{"id":11136,"date":"2024-11-04T17:32:46","date_gmt":"2024-11-04T17:32:46","guid":{"rendered":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?p=11136"},"modified":"2024-11-27T12:40:48","modified_gmt":"2024-11-27T12:40:48","slug":"mobile-telecom-security-landscape-blog-november-24","status":"publish","type":"post","link":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/","title":{"rendered":"Mobile Telecom Security Landscape Blog: November 24"},"content":{"rendered":"\n<p>Welcome to our November Security Landscape blog. This month, we look at the need to spot hidden persistent network accesses \u2013 is there something hiding in your network? There have been reports of attackers launching successful pre-positioning attacks. These \u2018quiet\u2019 attacks may have been missed by defence capabilities or may have existed prior to defence upgrades. They might exist with low levels of activity, occasionally contacting the Command and Control (C2) server, gathering information, exfiltrating low levels of data or waiting for a better time to launch a more destructive attack. Threat hunting plays a role in uncovering these long-term attacks, other defensive strategies are also highlighted.<\/p>\n\n\n\n<p>Reactive security defences play a huge role in delivering safe and resilient networks. Occasionally, though, these defences may have missed a successful attack that may have sought to pre-position a persistent \u2018bridgehead\u2019 from which to assert cyber attacks in a variety of forms. These \u2018quiet\u2019 attacks may have bypassed cybersecurity defences or have a long-term presence that pre-dates security enhancements or has been missed in log file analysis.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"h-underlying-activities\">Underlying activities<\/h5>\n\n\n\n<p>These persistent capabilities may undertake a variety of activities including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Maintaining a persistent \u2018backdoor\u2019 access<\/li>\n\n\n\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/news\/ncsc-and-partners-issue-warning-about-state-sponsored-cyber-attackers-hiding-on-critical-infrastructure-networks\">Living off the Land (LOTL)<\/a> involving the abuse of native tools and processes on systems and allows attackers to operate discreetly<\/li>\n\n\n\n<li>Beaconing to a C2 server<\/li>\n\n\n\n<li>Undertaking file deletion<\/li>\n\n\n\n<li>Side-loading malware<\/li>\n\n\n\n<li>Exfiltration of data<\/li>\n\n\n\n<li>Keylogging<\/li>\n\n\n\n<li>Credential theft.<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"h-examples-of-a-threat\">Examples of a threat<\/h5>\n\n\n\n<p>A couple of reported compromises point to evidence of this long-term attack ploy.  Syniverse <a href=\"https:\/\/www.sec.gov\/Archives\/edgar\/data\/1839175\/000119312521284329\/d234831dprem14a.htm\">filed<\/a> with the Securities and Exchange Commission that \u201cin May 2021, Syniverse became aware of unauthorised access to its operational and information technology systems by an unknown individual or organisation. Promptly upon Syniverse\u2019s detection of the unauthorised access, Syniverse launched an internal investigation, notified law enforcement, commenced remedial actions and engaged the services of specialised legal counsel and other incident response professionals.\u201d  Syniverse said that its \u201cinvestigation revealed that the unauthorised access began in May 2016\u201d and \u201cthat the individual or organisation gained unauthorised access to databases within its network.  The existence of this five-year access demonstrates the long-term approach taken by some attackers. <\/p>\n\n\n\n<p>In the <a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-june-24\/\">June security landscape blog<\/a>, the Kyivstar attack was noted, whereby <a href=\"https:\/\/www.reuters.com\/world\/europe\/russian-hackers-were-inside-ukraine-telecoms-giant-months-cyber-spy-chief-2024-01-04\/\">hackers had gained initial access to Kyivstar systems<\/a>, then likely compromised an employee account and then spent some time gaining access to other accounts. This appears to have eventually led them to those with administrative privileges and further access into Active Directory. <a href=\"https:\/\/therecord.media\/kyivstar-ceo-on-russian-cyberattack-telecom\">The attack <\/a>was reported to have gone undetected for some months and was reported that the group used a zero-day wiper malware, which Kyivstar&#8217;s protection systems couldn&#8217;t identify. The later destructive phase wiped out a range of infrastructure causing significant service interruption. <a href=\"https:\/\/www.mobileeurope.co.uk\/kyivstar-emerges-stronger-after-cyberattack-says-cto\/\">Kyivstar<\/a> reportedly were able to restore services in a very short time.<\/p>\n\n\n\n<p>The <a href=\"https:\/\/www.enisa.europa.eu\/publications\/enisa-threat-landscape-2024\">ENISA 2024 Threat Landscape Report<\/a> notes: Living Off Trusted Sites (LOTS): Threat actors extended their stealth techniques into the cloud, using trusted sites and legitimate services to avoid detection and disguising Command and Control communications (C2) as ordinary traffic or innocuous messages on platforms like Slack and Telegram.