IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE5 IOCs

Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions

CY
Cyble
Published September 25, 2026Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYSalt TyphoonINFRASTRUCTUREunknownCAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure
Capability
Victim

Indicators of Compromise

Indicators of Compromise5

TypeIndicatorConfidenceScoreFirst Seen
CVECVE-2023-46805
exploitintel-blogmalware
Medium
56
Jun 2, 26
CVECVE-2023-20273
exploitintel-blogvulnerability
Medium
51
Sep 26, 26
CVECVE-2023-20198
exploitintel-blogmalware
Medium
53
Jun 25, 26
CVECVE-2024-21887
exploitintel-blogmalware
Medium
56
Jun 2, 26
CVECVE-2024-3400
aptespionageexploit
High
79
Jun 2, 26

IOC Relationship Graph

IOC Relationship Graph5 total IOCs
CVE
CVE5Actors1REPORTInside the Telecom Attack Salt Typhoon
scroll to zoom · drag to pan · click IOC to open