Infiltration of global telecom networks

To mark my first year at Unit 42, I’m sharing a report I co-authored with the team: The Covert Operator’s Playbook: Infiltration of Global Telecom Networks. It brings together more than six months of incident response work I carried out across multiple telecom operators in Southwest Asia. The report summarizes the tactics, techniques, and procedures (TTPs) I observed during those investigations into activity tracked as CL-STA-0969, which overlaps with the threat actor known as LightBasin.

The technical details include backdoored Linux authentication modules, command channels over DNS and ICMP, and GTPDoor, an implant that carries commands over the GPRS Tunneling Protocol used in mobile networks. We also describe how the attackers used roaming connections to tunnel between operators, disguised their processes, and selectively removed authentication logs.