Every telecom threat actor profile TelcoSec publishes — LightBasin, Volt Typhoon, Salt Typhoon, GALLIUM, and the rest — is built on the same analytical skeleton. That is deliberate. Read any two APT reports from different vendors and you'll find two different vocabularies, two different phase breakdowns, and no reliable way to say whether "Group A" and "Group B" actually behave alike. Generic enterprise threat intelligence makes this worse for telecom specifically: it was written for phishing emails and Windows lateral movement, not for SendRoutingInfoForSM queries over a GRX roaming interconnect or a rogue NF registering itself with an NRF.
This piece is the reference to read before any single actor profile. It lays out the three-part framework — the Lockheed Martin Cyber Kill Chain for narrative structure, MITRE ATT&CK for standardized technique naming, and MITRE FiGHT for the telecom-specific techniques ATT&CK was never built to describe — and shows why a "FiGHT (5G/SS7)" column has to exist as its own tactic rather than being folded into Initial Access or Collection. Without it, an SS7 ProvideSubscriberInfo query and a phishing email get filed under the same generic label, and the entire point of building a telecom-specific matrix is lost.
This report explains the analytical framework TelcoSec applies to every tracked telecom threat actor: the 7-phase Lockheed Martin kill chain, the 15-tactic ATT&CK/FiGHT matrix used to classify techniques, and a worked comparison of three real documented actors — LightBasin, Salt Typhoon, and Volt Typhoon — whose kill chains look nothing alike despite all three being labeled "APT."
I. The Cyber Kill Chain: A Common Narrative Spine
Every actor profile follows the same seven-phase structure defined by Lockheed Martin's Cyber Kill Chain. It predates telecom-specific threat modeling by over a decade, but it remains the right tool for narrative sequencing — it answers "what happened, in what order" — while ATT&CK and FiGHT answer "what technique, exactly."
| Phase | Name | Definition |
|---|---|---|
| 1 | Reconnaissance | Passive/active information gathering on target infrastructure and subscribers |
| 2 | Weaponization | Building or adapting custom tooling for the target environment |
| 3 | Delivery | Transporting the capability to the target — network vector, supply-chain, or physical |
| 4 | Exploitation | Triggering the vulnerability or protocol weakness to achieve initial access |
| 5 | Installation | Establishing persistence — implants, C2 channels, stolen credentials |
| 6 | C2 | Command-and-control channel: covert comms for ongoing operator tasking |
| 7 | Actions on Objectives | Collection, exfiltration, lateral movement, or disruption meeting mission goals |
The kill chain's real value for telecom is that it forces every actor — whether their entry point is a phished laptop or a rented Global Title — into the same seven buckets. That's what makes a LightBasin profile and a Sandworm profile structurally comparable even though one never leaves the signaling plane and the other ends in a wiper deployment against a power grid.
II. The ATT&CK + FiGHT Tactic Matrix
Underneath each kill-chain phase, every observed action is tagged with a specific technique drawn from one of two knowledge bases: MITRE ATT&CK (enterprise IT) or MITRE FiGHT (5G/telecom). Both organize techniques under tactics — the "why" behind a technique, as opposed to the "how." TelcoSec's threat matrix uses 15 tactic columns: the 14 standard ATT&CK Enterprise tactics, plus one telecom-specific addition.