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"h-proactive-defence-threat-hunting\">Proactive Defence \u2013<a href=\"https:\/\/thecyberexpress.com\/why-proactive-threat-hunting-matters\/\"> threat hunting<\/a><\/h5>\n\n\n\n<p>In addition to reactive security controls, proactive threat hunting across the whole of the attack surface <a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-october-24\/\">(see October blog post)<\/a> may uncover these pre-positioning attacks. By focusing only on initial access points, teams may miss escalating threats or allow a stealthy bad actor to bypass detection. Proactively hunting for signs of an attacker\u2019s lateral movement through the network, identifying unauthorised privilege escalation, access rights abuse, and other threats, can help reveal potential risks that may not have been identified initially.<\/p>\n\n\n\n<p>Some regulations are pushing operators to establish the principle of \u2018assumed compromise\u2019 whereby operators should normally assume network oversight functions to be subject to high-end attacks, which may not have been detected, and implement business practices that make it harder for an attacker to maintain covert access.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\" id=\"h-mitigation-activities\">Mitigation Activities<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/hodigital.blog.gov.uk\/wp-content\/uploads\/sites\/161\/2020\/03\/Detecting-the-Unknown-A-Guide-to-Threat-Hunting-v2.0.pdf\">Threat hunting<\/a> is an active defence that can identify and remediate threats through a range of activities and traits, such as curiosity and intuition, to investigate potential threats. Also, insights can be gained by examining higher impact areas such as privileged access actions, activity logs plus analysis and network forensics tools (an obvious area for Security Information and Event Management (SIEM) tools including those that are AI-based).<\/li>\n\n\n\n<li>Implement trusted boot capabilities and secure roots of trust to establish an initial known-good state and periodically rebuilding the functions to an up-to-date known-good state.<\/li>\n\n\n\n<li>The GSMA Telecommunication Information Sharing and Analysis Center <a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/t-isac\/\">(T-ISAC)<\/a> is the central hub of information threat sharing for the Telecommunication Industry. Information threat sharing is essential for the protection of the mobile ecosystem, and the advancement of cybersecurity for the telecommunication sector T-ISAC intel sharing. Utilising T-ISAC intelligence and reciprocating by sharing Indicators of Compromise (IoCs) and evidenced attack techniques can lead to strong insights. These insights can be used proactively to identify how an initial compromise may have occurred and how to spot (and remediate) such attacks.<\/li>\n\n\n\n<li>Proactive penetration testing can be an additional tool with which to identify initial attack vectors, and, in turn, spot previous extant attack platforms. In the UK, a framework called <a href=\"https:\/\/www.ofcom.org.uk\/internet-based-services\/network-security\/our-work\">T-BEST <\/a>is sometimes used to undertake these activities in a controlled manner. T-BEST is a threat intelligence-led penetration testing scheme which simulates a well-resourced cyber-attack from a nation state or large organised crime groups. T-BEST seeks to assess how well a provider can detect, contain and respond to such an attack. The overall aim is to identify and address any security vulnerability or other weaknesses in a provider\u2019s functions, processes, policies, systems or networks.<\/li>\n<\/ul>\n\n\n\n<p>There are major consequences of having an undetected compromise on a network.\u00a0 Establishing a principle of \u2018assumed compromise\u2019 can lead to activities that identify these low-profile attacks.\u00a0 Fortunately, there are a number of proactive steps that can be undertaken to spot these compromises including threat hunting, trusted boot and rebuilding platforms, intelligence sharing and proactive penetration testing.\u00a0 Let\u2019s crack on and find these lurking cyber dangers.<\/p>\n\n\n\n<p><strong>If you\u2019d like to discuss these topics or to get more closely involved, please email&nbsp;<a href=\"mailto:security@gsma.com\">security@gsma.com<\/a>.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Welcome to our November Security Landscape blog. This month, we look at the need to spot hidden persistent network accesses \u2013 is there something hiding in your network? There have been reports of attackers launching successful pre-positioning attacks. These \u2018quiet\u2019 attacks may have been missed by defence capabilities or may have existed prior to defence [&hellip;]<\/p>\n","protected":false},"author":53,"featured_media":8336,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","footnotes":""},"categories":[1505],"tags":[],"algolia_discover_type":[],"class_list":["post-11136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-latest-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.3 (Yoast SEO v24.3) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Mobile Telecom Security Landscape Blog: November 24 - Security<\/title>\n<meta name=\"description\" content=\"November Security Landscape blog post- we\u2019re diving into the crucial need to detect hidden, long-term network accesses. Reports show attackers using stealthy pre-positioning attacks that can evade defences\u2014lying low, gathering intel, or reaching out to Command and Control (C2) servers, waiting for the perfect moment to strike.