The Covert Operator's Playbook: Infiltration of Global Telecom Networks
Summary: Unit 42 tracked activity it designates CL-STA-0969 against telecommunications infrastructure in Southwest Asia between February and November 2024, with initial access likely gained through SSH brute force using a dictionary of built-in telecom equipment accounts. The actor deployed custom telecom-focused tools including the AuthDoor PAM backdoor, the Cordscan location-data collector, GTPDoor, EchoBackdoor, ChronosRAT, NoDepDNS and an SGSN emulator, tunneling command-and-control over SSH, ICMP, DNS and GTP, and Unit 42 assesses with high confidence a nation-state nexus with heavy overlap to Liminal Panda.
Key Takeaway: The actor maintained high OPSEC and evaded detection while establishing resilient remote control for future objectives, and Cordscan's design for collecting mobile device location data points to victim location as a likely goal - a stake that lands on subscribers, not just the operator.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026