| # | Tactic | What It Covers |
|---|---|---|
| 1 | Reconnaissance | Gathering info to plan future operations (scanning, OSINT) |
| 2 | Resource Development | Establishing infrastructure and capabilities to support operations |
| 3 | Initial Access | Getting into the network — exploited apps, valid accounts, supply chain |
| 4 | Execution | Running attacker-controlled code on a system |
| 5 | Persistence | Maintaining a foothold across restarts, credential changes, interruptions |
| 6 | Privilege Escalation | Gaining higher-level permissions |
| 7 | Defense Evasion | Avoiding detection throughout the operation |
| 8 | Credential Access | Stealing account names, passwords, or authentication material |
| 9 | Discovery | Figuring out the environment — network layout, accounts, services |
| 10 | Lateral Movement | Moving between systems and accounts within the environment |
| 11 | Collection | Gathering data of interest to the operation's goal |
| 12 | Command and Control | Communicating with compromised systems for tasking |
| 13 | Exfiltration | Stealing data out of the network |
| 14 | Impact | Manipulating, interrupting, or destroying systems and data |
| 15 | FiGHT (5G/SS7) | Telecom-specific: SS7/Diameter/GTP protocol exploitation, rogue network functions, signaling-plane abuse |
Why FiGHT Has to Be Its Own Column
The other 14 tactics describe why an attacker does something regardless of the target — an enterprise SOC analyst and a telecom SOC analyst both understand "Credential Access" the same way. FiGHT exists because a large class of telecom-specific actions doesn't map cleanly onto any of those 14. A SendRoutingInfoForSM query isn't quite Reconnaissance (it returns live subscriber data, not just infrastructure metadata), isn't quite Collection (it's also how the attacker finds the target), and has no CVE, no malware, and no enterprise IT equivalent at all. Forcing it into an existing ATT&CK tactic would either stretch that tactic's definition past usefulness or hide the fact that the technique exploits a 3GPP protocol trust assumption rather than a software bug.
TelcoSec's registry tags FiGHT techniques explicitly (fight: true) alongside their ATT&CK-style ID (FGTxxxx), and — critically — cross-references them against real documented actors rather than treating FiGHT as a theoretical catalog. Three techniques recur constantly across the tracked telecom APTs:
| FiGHT ID | Technique | Seen In |
|---|---|---|
| FGT5013 | SS7 Network Exploitation | LightBasin, Liminal Panda |
| FGT5019 | GTP Network Exploitation | LightBasin |
| FGT5030 | Signaling Network Reconnaissance | LightBasin |
| FGT5006 | Diameter Network Exploitation | Liminal Panda |
III. A Worked Comparison: Three Actors, Three Different Shapes
The value of a shared framework isn't that it makes every actor look the same — it's that it makes their differences legible. Below, three documented, publicly-attributed telecom-targeting APTs are run through the identical kill-chain-plus-tactic-matrix structure. All three are routinely (and correctly) called "APTs" in press coverage. Structurally, they could not be more different.
LightBasin (signaling-plane, no CVE)
LightBasin lived inside 13 global carriers for roughly five years by staying entirely within the GRX/SS7/GTP roaming fabric — never touching a corporate laptop, never needing a CVE. Its kill chain:
- Reconnaissance — SCTP/M3UA port scanning across GRX interconnects (CordScan); SS7 Global Title enumeration (SIGTRANslator) —
FGT5030,T1046 - Delivery — SSH key reuse on GRX-connected GPRS infrastructure via a trusted roaming partner —
T1078 - Exploitation — SS7 MAP
SendRoutingInfoForSMqueries against the HLR for subscriber location;SendAuthInfofor auth-vector harvest —FGT5013,T1040 - Installation —
sDNSimplant masquerading as SGSN eDNS traffic;TinyShellreverse shell —T1098,T1071.004 - C2 —
PingPongICMP echo-payload C2 blending with legitimate GPRS traffic —T1071.004 - Actions on Objectives — mass SS7 location tracking, retrospective GSM decryption via harvested auth vectors, SMSC metadata collection across 13 operators —
T1560,FGT5019
(Full profile: LightBasin / UNC1945)
Salt Typhoon (management-plane, formal PRC attribution, CVE-based)
Salt Typhoon's entire operation traces back to one unpatched edge router. No FiGHT techniques appear anywhere in its documented technique list — every action maps to standard enterprise ATT&CK tactics, because the compromise never required protocol-layer signaling expertise:
