Critical national infrastructure, watched by everyone
A telecoms operator is a nation's nervous system and a permanent intelligence target. The same team is expected to defend the mobile core, the transport network, the retail estate, the OSS/BSS back office and a supplier chain of equipment vendors and managed-service partners, while a regulator, a national cyber authority and a board all ask the same question after every headline: are we exposed to that.
The reporting is already out there. An espionage group is found inside a carrier, a dozen outlets write it up, two vendors publish analysis, a national authority issues an advisory, and someone on your team has to read all of it to answer that one question. By the time it is answered, the next campaign, the next edge CVE and the next cable incident have landed.
That is the job ThreatCluster does before you open it.
Why the sector needs its own view
You are a target for the access, not the data
State-aligned groups do not breach a carrier for its customer table. They want lawful-intercept systems, call records, location data and a foothold to reach every subscriber downstream. That changes who is coming for you and how long they intend to stay.
The threat runs down to the physical layer
Subsea cables, landing stations, exchanges and mast sites are attack surface in a way no enterprise network is. A cut cable and a compromised router are the same continuity problem to a customer, and both belong in the same threat picture.
Your equipment vendors are the campaign
Edge appliances, routers, mobile-core and OSS/BSS platforms are where carrier intrusions begin. One exploited CVE in a widely deployed piece of network kit is a sector-wide event, and you learn who else was hit only from reporting.
Fraud is a security problem here
SIM-swap, SS7 and signalling abuse, and roaming fraud sit between the fraud team and the SOC, and the intelligence about the actors running them rarely reaches either. It is clustered here alongside the intrusion reporting.
What ThreatCluster does for a telecoms team
One record per incident
Density-based semantic clustering groups every source covering the same event into a single record with a sourced timeline, extracted entities, IOCs and MITRE ATT&CK mapping. Roughly 900 articles a day become around 70 clusters. You read the incident once.
A feed scoped to your actual network
Filter to telecommunications, to your equipment and platform vendors, and to the named partners and suppliers you depend on. Delivered by email, Slack, Teams, RSS or API. Nothing else reaches you.
Vendor and supply-chain monitoring
Track your network-equipment makers, managed-service partners and interconnect suppliers as watched entities. If one appears in reporting or on a leak site, you hear about it on the day, not when the advisory lands weeks later.
Exploitation status, not CVSS theatre
Confirmed in-the-wild exploitation is separated from the rest of the vulnerability queue. That distinction is what justifies an emergency change window on a live carrier network.
Indicators you can actually load
IOCs are filtered hard before publication rather than passed through, and exported in the formats your SIEM, TIP or firewall already reads.
Reporting that leaves the platform ready to send
Scheduled briefings and generated reports are written to be forwarded to a network operations director, a regulator or a board without a rewrite in between.
Running in an afternoon
- Tell it what you run. Network vendors, core and edge platforms, partners, sector. Takes a few minutes in the setup wizard.
- Pick how it reaches you. Digest, Slack, Teams, RSS or API. Most teams start with a daily digest and add integrations later.
- Wire the outputs in. IOC exports to the SIEM, hunt queries to the analysts, reports to the board and regulator pack.
No agents, no appliance, no data leaving your side. Nothing to deploy on the carrier network.
Evidence for the frameworks you are assessed against
Telecoms operators sit inside some of the strictest regimes in critical infrastructure, most of which expect documented, current awareness of sector threats rather than a generic risk register.
- NIS2 (EU): telecoms is an essential entity, with a 24-hour early warning and 72-hour notification clock
- The Telecommunications (Security) Act and TSR, with the NCSC code of practice, for UK public networks and services
- FCC CPNI rules and CISA cross-sector requirements for US carriers
- ISO 27001 Annex A 5.7, threat intelligence, as a named control
ThreatCluster is the monitoring and evidence layer underneath these. It does not make you compliant. It produces the dated, sourced record an assessor asks for.
Questions we get from telecoms buyers
“We already run a national CTI feed and an ISAC.”
Keep them. They cover the sector and the country. They do not cover the specific edge appliance, mobile-core platform and OSS/BSS vendor in your estate, or the managed-service partner with access to it. Most of our telecoms users run both.
“We do not have anyone to read another tool.”
That is the point of the clustering. The volume you receive drops rather than rises, because duplicate coverage is collapsed before it reaches you and the filter is set to your network.
“Our procurement will take six months.”
Start on the free tier while that runs. No card, no contract, no procurement involvement until you have decided it is worth buying.
“We are an equipment vendor or MVNO, not a national carrier.”
Same page, same product. Network-equipment makers, MVNOs, ISPs and managed-service providers use it to watch both their own exposure and the operators they sell into.
What we are tracking in the sector right now
Every incident here is drawn from live clustering. The telecommunications entity page carries the full history: active clusters, associated threat groups, and the most recent reporting, updated continuously.
Telecommunications threat intelligence FAQ
What is threat intelligence for telecommunications?
Monitoring and analysis of the threats specific to telecoms operators: state-sponsored espionage groups inside carrier networks, exploited vulnerabilities in edge and core network equipment, physical attacks on subsea cables and landing stations, SIM-swap and signalling fraud, and breaches at the vendors that supply the network.
Which threat actors target telecoms operators?
State-aligned espionage groups such as Salt Typhoon and other China-, Iran- and Russia-linked clusters are the most persistent, alongside ransomware groups hitting back-office and OSS/BSS systems and fraud operators exploiting SS7, SIM-swap and roaming. Current activity for each is tracked on their entity pages.
Do you cover network equipment and edge vulnerabilities?
Yes. CVEs and advisories for routers, VPN and edge appliances, mobile core, OSS/BSS and telecoms ICS are ingested alongside enterprise IT reporting and clustered against the affected vendor and product, with in-the-wild exploitation flagged separately.
Do you cover physical-layer and subsea cable incidents?
Yes. Cable cuts, landing-station incidents, sabotage and outages affecting the physical transport layer are clustered alongside cyber reporting, because for a carrier the two are the same continuity problem.
Does ThreatCluster need to be installed on our network?
No. It is a hosted platform. Nothing is deployed on network or corporate infrastructure, and integration is outbound only.
Is there a free version?
Yes. The free tier includes clustered intelligence and a daily digest, with no card required. Paid tiers add custom feeds, API access, IOC exports, reporting and workflows.
Start with the sector view, narrow it to your network
Free account, no card, no procurement. Set up a telecommunications feed in ten minutes and see what a week of filtered reporting actually looks like.