ATTACK CATEGORIES — Telecom & 5G Security Threat Domains
TelcoSec organizes its security research into five categories across the telecommunications attack surface. Each category maps directly to a distinct architectural layer of the cellular stack — from client-side baseband processors and SIM modules through signaling protocols, radio access networks, and cloud-native 5G core functions.
This taxonomy enables security engineers, red teams, and SOC analysts to locate targeted research, filter threat intelligence by infrastructure layer, and apply category-specific defensive controls aligned with GSMA security guidelines and 3GPP specifications.
The modern cellular network is a multi-generational infrastructure where 2G SS7 routing coexists with 5G Service Based Architecture (SBA) REST APIs, and where subscriber identity flows through legacy HLRs, modern UDMs, and virtualized AMFs within a single roaming transaction. This architectural complexity — driven by backward compatibility requirements and the global nature of roaming agreements — creates an attack surface that spans hardware, firmware, protocols, and cloud-native software simultaneously.
Standard enterprise security frameworks and threat feeds are not designed for this environment. SIEM rules built for Windows endpoint telemetry cannot interpret MAP SRI message anomalies. Web application firewalls cannot inspect GTP-U tunnel headers. Generic vulnerability scanners cannot assess 3GPP-compliant NF registration tokens. Effective telecommunications security requires domain-specific tooling, protocol-level expertise, and a threat model organized around the cellular stack rather than the enterprise perimeter.
TelcoSec's research taxonomy addresses this gap by classifying every published vulnerability, exploit technique, and defensive control according to the architectural layer it targets. Security teams can use this structure to scope penetration testing engagements, prioritize remediation efforts, and map findings to MITRE FiGHT techniques and GSMA security guidelines.
// FIVE CORE ATTACK DOMAINS
- User Land: Baseband firmware exploitation, SIM and eSIM compromise, and modem-to-application-processor privilege escalation. Research targets the full UE hardware stack from Qualcomm MSM and Samsung Shannon chipsets through JavaCard applets and eSIM remote provisioning protocols.
- Signaling: Unauthenticated message injection across SS7 MAP, Diameter S6a/Gx/Gy, GTP-C, and 5G HTTP/2 SBI. Attack classes include location tracking, SMS interception, call redirection, authentication vector harvesting, and NRF poisoning.
- Transmissions: Radio access network (RAN) threats including IMSI catchers, inter-RAT downgrade attacks, O-RAN xHaul interface exploitation, and SDR-based passive interception. Physical-layer attacks that require no access to operator infrastructure.
- Core: 5G SBA network function abuse, container escape in Kubernetes-deployed NFs, OAuth2 token manipulation, and lateral movement across AMF, SMF, UPF, and UDM via REST API exploitation.
- Cellular Networks: End-to-end network-level threats spanning public MNO and private 5G deployments — inter-RAT fallback attacks, network slicing isolation failures, multi-access edge computing (MEC) security, and NPN configuration vulnerabilities.
// GOVERNING STANDARDS & FRAMEWORKS
TelcoSec research is grounded in the official security specifications and industry frameworks that govern cellular network design and operator obligations. Each research article maps findings to one or more of the following governing documents, enabling security teams to directly reference normative requirements during vendor assessments, penetration testing engagements, and regulatory compliance reviews.
Additional frameworks referenced across TelcoSec research include MITRE FiGHT (a 5G-specific extension of ATT&CK), NIST SP 800-187, the ENISA Threat Landscape for 5G Networks, and O-RAN Alliance Security Work Group specifications. Where applicable, findings are cross-referenced against ETSI NFV security specifications for virtualized network function deployments and GSMA FS.38 for Non-Public Network (private 5G) security architecture.
SCOPE A DOMAIN ASSESSMENT
Our research team conducts targeted penetration tests and threat model reviews across all five telecommunications security domains. Engage TelcoSec for a scoped engagement against your network architecture.