https://telcosec.net/ https://telcosec.net/5g-network-security-architecture/ 2026-05-15 https://telcosec.net/images/articles/5g-architecture-hero.webp 5G Network Security Architecture TelcoSec's 5G security architecture deep dive: SBA vulnerabilities, SEPP protection proxies, SUCI encryption, and cloud-native telecom security threat modeling. https://telcosec.net/5g-network-slicing-security/ 2026-05-15 https://telcosec.net/images/articles/network-slicing-hero.webp 5G Network Slicing Security TelcoSec 5G network slicing security risks in Standalone architecture — cross-slice isolation failures, shared NF abuse, RAN starvation, and Kubernetes threats. https://telcosec.net/5g-nrf-oauth2-token-abuse/ 2026-07-04 https://telcosec.net/images/articles/5g-sba-architecture-diagram.webp 5G SBA NRF OAuth2 Token Abuse and NF Impersonation How rogue NFs abuse missing NF Instance ID binding in NRF OAuth2 token issuance to impersonate AMF/UDM and exfiltrate 5G core subscriber data. https://telcosec.net/5g-sepp-n32-roaming-bypass/ 2026-07-04 https://telcosec.net/images/articles/5g-architecture-hero.webp 5G SEPP N32 Roaming Interface Security Bypass How SEPP N32-c capability negotiation can be downgraded to unencrypted N32-f, letting IPX-positioned adversaries intercept roaming SBI traffic in plaintext. https://telcosec.net/5g-suci-null-scheme-supi-exposure/ 2026-07-04 https://telcosec.net/images/articles/stingray-hero.webp 5G SUCI Null-Scheme Attacks: The IMSI Catcher Evolution How misconfigured 5G SUCI null-scheme fallback negates subscriber identity concealment, letting rogue gNBs harvest SUPI in plaintext and revive IMSI-catcher tracking. https://telcosec.net/10-telecom-threat-intelligence-resources-for-mno-soc/ 2026-05-18 https://telcosec.net/images/articles/telecom-threat-intel-hero.webp 10 Threat Intelligence Resources for MNO SOC Teams TelcoSec-curated telecom threat intelligence resources for MNO SOC teams — 10 evaluated feeds covering SS7, Diameter, GTP anomaly detection, and subscriber tracking alerts. https://telcosec.net/about/ https://telcosec.net/acceptable-use/ https://telcosec.net/apt41-double-dragon-telecom-billing-fraud/ 2026-07-04 https://telcosec.net/images/articles/telecom-threat-intel-hero.webp APT41 (Double Dragon): When State Espionage Meets Telecom Billing Fraud APT41/Double Dragon runs Beijing-directed espionage and for-profit cybercrime from the same toolset — telecom OSS/BSS billing systems are the crossover point. https://telcosec.net/articles/ https://telcosec.net/baseband-exploitation-modern-smartphones/ 2026-05-15 https://telcosec.net/images/articles/baseband-exploitation-hero.webp Baseband Exploitation in Modern Smartphones TelcoSec research on smartphone baseband exploitation: attack surfaces, Shannon/MediaTek firmware analysis, OTA fuzzing methods, and zero-click vulnerabilities. https://telcosec.net/categories/ https://telcosec.net/contact/ https://telcosec.net/editorial-guidelines/ https://telcosec.net/gallium-soft-cell-telecom-apt/ 2026-07-04 https://telcosec.net/images/articles/5g-architecture-hero.webp GALLIUM (Operation Soft Cell): 7 Years Inside 10 Global Carriers GALLIUM/Soft Cell pivoted from enterprise IT into telecom management infrastructure, harvesting CDR and AD data from 10 carriers across 30+ countries for 7+ years. https://telcosec.net/glossary/ https://telcosec.net/imsi-catchers-and-rogue-base-stations/ 2026-05-15 https://telcosec.net/images/articles/stingray-hero.webp IMSI Catchers and Rogue Base Stations TelcoSec IMSI catcher and rogue base station analysis across 2G-5G: passive identity collection, MitM interception, downgrade attacks, and detection techniques. https://telcosec.net/mission/ https://telcosec.net/mitre-fight-telecom-attack-vector-index/ 2026-07-04 https://telcosec.net/images/articles/5g-architecture-hero.webp MITRE FiGHT for Telecom: A Field Guide to 5G Attack Techniques A field guide to the MITRE FiGHT framework's technique taxonomy across UE, RAN, O-RAN, 5G core, signaling, and physical telecom attack surfaces. https://telcosec.net/mobile-network-evolution-3gpp-releases/ 2026-05-15 https://telcosec.net/images/articles/3gpp-evolution-hero.webp Mobile Network Evolution: Understanding 3GPP Releases TelcoSec guide to 3GPP security standards and cellular network evolution from 2G to 5G Advanced: security milestones, authentication, and hardening