Why Nation-State Threat Actors Are Targeting Telcos?
Nation-state actors like China are increasingly targeting telecom providers across the globe. Discover why Telcos are high-value targets and why these cyberattacks should concern the public.
Introduction
In recent months, the press has seen multiple publications concerning China-related threat actors attacking Telecommunications providers. While the public is probably more aware of the attack against US providers such as Verizon and AT&T, they are not the only targets. Chinese groups are known also to act against Telecom providers in Asia and other regions, and there is no reason to assume other nation state actors are not acting in the same way.
Why are China and other nation states so interested in Telcos? And why should we, the public, be concerned with those attacks?
To understand this better, we should go back to the basics.
The Criminal Nature of Cyber Attacks
Cyber attacks are, in general, a crime. While different countries might define crime differently, all definitions of crime are centered around “an unlawful act”. Without touching the moral questions of “good” and “bad”, there is no doubt that a cyber-attack against a company or an infrastructure in another country is unlawful, at least from the targeted country point of view.
After watching numerous films and tv shows, we all know that criminal activities are judged by three main parameters – means, opportunity, and motive. We’ll therefore use those criteria to specifically look at attacks against Telcos.
It is true that threat actors may use different means (or, as they are known in the cyber industry – TTPs – tools, techniques, and processes), to attack different types of infrastructures. But nation states that have the means to attack a Telco, can use similar, or even more simple tools, against a large retail chain, healthcare institute, or a financial organization.
About opportunity – this is likewise similar across industries. The attacker’s opportunity depends on the organization’s complexity, network vulnerabilities, and security posture. A telecommunications provider is normally a complex organization, but no less complex than, say, a large utility provider. The telco operator is normally not an easy target but is probably not the most difficult one – it might have fewer vulnerabilities and more mature security posture than that of a large private manufacturer, but is probably less secure than a large bank, as the latter is held, for many years, under the regulator’s microscope.
When looking at the question we asked, we should therefore look at the most important aspect – the attacker’s motivation and goals.
Some nation state actors are after money, but those are rare. While some may argue that this is too simplistic an approach, we can safely say that most nation state threat actors are looking to achieve two main goals – Information and Control, and in those two aspects, large Telecom providers are the holy grail.
Telecom providers supply us with fixed and mobile communication lines, and arguably most important – Internet access, without which our daily lives will be severely interrupted. One can argue that this is true also for the second attacker most targeted industry, banking, but this comparison just shows why Telecoms are so critical. Communications availability is so basic in our society, that shutting it down will directly and immediately harm thousands of lives (e.g. commuters, the sick, and people in need). In other words, telecoms could survive a few days without banks, but no bank can work without continuous communication.
Why Telcos Are More Critical Than Banks
Continuing with the same line of thought – there are over 1,000 Telecom carriers in the US. Many of them rely on infrastructure provided by very few large national networks such as Verizon or AT&T. In contrast, there are a few thousand banks in the US, many of them with independent networks. Lastly – many of us have multiple bank accounts but most of us hold only one phone. The above is true for every country in the world, and the implication is clear – the large Telecom providers are critical to our lives – and having the ability to control even one of those allows a threat actor to have a huge impact, whether they act on this ability, or just save it for future use.
Arguably more important is the second aspect – Information. Apart from subscribers’ personal details, network operators have direct knowledge about our private and business connections, calls we have made or received, and even more disturbingly, our whereabouts – every second of the day. Furthermore, by law, carriers are required to allow law enforcement agencies to monitor the content of our communications – text or calls, and recent reports claim nation state actors have gained access to this extremely critical interface. Most of us trust government agencies to request access to this data only with the necessary warrant, but nation state actors are not bound, naturally, by these same restrictions.
Finally, internet service providers (ISPs), and every Telco is an ISP, have access to communications “meta-data” including sensitive information like sites we have searched, or, in some cases, whom we sent emails to. The data itself might be encrypted, but is it strong enough to keep the information safe from a determined nation state actor?
Access to all this information allows threat actors to closely monitor us, citizens. But that’s not all – combining access and control allows them to manipulate the information as they wish – hiding tracks of their own activities, and in parallel, harming people that have done no wrong.
In summary – Telecom is probably one of the industries whose availability is most critical to the smooth functioning of our society. Securing the data Telecoms hold is essential to our privacy and freedom. This combination makes them one of the most lucrative targets nation state actors might have.
Conclusion
Now that we understand this – it is now our job to act. This is a wholly different matter that should be discussed separately, but as a minimum – we should be extremely demanding in ensuring carriers and relevant government agencies implement the highest security measures on those infrastructures, and in parallel, take extra care in the way each one of us use and relies on, this infrastructure.
Ram Elboim. (2025, April 18). Why Nation-State Threat Actors Are Targeting Telcos?, Sygnia.
https://sygnia-stg.prpl.global/blog/nation-states-interest-in-telecom-attacks/
Related Resources
By clicking Subscribe, I agree to the use of my personal data in accordance with Sygnia Privacy Policy. Sygnia will not sell, trade, lease, or rent your personal data to third parties.