GSMA’s 2026 Security Report Highlights Persistent Telecom Intrusions and Supply Chain Risks
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
GSMA’s 2026 telecom security report reviews 2025 threats, highlighting persistent intrusions, accessible attack tools, supply chain exposure and scams. It recommends stronger baseline controls, threat hunting and preparation for AI and quantum risks.
Key points
- The report identifies six priority threat areas: software attacks, lower barriers to launching attacks, persistent pre-positioning, weak cyber hygiene, supply chain compromise and consumer scams.
- Attackers can maintain quiet access for months or years, using legitimate tools, low-volume data exfiltration and periodic command-and-control connections; GSMA recommends proactive threat hunting.
- GSMA profiles Salt Typhoon, LightBasin, Scattered Spider and ShinyHunters, highlighting credential abuse, authentication bypass, social engineering and legitimate administration tools.
- Expanding cloud architectures and third-party services broaden supply chain exposure. Recommended controls include tightly scoped supplier access, segmentation, privileged access management and verification of deployed code.
- GSMA received 15 coordinated vulnerability disclosure cases in 2025, including issues involving 5G Standalone, access control and eSIM.
- Agentic AI introduces risks from trusted model output, tampered dependencies and excessive permissions. For post-quantum migration, the report recommends cryptographic inventories, system prioritisation and transition planning.
- The report prioritises MFA, patching, encryption, traffic monitoring and intelligence sharing, while recommending harmonised, risk-based regulation to reduce conflicting obligations.
Article Details
- Publisher
- GSMA
- Report Period
- Developments during 2025
- Scope
- Global security of mobile networks, devices, consumers, and the telecommunications supply chain.
- Key Statistics
- GSMA received 15 coordinated vulnerability disclosure cases in 2025, covering areas including 5G Standalone, Access Control, and eSIM.
- Deutsche Telekom reported 70 million attacks per day on its honeypot systems.
- Virgin Media O2 reported blocking 1 billion scam text messages on its mobile network; the report does not specify the measurement period.
- A cited smishing campaign reportedly leveraged 194,000 domains.
- TPG Telecom's collaboration with Apate.ai diverted more than 280,000 scam calls and reportedly prevented more than $7.6 million in estimated scam losses.
- Recommendations
- Strengthen baseline controls through MFA, regular patching, encryption of sensitive data, and network segmentation.
- Monitor network traffic and logs, conduct proactive threat hunting, and rehearse incident response.
- Apply secure-by-design development, API security practices, software composition tracking, and code repository protection.
- Assess supply-chain security throughout the lifecycle and restrict third-party privileged access using least privilege, attributable accounts, and time-limited access.
- Inventory cryptographic protocols, identify critical systems, and develop a risk-prioritised post-quantum cryptography transition plan.
MITRE ATT&CK
T1047 · Windows Management InstrumentationThe report identifies WMI among the native administrative capabilities used by the profiled actors.T1053 · Scheduled Task/JobThe report describes persistence through scheduled tasks among the profiled actors' overlapping techniques.T1059.001 · PowerShellThe report describes profiled actors using PowerShell to blend malicious activity with normal administration.T1078 · Valid AccountsThe profiled actors use stolen or purchased credentials and maintain persistence through valid accounts.T1090 · ProxyLightBasin uses publicly available proxy tools to relay traffic to adversary-controlled remote infrastructure.T1136 · Create AccountSalt Typhoon creates privileged accounts after gaining access to network routers.T1219 · Remote Access ToolsScattered Spider uses social engineering to induce installation of remote access tools.T1556.006 · Multi-Factor AuthenticationScattered Spider persuades support staff to enrol new MFA devices, bypassing existing authentication controls.T1566.004 · Spearphishing VoiceShinyHunters uses voice phishing and impersonates IT support or help-desk personnel.T1621 · Multi-Factor Authentication Request GenerationScattered Spider repeatedly sends MFA push notifications in the hope that victims approve a request.
People
Threat Actors
0ktapusExplicitly identified as an alternate name for Scattered Spider, alongside UNC3944.LightBasinCyber-espionage group targeting telecommunications and other industries, particularly Linux and Solaris systems; the report also names it UNC1945 and UNC281.Salt TyphoonCyber-espionage group targeting telecommunications infrastructure, energy networks, and government systems worldwide; explicitly identified as also known as UNC2286.Scattered SpiderFinancially motivated group using social engineering, SIM swapping, and MFA bypass; explicitly also known as UNC3944 and Octo Tempest.ShinyHuntersFinancially motivated group specialising in data theft, extortion, and leaks; the report says Google links it to UNC6040, without explicitly establishing an alias relationship.UNC3944Explicitly identified as an alternate name for Scattered Spider, alongside Octo Tempest.UNC6040Threat actor cluster that Google links to ShinyHunters, according to the report.
Products
Linuxindustry to be aware of the threat interception of communications and Their primary focus is targeting LinuxSalesforcecodes. They have also employed MFA like Salesforce, giving them direct accessSolarisactors referenced in this report. They manipulation of network configurations. and Solaris based systems using
Countries
Industries
Energyservices, or achieve financial, political, energy networks and government using a combination of custom backdoorsfinanceeven insiders within an organisation. create privileged accounts, and maintain telecommunications, finance, retail and telecommunication businesses across theGovernment22 https://www.gsma.com/newsroom/press-release/gsma-asia-pacific-mobile-industry-taskforce-calls-for-government-and-law-enforcement-support-to-stamp-out-sms-blaster-device-threat/HealthcareIt is crucial for the telecommunications persistent network access, allowing hospitality and health care industries. globe63.HospitalityIt is crucial for the telecommunications persistent network access, allowing hospitality and health care industries. globe63.Retaileven insiders within an organisation. create privileged accounts, and maintain telecommunications, finance, retail and telecommunication businesses across theTechnology| | future of mobile technology and | permitted by the security classification. |TelecommunicationsGSMA Mobile Telecommunications