INDUSTRY FACT FILE · TELECOMMUNICATIONS & CONNECTIVITY

Threat Landscape: Top Cyber Threats Facing Telecom and Connectivity Providers

The 18 most relevant cyber threats, attacks and industry challenges for mobile operators, ISPs, enterprise connectivity providers, infrastructure providers and network vendors.

Telecom providers face two very different adversaries: nation-state actors seeking long-term access to network infrastructure for espionage, and criminals exploiting SIMs, messaging and subscribers for fraud. Reports based on I4C data put cyber-fraud losses across all channels at about ₹19,813 crore in 2025, much of it enabled by phones and messaging.

In 2024 US authorities reported state-backed intrusions into several major US carriers, and in 2025 a large South Korean operator disclosed a breach of subscriber SIM data—showing that cores, routers and subscriber systems are all in scope.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by telecom segment (Codec Networks assessment).

4.1 Nation-state network intrusion

State-backed groups target routers, cores and management systems for long-term access, often exploiting known vulnerabilities in edge devices and living off the land.

• Questions to test: Are network devices patched and hardened? Are configurations monitored for unauthorised change? Is there active threat hunting on network infrastructure?
• Relevant services: network device hardening, threat hunting, configuration integrity monitoring, red teaming.

4.2 SIM-swap and subscriber fraud

Fraudsters bribe dealers or impersonate subscribers to obtain replacement SIMs, then capture banking OTPs.

• Questions to test: How is identity verified for SIM replacement? Are dealer actions monitored? Are SIM-change signals shared with banks?
• Relevant services: SIM-change process review, dealer monitoring, fraud analytics, insider investigations.

4.3 Cloud-native 5G core

5G standalone cores run as containerised network functions communicating over APIs. Unauthenticated APIs and weak Kubernetes controls expose subscriber and session data.

• Questions to test: Are network function APIs mutually authenticated and authorised? Are clusters hardened? Is core telemetry monitored?
• Relevant services: cloud-native core assessment, Kubernetes review, API testing.

4.4 Vendor and supply-chain access

Network vendors and managed partners often hold standing remote access to element managers. Phished vendor credentials can lead to network-wide disruption.

• Questions to test: Is vendor access brokered, time-bound and recorded? Are vendor products from trusted sources and tested?
• Relevant services: vendor access review, supply-chain assessment, change monitoring.

4.5 Detection and the 6-hour clock

The Telecom Cyber Security Rules require reporting within six hours of becoming aware of a security incident, and CERT-In requires six-hour reporting too.

• Questions to test: Are network, core and IT telemetry centralised and monitored 24x7? Is there a playbook covering both DoT and CERT-In reporting?
• Relevant services: telecom-aware SOC, playbooks, tabletop exercises, IR retainer.

• DoT: security incidents reported within six hours of becoming aware, with details within 24 hours, under the Telecom Cyber Security Rules, 2024.
• CERT-In: cyber incidents reported within six hours.
• Public interest: the Government may inform the public or direct the entity to do so where disclosure is in the public interest.
• Privacy: subscriber personal data breaches must be intimated to the Data Protection Board once DPDP breach provisions commence in May 2027.
• Enterprise customers: contracts require notification and may trigger SLA penalties.

• Are we fully aligned to the Telecom Cyber Security Rules, with a policy and CTSO in place?
• Could we detect a quiet intrusion in our routers or 5G core?
• How do we verify identity before replacing a SIM?
• Who can reach our network elements, and is vendor access recorded?
• Could we report an incident to DoT and CERT-In within six hours?
• Are our network products from trusted sources and security-tested?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events. I4C figures cover all channels.