Telecoms

State actors took carrier networks on CVEs that were already public.

The same edge devices, management plane and administering directory the advisory describes.

Cracken runs the authorized version against your provider edge, the management plane behind it, and the corporate estate that administers both, then returns which known exposures an operator can chain into access. The signaling plane and the 5G core network functions behind it are covered by no playbook that ships today.

Book a demo
See the platform
Definition

What is telecom network penetration testing?

Telecom network penetration testing attacks a carrier's own infrastructure under written authorization: provider edge and customer edge routers, the management systems that reach them, and the corporate IT estate that administers both. It settles which known exposures an operator can chain into access to routing and subscriber systems. — Joint Cybersecurity Advisory AA25-239A, Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (CISA, 27 August 2025, last revised 3 September 2025)

Edge devices, exploited rather than listed

The Network Pentest playbook runs the public exploit against the device you put in scope, under per-action approval. A version banner stops being the answer.

The management plane behind them

Sweeps which management interfaces answer, and from where. What the topology diagram claims and what the network grants are two different lists.

The identity that administers the gear

AD Pentest walks whether an ordinary corporate account reaches the accounts that log into network equipment. That bridge turns one router into the estate.

Every finding traced back to its command

The operation ledger keeps the command, its output and the artifact captured from it. The Cybergraph keeps the paths between hosts, services and identities.

Salt Typhoon / OPERATOR PANDA — PRC state-sponsored actors working backbone routers and provider-edge and customer-edge routers since at least 2021, per joint advisory AA25-239A, co-sealed by 23 agencies across 13 countries.

The Salt Typhoon route, walked against your own edge

Five stages the joint advisory documents. Cracken runs the first three; the last two are where a real operator keeps going and an authorized run stops.

  1. 1Reconnaissance
    Attacker

    Simultaneously exploits large numbers of internet-exposed devices across many IP addresses, revisiting individual systems for follow-on operations.

    With Cracken

    Domain Recon builds the same external inventory from DNSDB, crt.sh and Shodan. It is passive only — no port scan, no HTTP probe, no DNS brute force at this stage.

  2. 2Initial access
    Attacker

    Exploits a publicly known CVE on an internet-facing edge device. The advisory records no observed zero-day use and names six CVEs, the oldest published in 2018.

    With Cracken

    Network Pentest runs that exploit against the device you authorized, under per-action approval, so a listed CVE either becomes an exploitable one or it does not.

  3. 3Pivot through trusted connections
    Attacker

    Uses the compromised device and private interconnections — provider-to-provider or provider-to-customer links — to reach the next network.

    With Cracken

    Maps what the foothold actually reaches, then runs AD Pentest against the domain that administers the network estate to see whether a corporate identity bridges into it.

  4. 4Persistence on the device
    Attacker

    Modifies router configuration, creates unauthorized administrative accounts, and holds long-term access.

    With Cracken

    Stops here. No implant development or device-persistence playbook ships. The run proves the access that would let one be planted, and names that as the boundary.

  5. 5Collection and exfiltration
    Attacker

    Enables SPAN/RSPAN/ERSPAN traffic mirroring and builds GRE or IPsec tunnels and static routes to move captured traffic out.

    With Cracken

    Does not mirror or move your traffic. It hands over the path and the artifacts behind it. Cracken validates exposure; closing it is your network team's work.

One run

An edge device that answers, and what it reaches from there.

A carrier's own estate: two public ASNs in scope for passive collection, a named block of internet-facing edge and management addresses in scope as targets, and a Tentacle on a spare Linux host in the OSS administration VLAN. Devices, addresses and the CVE are illustrative.

Written from the execution plan of the playbooks that run today — Domain Recon, Web App Pentest, Network Pentest, Cloud Pentest, AD Pentest. A run covers the target you authorise, under the policy you set.

  1. 01
    What ran

    Passive collection across the carrier's in-scope domains from DNSDB, crt.sh and Shodan. The Domain Recon playbook is passive only - no port scan, no HTTP probe and no DNS brute force touches the target at this stage.

    T1596 — Search Open Technical Databases
    What it established

    An external inventory of resolving addresses, the services answering on each, and the CVEs already attributed to them. This is the candidate list everything after it works from.

  2. 02
    What ran

    nmap sweep and version detection from the Tentacle against the authorized management addresses, then the same against the edge block from outside. nmap is the tool the Network Pentest playbook names.

    T1046 — Network Service Discovery
    What it established

    Which management interfaces answer, from where, and the version behind each. Reachability the topology diagram claims and reachability the network grants are two different lists.

  3. 03
    What ran

    Exploitation of one unpatched edge service from that list, run against the live device under per-action approval, with the Metasploit Framework from the Tentacle's Kali baseline.

    T1190 — Exploit Public-Facing Application
    What it established

    That the CVE is exploitable on this device in this configuration. A version banner match would have established nothing. AA25-239A tags the actors' own initial access with the same technique.

  4. 04
    What ran

    Active Directory Pentest against the domain that administers the network estate: enumeration, Kerberos service-ticket requests, certificate templates, delegation, ACLs and trusts, with every candidate path written into the Cybergraph. The bundle has no cracking or spraying skill, so recovered material is handled out of band or the path stops there.

    T1558.003 — Kerberoasting
    What it established

    Whether an ordinary corporate identity reaches the accounts that log into network gear. That bridge, not the router on its own, is what turns one device into the estate.

