CrowdStrike Exposes LIMINAL PANDA, a Telecom-Specialist Intrusion Actor
On 19 November 2024, alongside Adam Meyers' testimony to the US Senate Judiciary Committee, CrowdStrike named LIMINAL PANDA, an actor targeting telecom providers in South Asia and Africa since at least 2020, and reassigned some activity previously attributed to LightBasin to it.
02Deep-Dive Technical Analysis
CrowdStrike reports the actor abuses inter-operator trust, using footholds in compromised telecom servers to breach other providers in other regions. Its tooling emulates GSM protocols for command and control and retrieves subscriber information, call metadata and SMS; listed tools include SIGTRANslator, CordScan and PingPong alongside public proxy utilities. CrowdStrike said some 2020–2021 events in its LightBasin reporting belong to LIMINAL PANDA, as multiple actors were active on a "highly contested" network. It rates the intelligence-collection motive high-confidence but a China nexus only low-confidence.
03Vulnerability & Exploit Flow
Abuse of trusted inter-operator connectivity from compromised telecom servers, with signaling-protocol emulation to hide command-and-control.
04Recommended Defense & Mitigation Protocol
Strict filtering and monitoring of signaling and roaming interconnects, hardening of operator Linux servers and GSMA-guided threat-intel sharing.
05Security Impact & Geopolitical Consequence
Reinforced that telecom roaming and signaling interconnects are a primary espionage target, separate from the concurrent Salt Typhoon intrusions in US carriers.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.