implications. https://telcosec.net/muddywater-telecom-espionage/ 2026-07-04 https://telcosec.net/images/articles/5g-architecture-hero.webp MuddyWater: Iran's Long-Running Telecom Espionage Campaign MuddyWater (MERCURY) is an Iranian MOIS-linked APT running ongoing spearphishing and VPN-exploitation espionage against Middle East telecom operators. https://telcosec.net/privacy/ https://telcosec.net/projects/ https://telcosec.net/ran-wireless-security-assessment-methodology/ 2026-07-04 https://telcosec.net/images/articles/ran-air-interface-hero.webp RAN & Wireless Security Assessment: A Practical Methodology Hands-on RAN/wireless security assessment methodology: SDR lab setup, 2G-5G air interface capture, X2/Xn/fronthaul testing, and rogue BTS detection. https://telcosec.net/salt-typhoon-telecom-apt/ 2026-07-04 https://telcosec.net/images/articles/telecom-threat-intel-hero.webp Salt Typhoon: Inside the Breach That Compromised US Carrier Wiretap Systems How a PRC state-sponsored actor exploited an unpatched Cisco IOS-XE router (CVSS 10.0) to reach CALEA lawful-intercept systems inside US carriers. https://telcosec.net/sandworm-telecom-destructive-attacks/ 2026-07-04 https://telcosec.net/images/articles/5g-architecture-hero.webp Sandworm: The GRU Unit Behind NotPetya Targets Telecom as a Weapon How GRU Unit 74455's Sandworm turns telecom infrastructure into a disruption force multiplier — from Ukraine grid blackouts to NotPetya and beyond. https://telcosec.net/services/ https://telcosec.net/setting-up-private-lte-5g-lab/ 2026-05-15 https://telcosec.net/images/articles/private-lab-hero.webp Setting up a Private LTE/5G Environment TelcoSec private 5G security research lab setup: USRP B210 hardware, Open5GS, srsRAN, Faraday cage requirements, and RF legal compliance step-by-step guide. https://telcosec.net/signaling/ https://telcosec.net/sim-cloning-and-sim-swap-attacks/ 2026-05-15 https://telcosec.net/images/articles/sim-card-hero.webp SIM Cloning and SIM Swap Attacks TelcoSec SIM cloning and SIM swap attack analysis: physical cloning, SIMjacker remote exploitation, eSIM provisioning risks, and iSIM security architecture. https://telcosec.net/sitemap/ https://telcosec.net/telco-vs-computer-networks/ 2026-05-15 https://telcosec.net/images/articles/telco-computer-convergence-hero.webp Telco vs Computer Networks: Architecture & Convergence TelcoSec: telecom vs computer networks — architectural differences, 5G convergence security, and the cross-domain attack surfaces of modern telco. https://telcosec.net/telecom-osint-reconnaissance-methodology/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp Telecom OSINT: A Reconnaissance Methodology for Carrier Infrastructure A 4-phase OSINT methodology for mapping carrier PLMN, SS7/Diameter, and 5G core infrastructure using only public sources — no active exploitation. https://telcosec.net/telecom-penetration-testing-methodologies/ 2026-05-15 https://telcosec.net/images/articles/telecom-pentest-hero.webp Methodology: Telecom Penetration Testing Lifecycle TelcoSec telecom penetration testing lifecycle: SS7/Diameter exploitation, RAN attacks, 5G core vectors, and MITRE FiGHT framework mapping. https://telcosec.net/telecom-threat-actor-tracking-framework/ 2026-07-04 https://telcosec.net/images/articles/telecom-threat-intel-hero.webp How We Track Telecom Threat Actors: MITRE ATT&CK, FiGHT, and the Kill Chain The combined ATT&CK, MITRE FiGHT, and Lockheed Martin kill-chain framework TelcoSec uses to analyze and compare telecom-targeting APTs. https://telcosec.net/terms/ https://telcosec.net/volt-typhoon-critical-infrastructure-prepositioning/ 2026-07-04 https://telcosec.net/images/articles/5g-architecture-hero.webp Volt Typhoon: Pre-Positioning for Wartime Disruption of US Telecoms How Volt Typhoon used living-off-the-land techniques and hijacked SOHO routers to pre-position inside US telecom, energy, and water infrastructure. https://telcosec.net/vulnerabilities-in-5g-sba/ 2026-05-15 https://telcosec.net/images/articles/sba-vulnerabilities-hero.webp Vulnerabilities in the 5G SBA TelcoSec exposes 5G SBA vulnerabilities: NRF poisoning, BOLA in telecom APIs, container breakout paths in Kubernetes-deployed 5G cores, and zero-trust defenses. https://telcosec.net/vulnerabilities-of-the-ran-air-interface/ 2026-05-15 https://telcosec.net/images/articles/ran-air-interface-hero.webp RAN Vulnerabilities: A Deep Dive into the Air