- Reconnaissance — external scan for internet-facing Cisco IOS-XE management interfaces on vulnerable firmware —
T1190 - Delivery/Exploitation — CVE-2023-20198 (CVSS 10.0) privilege escalation, immediate web shell via CVE-2023-20273 —
T1190,T1505.003 - Installation —
GhostSpiderandSnappyBee(Masol RAT) deployed; TACACS+ credential reuse for lateral movement into CALEA infrastructure —T1078 - C2 — encrypted C2 with randomized beacon timing blending into HTTPS management traffic —
T1071.001,T1027 - Actions on Objectives — mass CDR harvest for social-graph analysis, and access to CALEA lawful-intercept systems revealing active law-enforcement surveillance targets —
T1213,T1119
Volt Typhoon (critical-infra pre-positioning, living-off-the-land)
Volt Typhoon also skips FiGHT entirely, but for the opposite reason from Salt Typhoon: it uses no custom malware at all, relying exclusively on native OS tools to stay under EDR signature detection while pre-positioning inside US critical infrastructure, including telecom, for a disruption capability assessed to matter in a future conflict:
- Reconnaissance — targeting of US critical infrastructure for strategic pre-positioning —
T1016 - Delivery — Fortinet FortiGuard VPN CVE exploitation; SOHO router compromise for proxy infrastructure —
T1190 - Exploitation — OS-native credential theft (no custom malware) —
T1003,T1078 - Installation — stolen VPN credentials for persistence; FRP proxy tunnels for covert C2; log clearing —
T1070,T1572 - Actions on Objectives — network topology mapping and credential pre-positioning for an assessed wartime disruption capability —
T1489
(Full profile: Volt Typhoon)
What the Comparison Reveals
| Dimension | LightBasin | Salt Typhoon | Volt Typhoon |
|---|---|---|---|
| Entry vector | SSH key reuse (trust abuse) | CVE-2023-20198 (CVSS 10.0) | Fortinet VPN CVE + SOHO routers |
| FiGHT techniques used | 3 (FGT5013, FGT5019, FGT5030) | 0 | 0 |
| Custom malware | Yes (SIGTRANslator, sDNS, TinyShell) | Yes (GhostSpider, SnappyBee) | None — LOTL only |
| ATT&CK Impact tactic populated | No | No | Yes (T1489, pre-positioned disruption) |
| Standard ATT&CK Reconnaissance tactic used | No (recon is entirely FiGHT-classified) | Yes (T1190 recon phase) | Yes (T1016) |
| Dwell time | ~5 years | ~12 months | Multi-year, ongoing at disclosure |
Three actors, three genuinely distinct threat models. LightBasin needs signaling-plane monitoring (SS7/GTP anomaly detection, GT screening) that has nothing to do with patching — it never used a CVE. Salt Typhoon needs edge-device patch management and management-plane network segmentation from CALEA/lawful-intercept systems specifically. Volt Typhoon needs behavioral/LOTL detection (unusual netsh, wmic, or credential-dumping patterns) since signature-based and CVE-based defenses are both irrelevant to how it operates. A defender who reads all three profiles as "the same kind of APT" and builds one generic detection strategy will miss two of the three.
<CodeBlock language="json" filename="lightbasin-technique-layer.json" code=" { "actor": "LightBasin (OPS-APT-001)", "techniques": { "techniqueId": "FGT5030", "tactic": "fight", "score": 1, "comment": "GT enumeration via SIGTRANslator" }, { "techniqueId": "T1078", "tactic": "initial-access", "score": 1, "comment": "SSH key reuse, GRX roaming trust" }, { "techniqueId": "FGT5013", "tactic": "fight", "score": 1, "comment": "SS7 MAP SRI-SM / SendAuthInfo" }, { "techniqueId": "T1071.004", "tactic": "command-and-control", "score": 1, "comment": "PingPong ICMP C2" }, { "techniqueId": "FGT5019", "tactic": "fight", "score": 1, "comment": "GTP exploitation, SMSC metadata collection" } }">
IV. Applying This Framework to Your Own Network
The point of building this matrix isn't academic. It's a checklist a defender can run against their own carrier or MVNO's actual exposure, using the same three lenses:
- Kill chain — where would each phase land in your environment? Map your GRX/IPX interconnect exposure to Reconnaissance/Delivery, your edge management interfaces to Exploitation, your CALEA/lawful-intercept segmentation to Actions on Objectives. If you can't answer "what would Installation look like on our network," you don't yet have a threat model — you have a vulnerability list.