  5. 05
    What ran

    Every command, its output and the artifacts captured from it land in the operation ledger. The edge and management addresses that answered, the OSS hosts behind them, and the routes between the two are written to the Cybergraph — the carrier's own estate, not a subscriber's traffic.

    What it established

    A trail that runs from any finding back to the command that produced it, and a path list the team that owns the fix can work from.

What this did not prove: Nothing here touches the signaling plane. SS7, Diameter and GTP abuse, and the 5G core functions behind them, are covered by no playbook that ships. Neither is device persistence: no implant or firmware playbook exists, so the run proves the access that would let one be planted and stops there. Nothing here says whether one would survive on that gear.

MITRE ATT&CK v19.0, April 2026

The model that will not run the exploit is the one most tools are built on

Ask a general-purpose model to execute a public router exploit against a device you own and it hedges or quietly declines. Cracken's model does the work, and the research behind that is published.

?

Run the exploit, not the description of it

The Network Pentest playbook executes the public CVE against the in-scope device under per-action approval, rather than returning a paragraph about how it would work.

?

Refusal counted in the open

RedLineBench publishes 153 grounded offensive-security tasks, run across nine models and scored by two independent judges, MIT-licensed, so silent refusal is a measurement instead of an argument.

?

Cyber refusal removed, and only cyber

Cracken's published abliteration work takes cyber refusal on a 1T-parameter model from 100% to 7% while explicit-content refusal holds at 100% and other domains keep 44-88%, a 13x selectivity ratio.

The actors in that advisory needed no zero-day. Run the same tradecraft against your own estate first.
Questions

What a carrier asks before Cracken touches the edge

Does Cracken test SS7, Diameter or GTP signaling?

No. Five playbooks ship today — Domain Recon, Web App Pentest, Network Pentest, Cloud Pentest and Active Directory Pentest — and all five operate on IP infrastructure, cloud accounts and identities. The signaling plane and the 5G core network functions behind it are covered by none of them, and no mobile-core playbook is written. What Cracken covers in a carrier is the route the AA25-239A actors actually took: internet-facing edge devices, the management plane, and the corporate estate that administers both.

The actors sat in carrier networks for years. What would running this earlier have changed?

It would not have found an operator already inside. That is detection and incident response, and Cracken does neither. What it changes is the input. The joint advisory, co-sealed by 23 agencies across 13 countries, records that "Exploitation of zero-day vulnerabilities has not been observed to date" and names six publicly known CVEs, the oldest published in 2018. Every one of them sat on a scanner output before it sat on an intrusion timeline. Validation is the work that separates a listed CVE from an exploitable one. — Joint Cybersecurity Advisory AA25-239A, Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (CISA, 27 August 2025, last revised 3 September 2025)

We are a small operator. Why would a state actor come for us?

Because ownership is not the filter. The advisory states: "The APT actors may target edge devices regardless of who owns a particular device. Devices owned by entities who do not align with the actors' core targets of interest still present opportunities for use in attack pathways into targets of interest." Peering and provider-to-provider interconnection make your edge a route into someone else's core. Your edge is in scope whether or not you are the objective. — Joint Cybersecurity Advisory AA25-239A, Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (CISA, 27 August 2025, last revised 3 September 2025)

Most of what we see is hacktivist DDoS. Does this help with that?

No. Cracken does not run or absorb volumetric attacks, and DDoS resilience is a different purchase. ENISA puts hacktivist-led DDoS at 57.5% of attacks on EU digital-infrastructure entities, with telecommunications the largest impacted sub-sector at 25.1%. Exposure validation addresses the intrusion half of that picture, the footholds and the data breaches behind them, and leaves the flood to your scrubbing provider. — ENISA Threat Landscape 2025, section 5.3, Digital Infrastructure and Services (v1.2, revised 9 January 2026, ENISA, October 2025)

Can this run against production network gear without dropping traffic?

A new operation starts in Manual, where every action waits for you. Raise it to Semi and the realm's policy decides: on SA2 - Recon Execution, the default preset - read-only reconnaissance runs on its own while scans and anything that mutates, including the sweep this page describes and the exploit against a live device, queue for approval. The authorized address ranges and the intrusiveness ceiling are fixed before the first packet, approval is per action, and the operation can be stopped mid-step. Nothing stops you pointing the first pass at a lab device on the same platform and promoting to live once the ceiling is agreed.

Where does this sit against the vulnerability management programme we already run?

Upstream of the ticket. Cracken reads asset and vulnerability context from the scanners already deployed, including Tenable, Qualys and Rapid7 InsightVM, and treats their output as a candidate list rather than a verdict. It returns the subset an operator can chain into access, with the command that ran and the artifact it produced behind each one. It does not patch, it is not incident response, and it does not fire a canned technique at a control to see whether the control blinks.

If you run the operation

See the engine underneath this.

Tentacles, the Cybergraph, the approval gate every action passes through, and the operation ledger that records what ran. Telecoms is one playbook on top of that engine.

If you own the risk

Start from the exposure, not the technique.

One playbook answers one question. The case for validating exposure at all — why a scanner score is not a finding, and what changes when something proves the path instead of ranking it — is the argument this page assumes.

Use cases

Playbooks for Telecoms

See all use cases

Prove which of your known exposures reach the routing plane.

Scope a run against your management plane and administering identities.

Book a demo