Interface TelcoSec RAN air interface security vulnerabilities: O-RAN exploitation, IMSI catcher deployment, NAS/RRC manipulation, and MEC attack surface analysis. https://telcosec.net/why-telecom-teams-outgrow-generic-threat-intelligence/ 2026-05-18 https://telcosec.net/images/articles/why-telecom-outgrow-hero.webp Why Telecoms Outgrow Generic Threat Intelligence TelcoSec on telecom-specific threat intelligence: why MNO SOC teams outgrow generic feeds and a roadmap for evaluating curated telecom threat intelligence platforms. https://telcosec.net/projects/3gpp/ https://telcosec.net/projects/academy/ https://telcosec.net/projects/blog/ https://telcosec.net/projects/calculators/ https://telcosec.net/projects/ctf/ https://telcosec.net/projects/library/ https://telcosec.net/projects/rdnsx/ https://telcosec.net/projects/tools/ https://telcosec.net/services/corporate-training/ https://telcosec.net/services/dedicated-labs/ https://telcosec.net/signaling/camel-initialdp-call-redirect/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp CAMEL InitialDP Call Redirection and Charging Fraud TelcoSec CAMEL/CAP exploitation guide: rogue SCP injection via InitialDP for call redirect, covert interception, and CDR charging manipulation. https://telcosec.net/signaling/diameter-clr-forced-deregistration/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp Diameter S6a CLR Forced Subscriber Deregistration How adversaries abuse the Diameter S6a Cancel-Location-Request to impersonate the HSS, force subscriber detach, and stage attach-hijack race conditions. https://telcosec.net/signaling/diameter-ulr-location-disclosure/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp Diameter S6a ULR Subscriber Location Disclosure How attackers abuse Diameter S6a Update-Location-Request messages across IPX interconnects to track LTE subscribers and exfiltrate subscription profiles. https://telcosec.net/signaling/diameter/ 2026-05-15 https://telcosec.net/images/articles/diameter-protocol-hero.webp Diameter Protocol Security Analysis TelcoSec Diameter protocol security in 4G/LTE roaming networks: DEA/DRA bypass, AVP manipulation, realm spoofing, and signaling firewall evasion techniques. https://telcosec.net/signaling/gtp-c-tunnel-hijack-overbilling/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp GTP-C Tunnel Hijacking and IMSI Overbilling Fraud How forged GTP-C Create/Modify Bearer Request messages let GRX/IPX-positioned attackers hijack PDP/EPS tunnels and commit IMSI-attributed billing fraud. https://telcosec.net/signaling/lightbasin-unc1945-telecom-apt/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp LightBasin (UNC1945): The APT That Lived in Roaming Networks for 5 Years How LightBasin (UNC1945) exploited GRX roaming trust and SS7/GTP protocols to persist inside 13 global carriers for five years without tripping EDR. https://telcosec.net/signaling/liminal-panda-telecom-apt/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp Liminal Panda: A 4-Year SS7 and Diameter Espionage Campaign Liminal Panda ran a 4+ year China-nexus espionage campaign exploiting both SS7 and Diameter against telecom carriers in SE Asia and Africa. https://telcosec.net/signaling/sip-register-identity-spoofing/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp IMS SIP REGISTER Identity Spoofing in VoLTE TelcoSec IMS SIP REGISTER spoofing analysis: how weak IMS-AKA authentication lets attackers hijack VoLTE calls, SMSoIP, and bypass OTP delivery. https://telcosec.net/signaling/ss7-sms-interception/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp SS7 MAP SMS Interception via UpdateLocation How attackers abuse SS7 MAP UpdateLocation to hijack a subscriber's serving MSC/VLR, silently rerouting SMS and OTP/2FA codes to attacker infrastructure. https://telcosec.net/signaling/ss7-sri-sm-geolocation/ 2026-07-04 https://telcosec.net/images/articles/signaling-attack-vector.webp SS7 SRI-for-SM Subscriber Geolocation Attacks How MAP SendRoutingInfoForSM is abused for real-time subscriber geolocation over SS7 interconnects, with GSMA FS.11 mitigations and defense controls. https://telcosec.net/signaling/ss7/ 2026-05-15 https://telcosec.net/images/articles/signaling-attack-vector.webp SS7 Location Tracking Vulnerabilities TelcoSec SS7 MAP exploitation guide: subscriber tracking, SMS interception, and call redirection via SendRoutingInfo and ProvideSubscriberInfo attacks.