Mobility APT Threat Intelligence — Index

#mobility #telecom #apt #threat-intelligence #open5gs

Mobility APT Threat Intelligence

BLUF. Public reporting shows that sophisticated actors usually enter an operator through ordinary enterprise, edge, vendor, or management systems and then move toward telecom-specific assets. In this lab, the most plausible post-entry paths terminate at the Docker host, unauthenticated 5G SBI, MongoDB subscriber store, Diameter trust links, or privileged packet-plane containers—not at a fictional “5G exploit.”

Reading order

Documented campaigns — what authoritative sources actually observed, including filenames and applications.
Attack surfaces and inspection files — operator-layer attack vectors and evidence to collect.
Local lab exposure map — exact repository files, observed conditions, and likely attack locations.
Defensive validation backlog — safe, non-destructive checks to close the largest gaps.
Source ledger — primary or authoritative sources and the claims each supports.

Evidence labels

Label	Meaning	Permitted language
D — Documented	The cited source reports the actor or incident performing the action.	“Observed,” “used,” or “compromised.”
A — Architectural	A standard or authoritative guide establishes the trust boundary or security requirement; no actor use is asserted.	“Could,” “exposes,” or “requires.”
L — Lab observed	The named file or running lab demonstrates the condition locally.	“Configured,” “present,” or “reachable in the lab.”
U — Unverified	Vendor/user report or hypothesis has not been reproduced or assigned a CVE.	“Reported,” “requires reproduction”; never “vulnerable” without qualification.

Attack-path model

Internet / vendor / registrar / UE
             |
             v
 edge appliance, DNS, support, CI/CD, or management identity
             |
             v
 operator management plane / Docker host / OSS-BSS
        |             |              |
        v             v              v
  5G SBI/NRF      subscriber DB    RAN/core config
        |             |              |
        +-------> policy and session state <------+
                           |
                           v
                 PFCP / GTP-U packet plane

The public evidence is strongest on the left side of this diagram: routers, DNS, Linux servers, Windows/IIS estates, privileged identities, and trusted inter-operator systems. The local lab gives us safe coverage of the right side after an attacker has obtained network or host access.

Scope guardrails

This section supports detection engineering, architecture review, and testing only in the owned lab.
It does not contain live-operator targeting, credential attacks, signaling abuse instructions, or exploit payloads.
A CVE is named only where the cited advisory applies to the named product and version.
A weak lab configuration is not automatically a software vulnerability.
A telecom incident is not automatically a mobile-core intrusion.
Actor aliases are preserved as the source uses them; alias overlap is not treated as proof that every report describes the same team.

Fast answer: where could activity happen here?

Priority	Local location	Why it matters
P0	Docker host and `lab/core/docker-compose.yml`	Compromise reaches every NF, test secret, virtual network, and privileged packet-plane container.
P0	NRF and the cleartext SBI on TCP/7777	The lab already demonstrates NF registration without authorization; Open5GS 2.7.6 is also in the affected range for CVE-2025-41067.
P0	MongoDB at `10.74.0.2`	The compose URI has no credentials; access exposes or changes subscriber authentication and policy data.
P1	UPF/SGWU containers and N3/S1-U	Privileged/root packet-plane services are a high-impact bridge from session control to user traffic.
P1	freeDiameter peers on TCP/3868	The checked-in peers explicitly use `No_TLS`; a foothold inside the Docker network inherits that trust.
P1	UERANSIM UE/gNB configuration	Static lab K/OP and null SUCI protection make identity and authentication material observable to a host/repository compromise.
P2	srsRAN NSA/SA configuration	Relevant for configuration integrity and handover/control-plane study; it is not a production RAN or a complete NSA data-plane target.