The Covert Operator's Playbook Infiltration of Global Teleco...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/
• Blog Title: The Covert Operator's Playbook: Infiltration of Global Telecom Networks
• Suggested Section: generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.md

🎯 Content Summary

Technical Summary: CL-STA-0969 APT Cluster

Between February and November 2024, Unit 42 tracked CL-STA-0969, a nation-state-linked APT cluster targeting Southwest Asia telecom roaming networks. Initial access was achieved via SSH brute-force against vendor default accounts using a custom dictionary of built-in telecom credentials. Once inside, the actors implanted multiple covert backdoors and scanners to enumerate, tunnel, and control subscriber sessions stealthily. ...

🔧 Technical Details

AuthDoor PAM Backdoor: Overwrites the pam_unix.so library to hook pam_sm_authenticate, capturing and ASCII-hex encoding credentials into /usr/bin/.dbus.log, while accepting a hard-coded magic password for persistent SSH access. It uses atomic temp-file renames to avoid partial writes and allow stealthy updates. 🎁 PoC

Cordscan Telecom Scanner: A custom Go utility that sends GTP-C context-request packets over UDP 212...

🤖 Agent Actions

Added content from the Unit42 telecom-network intrusion report to HackTricks:

1. Created new file
   src/generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.md
   • In-depth GTP/roaming attack methodology (Cordscan, GTPDoor, SGSN-emu pivot, covert channels, defence evasion, detection ideas, toolbox)
   • Proper HackTricks banners and references section.

2. Linked the new page from pentesting-network/README.md under a fresh “Telecom / Mobile-Core (GTP) Exploitation” subsection.

3. Enhanced linux-post-exploitation PAM page:
   • Added practical “Backdooring PAM – Hooking pam_unix.so” section (source code, compilation, OPSEC, detection).
   • Appended the Unit42 blog URL to references.

These additions integrate the new telecom-specific techniques ...

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/

Content Categories: Based on the analysis, this content was categorized under "generic-methodologies-and-resources/pentesting-network/telecom-network-exploitation.md".

Repository Maintenance:

• MD Files Formatting: 863 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge