Telecom providers hold subscriber accounts and run large networks that face the internet. State-backed groups, fraudsters and ordinary criminals all target them, often through unpatched network devices and subscriber logins. Watching outside the network shows SIM swapping, subscriber data theft and exposed edge devices early.
At A GlanceState-sponsored intrusions, subscriber data theft, SIM swapping and account takeover at telecom providers, and the rules that apply.
CISA's advisory on Salt Typhoon says the activity is linked to the People's Republic of China, focuses on large backbone routers of major telecommunications providers and targets provider and customer edge routers.
NIS2 DirectiveThe European Commission lists digital infrastructure and providers of public electronic communications among the entities the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents.Official Site ↗
GDPRThe EU's main data protection law. It applies to organisations established in the EU that process personal data, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour.Official Site ↗
A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.
No. The platform looks from outside at what is exposed and at criminal sources. It does not connect to your core.
What does the CISA advisory say about access?
It says the actors gain entry through publicly known vulnerabilities rather than zero-days, on exposed network edge devices.
Which rules apply?
NIS2 covers providers of public electronic communications and digital infrastructure. National rules differ, so check with your legal team.
Can it help with SIM swap fraud?
It can show leaked subscriber data and fake pages that feed it. Preventing swaps still needs checks in your own processes.
Who is Salt Typhoon?
CISA's advisory links Salt Typhoon activity to the People's Republic of China. MITRE ATT&CK says it has been active since at least 2019. It compromised network equipment at major US telecommunications and internet providers.
Why are network edge devices a target for telecom attackers?
CISA says Salt Typhoon activity focuses on telecommunications, mostly through publicly known flaws on network edge devices. External Attack Surface Management shows exposed routers, gateways and services on your address ranges, including forgotten ones.
How does account takeover happen on subscriber accounts?
Attackers use stolen or reused passwords on subscriber accounts. Dark Web Monitoring alerts you when subscriber or staff logins tied to you appear in criminal markets.
How do fake pages target telecom subscribers?
Criminals build pages that copy a telecom brand and aim them at subscribers. Phishing Monitoring and Domain Abuse finds fake pages that copy your brand and target subscribers.
How can a telecom find systems its team does not know about?
The Asset Discovery and Shadow IT use case finds systems your team does not know about. Telecoms run large networks that face the internet, so unlisted systems are easy to miss.
Is state-backed hacking of telecoms limited to one country?
No. From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries. In 2025 an advanced persistent threat actor called UNC3886 attacked all four of Singapore's major telecommunications operators.
