Stealthy GTPDOOR Linux malware targets mobile operator networks

Security researcher HaxRob disclosed GTPDOOR, a stealthy Linux backdoor tailored to telecom infrastructure that uses GTP-C packets as covert C2 to blend with legitimate roaming traffic; two versions (v1/v2) support remote command execution, file writes, and ACL controls, and the malware is attributed to the LightBasin/UNC1945 threat group with detection guidance and a YARA rule provided.