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mobile Telecom Security Landscape Blog: November 24 - Security\" \/>\n<meta property=\"og:description\" content=\"November Security Landscape blog post- we\u2019re diving into the crucial need to detect hidden, long-term network accesses. Reports show attackers using stealthy pre-positioning attacks that can evade defences\u2014lying low, gathering intel, or reaching out to Command and Control (C2) servers, waiting for the perfect moment to strike.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/\" \/>\n<meta property=\"og:site_name\" content=\"Security\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-04T17:32:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-11-27T12:40:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/05\/Security-blog-1-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"900\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"sfishwick@gsma.com\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"sfishwick@gsma.com\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Mobile Telecom Security Landscape Blog: November 24 - Security","description":"November Security Landscape blog post- we\u2019re diving into the crucial need to detect hidden, long-term network accesses. Reports show attackers using stealthy pre-positioning attacks that can evade defences\u2014lying low, gathering intel, or reaching out to Command and Control (C2) servers, waiting for the perfect moment to strike.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/","og_locale":"en_GB","og_type":"article","og_title":"Mobile Telecom Security Landscape Blog: November 24 - Security","og_description":"November Security Landscape blog post- we\u2019re diving into the crucial need to detect hidden, long-term network accesses. Reports show attackers using stealthy pre-positioning attacks that can evade defences\u2014lying low, gathering intel, or reaching out to Command and Control (C2) servers, waiting for the perfect moment to strike.","og_url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/","og_site_name":"Security","article_published_time":"2024-11-04T17:32:46+00:00","article_modified_time":"2024-11-27T12:40:48+00:00","og_image":[{"width":900,"height":300,"url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/05\/Security-blog-1-1.png","type":"image\/png"}],"author":"sfishwick@gsma.com","twitter_card":"summary_large_image","twitter_misc":{"Written by":"sfishwick@gsma.com","Estimated reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/","name":"Mobile Telecom Security Landscape Blog: November 24 - Security","isPartOf":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/#primaryimage"},"image":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/#primaryimage"},"thumbnailUrl":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/05\/Security-blog-1-1-e1744681521650.png","datePublished":"2024-11-04T17:32:46+00:00","dateModified":"2024-11-27T12:40:48+00:00","author":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#\/schema\/person\/779a7ff304b557a1b5fb9b7e5b34f150"},"description":"November Security Landscape blog post- we\u2019re diving into the crucial need to detect hidden, long-term network accesses. Reports show attackers using stealthy pre-positioning attacks that can evade defences\u2014lying low, gathering intel, or reaching out to Command and Control (C2) servers, waiting for the perfect moment to strike.","inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/mobile-telecom-security-landscape-blog-november-24\/#primaryimage","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/05\/Security-blog-1-1-e1744681521650.png","contentUrl":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/05\/Security-blog-1-1-e1744681521650.png","width":352,"height":190,"caption":"People working at computer centre"},{"@type":"WebSite","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#website","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/","name":"Security","description":"GSMA Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#\/schema\/person\/779a7ff304b557a1b5fb9b7e5b34f150","name":"sfishwick@gsma.com","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/053fecc6339b359a923239637a042baf?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/053fecc6339b359a923239637a042baf?s=96&d=mm&r=g","caption":"sfishwick@gsma.com"}}]}},"featured_image_url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/05\/Security-blog-1-1-e1744681521650.png","_links":{"self":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts\/11136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/users\/53"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/comments?post=11136"}],"version-history":[{"count":8,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts\/11136\/revisions"}],"predecessor-version":[{"id":11258,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts\/11136\/revisions\/11258"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/media\/8336"}],"wp:attachment":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/media?parent=11136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/categories?post=11136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/tags?post=11136"},{"taxonomy":"algolia_discover_type","embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/algolia_discover_type?post=11136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}