# Nation-State Intrusions into Telecom Infrastructure via SS7, BGP Hijacking, and Router Compromise (Salt Typhoon)

> PRC state-sponsored actors (Salt Typhoon and related trackers) have compromised large backbone routers of major telecommunications providers since at least 2021, achieving persistent, wiretap-equivalent access via known edge-device vulnerabilities (Cisco IOS XE, Ivanti Connect Secure, Palo Alto PAN-OS), GRE/IPsec tunnel persistence, and credential harvesting from TACACS+/RADIUS traffic. The same campaign surface includes decades-old SS7/Diameter signaling weaknesses and BGP route-hijacking techniques (2010 China Telecom incident) that are invisible to endpoint EDR. Joint CISA/NSA/FBI advisory AA25-239A (27 Aug 2025) documents the router-compromise playbook; exploitation uses known CVEs, not zero-days.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2649
- **ID:** TL-2026-2649
- **Severity:** HIGH (CVSS 10)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Salt Typhoon - G1045 (China)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-20198, CVE-2023-20273, CVE-2023-46805, CVE-2024-21887, CVE-2024-3400, CVE-2018-0171

## Description

This campaign spans three complementary attack surfaces of the global telecommunications infrastructure: SS7/Diameter signaling, BGP route propagation, and the compromise of provider edge and backbone routing devices by PRC state-sponsored actors.

ROUTER COMPROMISE (AA25-239A). The joint advisory co-sealed by NSA, CISA, FBI, DC3, ASD (ACSC), Canadian Cyber Centre, NCSC-NZ and NCSC-UK documents APT actors observed globally since at least 2021 targeting large backbone routers of major telecom providers as well as provider edge and customer edge routers. Initial access was achieved exclusively through known, publicly disclosed vulnerabilities - exploitation of zero-days has not been observed - including CVE-2023-20198/CVE-2023-20273 (Cisco IOS XE Web UI; unauthenticated privilege escalation chained with post-auth root command injection), CVE-2023-46805/CVE-2024-21887 (Ivanti Connect Secure and Policy Secure; authentication bypass chained with command injection), CVE-2024-3400 (Palo Alto PAN-OS GlobalProtect; unauthenticated command injection with root-level code execution) and CVE-2018-0171 (Cisco IOS/IOS XE Smart Install). Once on a device, the actors created unauthorized local accounts (including a sudo-privileged user named 'cisco'), inserted SSH keys, deployed Cisco Guest Shell containers to stage tooling, modified ACLs (commonly 'access-list 20'), redirected TACACS+ servers to actor-controlled IPs, and used non-standard ports (SSH on 22x22/xxx22 patterns, HTTP on 18xxx, a backdoored sshd_operns on TCP/57722 on IOS XR) to evade detection. Persistence and covert channels were built with tunnels over GRE, multipoint GRE (mGRE) and IPsec, obscuring source IPs in logs. Collection focused on network-device credentials and traffic: native PCAP capture (including Cisco Embedded Packet Capture) of TACACS+/RADIUS traffic on TCP/49, SPAN/RSPAN/ERSPAN traffic mirroring, MIB/configuration dumping (e.g. T1602.002), and brute-forcing Cisco Type 5 and Type 7 password hashes. Custom Golang SFTP clients (cmd1, cmd3, new2, sft) moved encrypted archives to staging hosts, STOWAWAY provided multi-hop SOCKS5/HTTP proxy pivoting, and data was exfiltrated to China via GRE and MPLS tunnels, including over ISP peering connections.

SS7/DIAMETER SIGNALING. SS7 underpins 2G/3G SMS, phone services and international roaming with no built-in mechanism to verify the origin of signaling requests: any node with signaling access can send Mobile Application Part (MAP) queries to locate a subscriber or redirect SMS. Documented consequences include location tracking, interception of voice traffic and MFA keys, and spies using SS7 as a delivery vector. 4G/5G migration does not eliminate the problem - Diameter has its own location-tracking weaknesses and 4G/5G users can be downgraded to SS7 while roaming. A 2017 DHS assessment reportedly concluded all U.S. carriers are vulnerable to SS7 and Diameter exploits, with Russia, China, Israel and Iran named as primary countries exploiting U.S. subscribers via third-country telecom assets; Cyble's dark-web research confirms SS7/Diameter exploits and services are still routinely traded on underground forums.

