Telecommunications threat intelligence over an API
State espionage inside carrier networks, exploited edge equipment, subsea cable incidents and signalling fraud, clustered from 20,000+ sources into scored incident records you can query from code. Every account gets a free key: 100 credits a day over the last 7 days, no card.
Why telecommunications needs its own threat picture
A telecoms operator is a nation's nervous system and a permanent intelligence target. The same team is expected to defend the mobile core, the transport network, the retail estate, the OSS/BSS back office and a supplier chain of equipment vendors and managed-service partners, while a regulator, a national cyber authority and a board all ask the same question after every headline: are we exposed to that.
The reporting is already out there. An espionage group is found inside a carrier, a dozen outlets write it up, two vendors publish analysis, a national authority issues an advisory, and someone has to read all of it to answer that one question. ThreatCluster collapses that reporting into one record per incident, so the answer is a query rather than an afternoon.
State groups come for carrier access
State-aligned groups do not breach a carrier for its customer table. They want lawful-intercept systems, call records, location data and a foothold to reach every subscriber downstream. That changes who is coming for you and how long they intend to stay.
The threat runs down to the physical layer
Subsea cables, landing stations, exchanges and mast sites are attack surface in a way no enterprise network is. A cut cable and a compromised router are the same continuity problem to a customer, and both belong in the same threat picture.
Carrier intrusions start at the equipment vendors
Edge appliances, routers, mobile-core and OSS/BSS platforms are where carrier intrusions begin. One exploited CVE in a widely deployed piece of network kit is a sector-wide event, and you learn who else was hit only from reporting.
Fraud is a security problem here
SIM-swap, SS7 and signalling abuse, and roaming fraud sit between the fraud team and the SOC, and the intelligence about the actors running them rarely reaches either. It is clustered here alongside the intrusion reporting.
What a telecommunications record carries
Density-based semantic clustering groups every source covering the same event into a single record. Roughly 900 articles a day become around 70 clusters, and each one keeps updating as coverage grows. For the sector that means:
- One record per incident
- A rewritten title and summary, a sourced timeline, extracted entities (actors, malware, CVEs, victims), IOCs, MITRE ATT&CK mapping and a 0 to 100 threat score. One id to follow instead of 20 headlines.
- Exploitation status
- Confirmed in-the-wild exploitation is separated from the rest of the vulnerability queue. CVEs and advisories for routers, VPN and edge appliances, mobile core, OSS/BSS and telecoms ICS are clustered against the affected vendor and product. That distinction is what justifies an emergency change window on a live carrier network.
- Vendors as entities
- Network-equipment makers, managed-service partners and interconnect suppliers are extracted as entities you can query and watch. If one appears in reporting or on a leak site, it is in the data on the day.
- Physical-layer incidents
- Cable cuts, landing-station incidents, sabotage and outages are clustered alongside cyber reporting, in the same record format.
- Dark-web coverage
- Ransomware leak-site victims from our own Tor collection, filterable by sector, group and country, with screenshots and extracted data on enriched records.
Over the API
The telecommunications slice is a filter, not a separate product. The same endpoints that serve the whole corpus take a keyword or sector parameter, authenticated with an X-API-Key header.
Clustered incidents mentioning the sector, newest first, each with entities, score and timeline:
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/threats?keyword=telecommunications"
Leak-site victims in the sector, from our own dark-web collection:
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/darkweb/ransomware/victims?sector=Telecommunication"
The free key covers every read endpoint: incidents, IOCs, entities, vulnerabilities and dark web, with 100 credits a day over the last 7 days. Starter at $19.99 a month raises that to 1,000 credits a day with full records and all history. The full surface is in the OpenAPI docs and the plans are on the pricing page.
The public feeds and the IOC blocklist need no key or account at all.
Evidence for the frameworks you are assessed against
Telecoms operators sit inside some of the strictest regimes in critical infrastructure, most of which expect documented, current awareness of sector threats rather than a generic risk register.
- NIS2
- Telecoms is an essential entity in the EU, with a 24-hour early warning and 72-hour notification clock.
- TSA and TSR
- The Telecommunications (Security) Act and regulations, with the NCSC code of practice, for UK public networks and services.
- FCC and CISA
- FCC CPNI rules and CISA cross-sector requirements for US carriers.
- ISO 27001
- Annex A 5.7, threat intelligence, as a named control.
ThreatCluster is the monitoring and evidence layer underneath these. It does not make you compliant. It produces the dated, sourced record an assessor asks for, and because it is an API, that record can land in your own compliance tooling.
In the sector right now
Every incident here is drawn from live clustering. The telecommunications entity page carries the full history: active clusters, associated threat groups, and the most recent reporting, updated continuously.
Telecommunications threat intelligence FAQ
What is threat intelligence for telecommunications?
Monitoring and analysis of the threats specific to telecoms operators: state-sponsored espionage groups inside carrier networks, exploited vulnerabilities in edge and core network equipment, physical attacks on subsea cables and landing stations, SIM-swap and signalling fraud, and breaches at the vendors that supply the network.
Which threat actors target telecoms operators?
State-aligned espionage groups such as Salt Typhoon and other China-, Iran- and Russia-linked clusters are the most persistent, alongside ransomware groups hitting back-office and OSS/BSS systems and fraud operators exploiting SS7, SIM-swap and roaming. Current activity for each is tracked on their entity pages.
Do you cover network equipment and edge vulnerabilities?
Yes. CVEs and advisories for routers, VPN and edge appliances, mobile core, OSS/BSS and telecoms ICS are ingested alongside enterprise IT reporting and clustered against the affected vendor and product, with in-the-wild exploitation flagged separately.
Do you cover physical-layer and subsea cable incidents?
Yes. Cable cuts, landing-station incidents, sabotage and outages affecting the physical transport layer are clustered alongside cyber reporting, because for a carrier the two are the same continuity problem.
Does ThreatCluster need to be installed on our network?
No. It is a hosted platform and an outbound API. Nothing is deployed on network or corporate infrastructure; your code calls us.
Is there a free version?
Yes. Every account includes a free API key with 100 credits a day over the last 7 days, covering every read endpoint, with no card required. Starter is $19.99 a month with 1,000 credits a day and full history. Business is $399 a month. The public feeds and IOC blocklist need no key at all.
Get started
Mint a free key, make the first call against the sector in a minute, and wire the records into whatever already runs your queue.