's core operations sat inside SS7/Diameter signaling paths, where "command and control" in the conventional IT sense may not even apply the same way — MESSAGETAP-class tooling installed on carrier signaling infrastructure can operate as a passive collector that exfiltrates on its own schedule rather than checking in to a remote controller, which would explain why no C2 channel is documented without requiring one to have existed unobserved.
IV. The Toolset
Three tools are named in the CrowdStrike profile: SEABESQUE, MESSAGETAP, and GPSMEX.
MESSAGETAP is the best-characterized of the three in public reporting generally — it is a passive SMS/CDR interception tool designed to run on SS7-adjacent signaling infrastructure (SMSC or STP-adjacent hosts) and selectively capture message traffic matching operator-defined criteria (phone numbers, IMSIs, or keyword content), while discarding everything else to keep collection targeted and disk usage low. In Liminal Panda's kill chain it is the tool documented at the installation phase — deployed directly on carrier SS7 infrastructure for passive SMS and CDR capture rather than being pulled through live interconnect queries each time.
SEABESQUE and GPSMEX are named in CrowdStrike's profile as part of the same toolset but without granular per-tool technical breakdowns in the publicly available reporting. Consistent with the actor's documented collection categories — CDR metadata, subscriber location, and SMS interception — GPSMEX's naming is consistent with a location-collection role, though CrowdStrike's disclosure does not confirm exact functionality for either tool beyond their presence in the actor's kit. This profile does not speculate beyond what's public; treat SEABESQUE and GPSMEX as confirmed components of the Liminal Panda toolkit whose detailed mechanics have not been made public.
| Tool | Documented role |
|---|---|
| MESSAGETAP | Passive SMS/CDR capture deployed directly on SS7 infrastructure — installation-phase persistence |
| SEABESQUE | Named component of the toolset; detailed function not disclosed publicly |
| GPSMEX | Named component of the toolset; naming consistent with the actor's location-collection focus, function not disclosed publicly |
V. ATT&CK / FiGHT Technique Mapping
| TTP ID | Name | Tactic | Framework |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | MITRE ATT&CK |
| FGT5013 | SS7 Network Exploitation | Fight (5G/SS7) | MITRE FiGHT |
| FGT5006 | Diameter Network Exploit | Fight (5G/SS7) | MITRE FiGHT |
| T1040 | Network Sniffing | Credential Access | MITRE ATT&CK |
| T1071 | Application Layer Protocol | Command and Control | MITRE ATT&CK |
| T1560 | Archive Collected Data | Collection | MITRE ATT&CK |
The presence of both FGT5013 (SS7) and FGT5006 (Diameter) against a single actor entry is itself unusual in the telecom threat landscape — most documented actors, including LightBasin and APT41, map cleanly to one signaling generation. Liminal Panda's technique mapping is the clearest public evidence that a single, sufficiently telecom-specialized actor can carry FiGHT-mapped tradecraft across a full protocol migration rather than needing to be rebuilt for it.
VI. The Standards Gap
CrowdStrike's profile attributes the exposure to a straightforward deployment gap: GSMA FS.11 SS7 filtering and IR.83 Diameter interconnect guidance were not deployed at the affected carriers. This is the same conclusion reached independently in our SRI-for-SM and Diameter ULR case studies — the controls that stop this entire class of attack have existed as GSMA guidance for years. What Liminal Panda's dual-protocol profile adds is proof that partial deployment doesn't help: an operator that filters SS7 SRI-for-SM/ATI at the STP but leaves Diameter S6a peer validation on realm-matching alone has closed one door and left the structurally identical one next to it wide open.
GSMA FS.11 (SS7): SMS Home Routing to prevent IMSI/serving-node disclosure via SRI-for-SM, SCCP Global Title allowlisting at the STP, and unconditional blocking of AnyTimeInterrogation/ProvideSubscriberInfo from external Global Titles.
GSMA IR.83 / FS.19 (Diameter): Mutual TLS with certificate-to-MME binding on every S6a peer session, an HSS-side MME whitelist that rejects unregistered Origin-Hosts, and Diameter Edge Agent inspection at the IPX boundary rejecting traffic from Origin-Realms without an active bilateral roaming agreement.
The operational point Liminal Panda's dual-protocol profile forces: SS7 and Diameter interconnect security cannot be treated as two separate compliance projects run on different timelines. An actor already positioned on the interconnect will simply use whichever protocol is unprotected. Both control sets need to be live at the same carrier, at the same time, for either one to actually close the exposure.
| Interconnect | Control | Status at affected carriers (per CrowdStrike) |
|---|---|---|
| SS7 | GSMA FS.11 Category 1 filtering | Not deployed |
| Diameter | GSMA IR.83 / FS.19 peer validation | Not deployed |
| Both | Correlated cross-protocol signaling monitoring | No evidence of detection prior to CrowdStrike's investigation |
VII. Frequently Asked Questions
No. CrowdStrike's classification is "China-nexus (assessed)" — an analytic assessment based on tradecraft, targeting, and infrastructure overlap, not a formal government attribution of the kind issued for Salt Typhoon or Volt Typhoon by US agencies. Treat the China-nexus label as CrowdStrike's confidence-graded judgment rather than a confirmed state attribution.
No confirmed CVE dependency is documented. Like LightBasin, the actor's access and collection relied on abusing legitimate SS7 MAP and Diameter S6a/SLh operations exactly as they're specified — the exposure is a trust-model gap in the protocols and their deployment, not a patchable software flaw.
CrowdStrike's disclosed reporting establishes reconnaissance, delivery, exploitation, installation, and actions on objectives, but does not confirm specific weaponization or command-and-control tradecraft for this actor. That may reflect a genuine reporting gap in what CrowdStrike chose to disclose, or it may reflect that MESSAGETAP-class passive collection on signaling infrastructure doesn't require an IT-style beaconing C2 channel to exfiltrate. Either way, this profile reports the documented five phases rather than inferring the other two.
MESSAGETAP has been documented in more than one actor's toolkit — Mandiant's original research associated it with APT41 activity, and CrowdStrike's Liminal Panda profile documents it again in a distinct campaign. The tool's function (passive SS7-adjacent SMS/CDR capture) is consistent across both; what differs is the surrounding campaign — Liminal Panda's is a sustained, telecom-specialist operation against SE Asia/Africa carriers using both SS7 and Diameter, while APT41 is a broader dual-mission (espionage plus financial crime) actor for whom MESSAGETAP is one tool among a wider, non-telecom-exclusive kit.
Only if the SS7 interworking function is fully retired and Diameter/5G SBA interfaces are hardened per GSMA IR.83/FS.19 and 3GPP SEPP requirements — neither of which was true at Liminal Panda's targeted carriers. Partial migration that leaves SS7 reachable for legacy roaming, or that deploys Diameter without mutual TLS and MME whitelisting, simply gives a sufficiently capable actor a second protocol to use, which is exactly the pattern this campaign demonstrates.
Conclusion
Liminal Panda's four-year run is not remarkable because of a novel technique — every message class it abused (SS7 MAP location lookups, Diameter S6a/SLh queries, passive SMS/CDR capture) is separately documented elsewhere on this site. It's remarkable because it is public, attributed evidence that a sufficiently specialized actor treats the SS7-to-Diameter migration as a non-event: the trust gap moved, the actor moved with it, and the standards that would have stopped both — GSMA FS.11 and IR.83 — were absent at the same carriers for years at a time.
TelcoSec's signaling security assessments test SS7 and Diameter interconnect controls together, not as separate line items, precisely because actors like Liminal Panda don't respect that separation either.