BGP ROUTE HIJACKING. BGP offers no intrinsic way to verify route origination: if a network announces a prefix it does not own (or a more specific slice), neighbors often accept it and redirect traffic. On 8 April 2010, China Telecom advertised erroneous routes for roughly 18 minutes, pulling traffic for approximately 15 percent of internet destinations - including U.S. government and military sites - through Chinese servers, per the U.S.-China Economic and Security Review Commission's 2010 report to Congress (FCC DOC-402579A1). In 2024 the FCC proposed requiring broadband providers to build BGP security plans based on RPKI, with the nine largest carriers filing confidential plans and publishing quarterly progress.

WHY DETECTION LAGS. SS7 abuse resembles normal roaming traffic, a hijacked prefix resembles an ordinary route update, and a rogue GRE tunnel resembles legitimate provisioning - none of it runs on an endpoint where EDR can observe it. By the time anomalous activity appears internally, the attacker has usually already mapped the network and begun lateral movement. Mitigation therefore centers on signaling firewalls (SS7/Diameter), routing-origin validation (ROAs + RPKI), patching the listed CVEs, auditing tunnels/mirror sessions/AAA configs against an approved baseline, management-plane isolation, and monitoring activity outside the perimeter.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059.008 Network Device CLI
- T1136.001 Local Account
- T1543.005 Container Service
- T1098.004 SSH Authorized Keys
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1610 Deploy Container
- T1040 Network Sniffing
- T1110.002 Password Cracking
- T1021.004 SSH
- T1602.002 Network Device Configuration Dump
- T1090.003 Multi-hop Proxy
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1095 Non-Application Layer Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1584.008 Network Devices

## Sources

- [Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions (Cyble)](https://cyble.com/blog/ss7-bgp-nation-state-intrusions/)
- [Joint Advisory AA25-239A: PRC State-Sponsored Actors Compromise and Maintain Persistence in U.S. Telecommunications Provider Networks](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD Entry CVE-2023-20198 (Cisco IOS XE Web UI Privilege Escalation)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-20198)
- [NVD Entry CVE-2024-21887 (Ivanti Connect Secure / Policy Secure Command Injection)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-21887)
- [NVD Entry CVE-2024-3400 (Palo Alto PAN-OS GlobalProtect Command Injection)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-3400)
- [Cisco Security Advisory: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability (cisco-sa-iosxe-webui-privesc-j22SaA4z)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z)
- [Palo Alto Networks Security Advisory: PAN-OS GlobalProtect CVE-2024-3400](https://security.paloaltonetworks.com/CVE-2024-3400)
- [Volexity: Zero-Day Exploitation of Unauthenticated Remote Code Execution in GlobalProtect (CVE-2024-3400)](https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/)
- [Unit 42: CVE-2024-3400 Exploitation Analysis](https://unit42.paloaltonetworks.com/cve-2024-3400/)
- [FCC Fact Sheet: Declaratory Ruling and NPRM on Carrier Cybersecurity (DOC-408015A1)](https://docs.fcc.gov/public/attachments/DOC-408015A1.pdf)
- [U.S.-China Economic and Security Review Commission 2010 Report to Congress (China Telecom route hijack)](https://www.uscc.gov/Annual_Reports)
- [WSJ: China-Linked Hackers Breach U.S. Internet Providers](https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835)
- [CNN: Chinese hackers infiltrated major U.S. telecom firms, potentially accessing wiretap warrant requests](https://www.cnn.com/2024/10/05/politics/chinese-hackers-us-telecoms)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2649