# The 5060 Siege: Industrialized SIP Brute-Force and Toll-Fraud Campaign Against Telephony Infrastructure

> CloudSEK honeypot telemetry recorded 15,183,358 SIP events from 323 source addresses over an 18-day window (4-22 May 2026), dominated by registration brute force (1,869,521 Digest authentication attempts across 29,433 extensions) and 89,465 toll-fraud INVITE attempts aimed mainly at UK revenue-share ranges. 99.8% of source-attributed traffic came from datacenter/hosting ranges, chiefly OVH (AS16276).

- **Published:** 2026-10-23T11:14:47Z
- **Last reviewed:** 2026-10-23T11:14:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4259
- **ID:** TL-2026-4259
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CloudSEK researcher Vikas Kundu published 'THE 5060 SIEGE' on 2026-06-23, documenting a sustained, automated assault on the SIP telephony ecosystem observed through honeypots. The window covered 18 days (reported as 4-22 May 2026) and produced 15,183,358 telemetry events, of which 3,787,791 were distinct SIP requests from 323 unique source addresses.

The dominant activity was credential harvesting through SIP REGISTER brute force: 1,869,521 authentication attempts carrying full Digest credentials were spread across 29,433 distinct extension identities. Because the captured authentication material was complete, CloudSEK determined the plaintext password behind 96.09% of all attempts, yielding a dictionary of 277,632 unique passwords and 1,499,846 unique extension/password pairs. CloudSEK characterizes this as curated-dictionary credential harvesting rather than opportunistic guessing. Every authentication against the honeypots was rejected, so the value of the dataset is intelligence on adversary wordlists, target numbers, tooling and infrastructure rather than observed compromise.

A second activity stream was toll fraud: 89,465 INVITE (call-setup) attempts, 47,273 of them toward UK numbers, concentrated on rural and Northern Ireland ranges consistent with International Revenue Share Fraud (IRSF). Authenticated access to a real PBX would let the operator place such calls at the victim's expense.

The scanners impersonated common telephony platforms through spoofed User-Agent values (FreePBX, Cisco, Polycom, Avaya) and reused a hardcoded Contact header signature present in 3,396,685 registration requests (the value is redacted in the published text). Infrastructure was cheap and European and highly concentrated: OVH (AS16276) originated 6,559,589 events, and a single /24 (15.204.157.0/24) produced 5,178,084 events alone. 93.5% of attacker addresses already appeared on known-abuser lists. No CVE is involved and the source names no threat actor; severity is analyst-assigned based on scale and the credential-theft and financial-fraud impact on exposed PBX/VoIP deployments.

## MITRE ATT&CK

- T1595 Active Scanning
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1036 Masquerading
- T1110 Brute Force
- T1110.001 Password Guessing
- T1110.003 Password Spraying
- T1496 Resource Hijacking
- T1657 Financial Theft

## Sources

- [THE 5060 SIEGE - Industrialized Attacks Against the SIP Telephony Ecosystem (CloudSEK, Vikas Kundu)](https://www.cloudsek.com/blog/the-5060-siege---industrialized-attacks-against-the-sip-telephony-ecosystem)
- [CloudSEK SIP Honeypot Report (PDF)](https://cdn.cloudsek.com/cloudsek-blog-pdfs/copy-of-sip-7klb.pdf)
- [CloudSEK blog (Arabic edition) - The 5060 Siege](https://www.cloudsek.com/ar/blog/the-5060-siege---industrialized-attacks-against-the-sip-telephony-ecosystem)
- [OffSeq Mirage - The Honeypot That Gets Robbed (independent SIP toll-fraud study, 21 Jun-19 Aug 2026; corroborating, separate dataset)](https://offseq.com/en/research/the-honeypot-that-gets-robbed/)
- [MITRE ATT&CK T1110 Brute Force](https://attack.mitre.org/techniques/T1110/)
- [MITRE ATT&CK T1657 Financial Theft](https://attack.mitre.org/techniques/T1657/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4259