Telecom Red Team

A telecom red team is an adversary-emulation engagement against a mobile network operator, executed from the perspective of a realistic threat actor that has reached the interconnect or the operator's perimeter. The point is not to prove that any single signalling vulnerability exists — a penetration test does that — but to measure end-to-end detection and response: does the SOC see the activity, does the relevant team triage it, do the playbooks fire, do containment actions actually work on the production perimeter under time pressure?

Scenarios are built around documented adversary behaviour and the GSMA / 3GPP control set. Typical scopes include: a simulated roaming partner conducting SS7 location and IMSI-disclosure campaigns against a target subscriber base; a Diameter-borne attempt to relocate a subscriber's S6a state from a malicious VPLMN; a GTP overbilling or tunnel-hijack campaign on the GRX/IPX border; abuse of SMS home-routing weaknesses to intercept OTPs; SIP/IMS abuse against VoLTE/VoWiFi; on a 5G core, NRF service-registration abuse, SEPP bypass attempts on N32, and slice-isolation probes. Frameworks such as MITRE FiGHT (5G-specific adversary TTPs) and the GSMA threat catalogues guide scenario selection.

Where a penetration test aims for breadth and reproducibility of findings, and a security audit aims for control-baseline coverage, a red team aims for realistic end-to-end attack chains with detection metrics. Engagements are commonly run "purple" — with SOC collaboration after each scenario — so that detection gaps are converted into rule and playbook improvements rather than just listed in a report. Cross-protocol scenarios make the perimeter-wide framing in the Signaling Firewall guide especially relevant; SS7-specific scenario design is in SS7 Penetration Testing and the SS7 Security hub.