1988
9.5
CCITT Standardizes SS7 (Signaling System No. 7)
CCITT standardized the SS7 protocol suite in 1988 across mobile and fixed networks, built on implicit operator trust with no authentication — the root cause of every later signaling attack.
🌐GLOBAL
Intercept Log — Global Standards
016 RECORDS
2001
6.5
3G UMTS Standardization & 3G AKA Mutual Authentication Architecture
3GPP Release 99 standardized 3G UMTS, introducing bidirectional mutual authentication (3G AKA) to defeat rogue base stations (IMSI catchers) and replacing A5/1 with the KASUMI block cipher.
2004
6.0
Cabir & CommWarrior: The First Mobile Phone Worms (Bluetooth and MMS Propagation on Symbian)
In June 2004 F-Secure analysed Cabir, a proof-of-concept worm linked to the 29A virus-writing group and the first known worm for mobile phones, which spread between Symbian Series 60 handsets over Bluetooth; in March 2005 CommWarrior added self-propagation over operator MMS.
2010
8.8
SIPVicious-Era SIP Brute-Force Toll Fraud Wave Against Asterisk & FreePBX PBXs
Through 2009–2010, automated scanners swept the internet for SIP on UDP port 5060 and brute-forced extension credentials on exposed Asterisk and FreePBX systems; the SANS Internet Storm Center flagged the surge in July 2010, and in February 2011 the Sality botnet ran an internet-wide "sipscan" from about 3 million hosts. Compromised PBXs were used to pump calls to high-cost international and premium-rate numbers.
2014
9.1
Positive Technologies Exposes GTP/GRX Mobile-Internet Hijacking via Internet-Reachable GTP Nodes
Positive Technologies' 2014 report "Vulnerabilities of Mobile Internet (GPRS)", publicized in February 2015, showed that GPRS Tunnelling Protocol (GTP) nodes reachable from the internet and the GRX roaming network let attackers brute-force subscriber identities, hijack or block mobile data sessions and obtain subscriber data — building on P1 Security's 2011 "Attacking GRX" research. A 2020 Positive Technologies assessment found every one of 28 tested operators still exploitable via GTP.
2014
9.4
Regin Malware Discovery: Five Eyes Advanced Modular GSM/SS7 Telecom Core Spyware
Symantec and Kaspersky exposed Regin, an extraordinarily sophisticated nation-state malware platform specifically engineered to infiltrate GSM cellular base station controllers and telecom routing cores.
2015
9.2
LTE Diameter Core Exploits Go Public: P1 Security Shows Diameter Routing Agent Takeover at Hackito Ergo Sum
At Hackito Ergo Sum in Paris (October 2015), P1 Security researchers Laurent Ghigonis and Philippe Langlois showed a remotely exploitable flaw in an LTE Diameter Routing Agent, one of the first public demonstrations that 4G Diameter signaling inherited SS7-style interconnect trust problems; Nokia Bell Labs (2016) and Positive Technologies (2018) then published Diameter location-tracking and denial-of-service attacks over IPX interconnects.
2015
8.0
Satellite Turla: APT Hijacks Downstream-Only Satellite Internet Links for Covert C2
On 9 September 2015 Kaspersky Lab reported that the Russian-speaking Turla APT had, since as early as 2007, hidden its command-and-control servers behind IP addresses of legitimate satellite internet subscribers, mostly of DVB-S providers in the Middle East and Africa.
2018
9.4
Operation Soft Cell: Nation-State Espionage Theft of Global Telco Call Detail Records (CDRs)
Cybereason revealed Operation Soft Cell, a massive multi-year cyber espionage campaign by suspected nation-state actors that completely compromised multiple telecommunications providers to exfiltrate raw subscriber Call Detail Records.
2019
8.0
GSMA Formalizes Telecom Coordinated Vulnerability Disclosure (CVD) Program
The GSM Association launched its formal Coordinated Vulnerability Disclosure (CVD) program and Hall of Fame, establishing standard operating procedures for researchers to responsibly report 2G–5G protocol and core vulnerabilities.
2019
9.8
LightBasin (UNC1945) Compromises 13+ Global MNO Core Networks
CrowdStrike revealed that the LightBasin (UNC1945) APT had compromised 13+ global telecom operators since at least 2016 using custom GTP and SS7 tooling to masquerade as roaming infrastructure.
2020
8.0
3GPP Release 16 Standardizes NWDAF Network Analytics (TS 23.288) Including Abnormal UE Behaviour Detection
With the Release 16 freeze on 3 July 2020, 3GPP completed its Enablers for Network Automation (eNA) work, defining the 5G Core Network Data Analytics Function (NWDAF) in TS 23.288 — including abnormal UE behaviour analytics that operators can feed into policy and security decisions.
2020
3.2
3GPP Standardizes 5G Standalone (SA) Security Architecture
5G Standalone (Release 16, 2020) replaced SS7/Diameter trust assumptions with HTTP/2 service-based APIs over TLS, OAuth 2.0 token authentication, and cryptographically concealed subscriber identities (SUCI).
2021
9.9
The Pegasus Project: Zero-Click Telecom & Mobile Surveillance Revelations
A global consortium of journalists revealed that NSO Group's Pegasus spyware had targeted 50,000+ phone numbers across 50 countries, utilizing zero-click SMS/iMessage parser vulnerabilities.
2024
8.5
CrowdStrike Exposes LIMINAL PANDA, a Telecom-Specialist Intrusion Actor
On 19 November 2024, alongside Adam Meyers' testimony to the US Senate Judiciary Committee, CrowdStrike named LIMINAL PANDA, an actor targeting telecom providers in South Asia and Africa since at least 2020, and reassigned some activity previously attributed to LightBasin to it.
2026
9.4
Outlook: 3GPP Release 20 Post-Quantum Cryptography Migration for 5G-Advanced & 6G (TR 33.703, FIPS 203/204)
3GPP SA3 is preparing to migrate 5G and future 6G security to post-quantum cryptography. After the Release 19 cryptographic inventory (TR 33.938), the Release 20 study TR 33.703 evaluates options built on NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), published in August 2024, and a Release 20 normative work item, Post-quantum Cryptography Migration Phase 1, is under way. No PQC scheme has yet been standardized for SUCI.