- ATT&CK tactics — which of the 14 standard tactics does your SOC actually have detection coverage for? Most telecom SOCs inherit enterprise-IT detection stacks. Credential Access, Discovery, and C2 detection built for Windows domains will not catch a rogue Global Title sending MAP queries.
- FiGHT — do you have any signaling-plane monitoring at all? If your SS7/Diameter/GTP interconnects have no anomaly detection, no GT screening (GSMA FS.11), and no Diameter peer validation (IR.83/IR.88), you have zero visibility into the exact technique class that gave LightBasin five years of undetected access to 13 carriers.
This same matrix underlies TelcoSec's broader telecom penetration testing methodology — the FiGHT tactic mapping used there for offensive engagements is the identical framework used here for defensive threat tracking. An assessment finding and a threat actor's documented technique should be describable in the same language; that's the entire premise of using a shared matrix instead of ad hoc prose per report.
V. Frequently Asked Questions
The Kill Chain is a narrative sequence (Lockheed Martin's 7 phases: Reconnaissance through Actions on Objectives) — it answers "in what order did this happen." ATT&CK and FiGHT are technique catalogs organized by tactic — they answer "what specific action, exactly." A single kill-chain phase, like Exploitation, might involve one or several tactic-tagged techniques from either catalog. TelcoSec's actor profiles use all three together: kill chain for structure, ATT&CK/FiGHT technique IDs for precision.
Because telecom-specific techniques — SS7 MAP queries, Diameter AVP manipulation, rogue NF registration against an NRF — don't map cleanly onto enterprise concepts like Initial Access or Collection. They exploit protocol-level trust assumptions in 3GPP signaling standards, not software vulnerabilities or credential theft in the enterprise-IT sense. Folding them into an existing tactic would either misdescribe the technique or bury the fact that it requires signaling-plane monitoring, not endpoint detection, to catch.
No — and that's one of the most useful findings from comparing actors this way. LightBasin and Liminal Panda operate almost entirely within FiGHT/signaling techniques. Salt Typhoon and Volt Typhoon, despite both targeting telecom infrastructure, use zero FiGHT techniques in their documented technique lists — their entry and persistence methods are conventional CVE exploitation and living-off-the-land tooling respectively. Targeting telecom infrastructure doesn't imply telecom-specific tradecraft.
Vendor reports (CrowdStrike, Mandiant, Microsoft MSTIC, Cisco Talos) are the primary sources this framework is built from — TelcoSec doesn't originate the underlying intelligence. What the framework adds is normalization: every actor gets tagged against the same 15-tactic matrix and the same 7-phase kill chain, so a reader can compare LightBasin to Volt Typhoon technique-for-technique instead of comparing two differently-structured PDF reports written by two different vendors with two different taxonomies.
Yes — that's the intent of Section IV above. A carrier or MVNO's security team can run their own environment through the same three lenses (kill chain phase mapping, ATT&CK tactic coverage audit, FiGHT/signaling-plane visibility check) to identify where their actual detection gaps sit relative to documented real-world technique usage, rather than relying on generic enterprise threat modeling that has no telecom-specific coverage at all.
Understanding the framework is the prerequisite. The individual actor profiles — LightBasin's five-year signaling-plane campaign, Volt Typhoon's living-off-the-land pre-positioning, and the Salt Typhoon, GALLIUM, Liminal Panda, APT41, Sandworm, and MuddyWater profiles that use this same structure — are where the framework gets applied to specific, documented campaigns.
