Stealthy campaigns targeting the telco core

Adversaries are shifting from opportunistic hits to coordinated, infrastructure-level campaigns. They blend into routine administration, using trusted tools and configuration drift to persist inside lawful interception paths, mobile core signaling, orchestration layers and subscriber databases.

Across network operators, 63% encountered at least one “living-off-the-land” campaign over the past 12 months, and almost a third saw four or more. When routine activity becomes the cover, the core becomes a hiding place.

DDoS attacks that are faster, stronger, and relentless

DDoS storms aren’t just big in terms of traffic volumes; when they happen, they are fast rising, like a tsunami. Peaks in the 5–10 Tbps range have become a daily norm and can occur in a very short time. 78% percent of DDoS attacks conclude within five minutes, and more than a third are completed in under two minutes.

Residential proxy networks with 100 million+ hijacked home devices and Mirai-descendant botnets like Eleven11 can unleash multi-terabit floods in a few minutes.

The report breaks down multi-vector patterns and shows how to design sub-60-second mitigation at the edge to keep traffic flowing.

Insider risk and hygiene gaps driving costly breaches

Nearly 60% of high-cost breaches in telecom stem from insider actions or mistakes, whether malicious or accidental. The report highlights that these incidents are often enabled by gaps in privilege management, credential misuse, and lack of behavioral monitoring. Real-world examples include contractors disabling multi-factor authentication, vendors reusing credentials, and even physical access being exploited to plant rogue devices.

76% of vulnerabilities are due to missing patches. Application flaws, weak passwords, and legacy systems widen the attack surface, making patching and monitoring essential.

Real-world case studies & field data

• Salt Typhoon and BPFDoor show how attackers can persist undetected for months or years, using device-level exploits and kernel implants that evade standard controls. These cases reveal how routine operations can mask long-dwell threats.
• Bite Latvija’s DDoS telemetry offers a real-world look at attack frequency and complexity, with thousands of multi-vector attacks per year, most peaking within minutes. Their experience underscores why sub-minute, automated enforcement is now essential for effective DDoS defense.