Severity: High | Priority: 1
Enea has reported new activity by LIMINAL PANDA, a China-nexus espionage group that specialises in mobile operators. The group compromises Linux systems in mobile core and roaming networks. It then uses the trusted interconnect between operators to reach further networks and collect subscriber information. Enea has detected hundreds of covert command-and-control attempts across its operator customers. It has direct evidence of five to ten infected operators and believes several dozen more may be affected worldwide.
This update covers two implants. GTPDoor v3 is a new version of the group’s GTPDoor backdoor. Earlier versions hid commands in GTP control-plane signalling. This one hides them deep inside GTP-U user-plane traffic, the highest-volume and least-inspected traffic on the interconnect, and a protocol that carries over into 5G. It captures packets passively, so it doesn’t show up as a listening process in tools such as netstat or lsof. Enea believes the group keeps it as a fallback for when other access is blocked. SCTPE, which CrowdStrike tracks as SIGweaver, is a Linux kernel-level implant. It injects SS7 and Diameter signalling messages through SCTP connections that already exist on the infected node. That lets an attacker send forged location updates and other signalling that can divert a subscriber’s calls and text messages. Its behaviour partly overlaps with SilentAir, a separate actor seen intercepting SMS verification codes, mostly from Taiwanese users.
These threats mainly concern mobile operators and companies that run packet-core, signalling or roaming infrastructure. If your network includes such systems, scan the Linux hosts in the packet core and signalling layers: SGSN, GGSN, P-GW, STP, DRA and IPX- or GRX-facing nodes. Don’t rely on netstat or lsof to find GTPDoor. Look instead for unexpected processes capturing packets or using raw sockets, unfamiliar kernel modules, and processes using system-style names.
Restrict administrative access to core network elements, and monitor GTP-U, GTP-C, SS7 and Diameter traffic for anomalies with signalling firewalls. If either implant is found, treat the node and any systems it can reach as compromised.