The Covert Operator's Playbook: Infiltration of Global Telecom Networks

Unit 42 documents CL-STA-0969, a highly OPSEC-conscious, nation-state-associated espionage campaign targeting telecommunications roaming infrastructure in Southwest Asia (Feb–Nov 2024). The actors used bespoke telecom-aware implants and covert channels (GTP, DNS, ICMP, SSH tunneling), exploited legacy/unpatched systems and known local privilege-escalation CVEs, and deployed persistence and pivoting tools; the report includes technical TTPs, IoCs (SHA256s, filenames), and mitigation recommendations.