INDUSTRY FACT FILE · TELECOMMUNICATIONS & CONNECTIVITY

Five New Case Studies in Telecom Security

Original 2026 case studies, each written as a blog post, showing how current threats play out for telecom providers and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The SIM Swap That Emptied a Business Account 3.  Case Study 2: The Router Nobody Patched 4.  Case Study 3: The Core Function With an Open API 5.  Case Study 4: The Vendor Support Tunnel 6.  Case Study 5: The Billing System Held to Ransom

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in telecommunications with the obligations that apply in India as of October 2026—in particular the Telecommunications Act, 2023, the Telecom Cyber Security Rules, 2024, CERT-In's Directions and the DPDP framework.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Provider type	Core threat	Regulatory lens	Primary bundles
1. The SIM Swap That Emptied a Business Account	Mobile network operator	Dealer-assisted SIM-swap fraud	Telecom Cyber Security Rules; CERT-In; DPDP	B3, B7, B8
2. The Router Nobody Patched	Internet service provider	Nation-state persistence in edge routers	Telecom Cyber Security Rules; CERT-In	B1, B7, B8
3. The Core Function With an Open API	5G mobile operator	Unauthenticated network function API	Telecom Cyber Security Rules; DPDP	B3, B1, B7
4. The Vendor Support Tunnel	Mobile operator with managed services	Abuse of vendor remote access	Telecom Cyber Security Rules; trusted sources	B9, B3, B7
5. The Billing System Held to Ransom	ISP and broadband provider	Ransomware on OSS/BSS	Telecom Cyber Security Rules; CERT-In; DPDP	B7, B8, B10

The new SIM was issued in minutes. The bank account was emptied in hours.

At a glance
Organisation	A mobile operator (“Operator A”) with a large retail dealer network
Threat	A bribed dealer issuing a replacement SIM to a fraudster
Why it is new	SIMs are the second factor for most banking
Codec Networks services	SIM-change controls review, fraud monitoring, investigation (Bundles B3, B7, B8)

The scenario

Fraudsters gathered a small business owner's personal details through phishing.

A dealer, paid by the fraud ring, accepted forged documents and issued a replacement SIM late in the evening.

Bank OTPs went to the new SIM and the business account was drained overnight. The victim complained to the operator, the bank and the police.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Verification for SIM replacement was weak.
• Dealer actions were not monitored for anomalies.
• SIM-change signals were not shared with banks.
• Dealer fraud had no investigation process.

The impact

Operator A faced complaints, scrutiny of its dealer controls and reputational damage.

The regulatory lens

• Telecom Cyber Security Rules: security incidents reported within six hours where they meet the rules' definition.
• DoT KYC and licence conditions: verification requirements for SIM issuance.
• DPDP Act and Rules: subscriber data safeguards once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden SIM changes	SIM-change process and dealer access review	B3
Spot fraud	Dealer anomaly and SIM-change monitoring	B7
Investigate	Dealer and insider fraud investigation	B8

Key lessons Verify identity strongly for SIM changes. Monitor dealer behaviour. Share SIM-change signals with banks. Investigate dealer fraud quickly.

Nothing broke. That was the problem.

At a glance
Organisation	A national ISP (“ISP B”) with enterprise and government customers
Threat	A known router vulnerability exploited for long-term espionage access
Why it is new	Edge devices are prime targets for persistent access
Codec Networks services	Device hardening, threat hunting, forensics (Bundles B1, B7, B8)

The scenario

ISP B's edge routers ran firmware with a known vulnerability, patched only on some devices.

A state-backed group exploited it, added hidden configuration and collected traffic metadata and configurations for months.

A threat intelligence tip-off led to discovery. ISP B had to report, rebuild devices and assess what was taken.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Patching of network devices was inconsistent.
• Configuration changes were not monitored.
• No threat hunting on network infrastructure.
• Management access was not restricted.

The impact

ISP B faced reporting obligations, costly clean-up and difficult conversations with government customers.

The regulatory lens

• Telecom Cyber Security Rules: reporting within six hours of becoming aware, with details within 24 hours.
• CERT-In Directions: incidents reported within six hours.
• NCIIPC: additional coordination where systems are notified as critical.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden devices	Router and firmware security review	B1
Hunt	Threat hunting on network infrastructure	B7
Investigate	Network intrusion forensics	B8

Key lessons Patch network devices consistently. Monitor configuration integrity. Hunt for quiet persistence. Restrict management access.

The core was cloud-native. So were its mistakes.

At a glance
Organisation	A mobile operator (“Operator C”) launching a 5G standalone core
Threat	A network function API reachable without authentication from a management segment
Why it is new	5G cores bring cloud and API risks into the network
Codec Networks services	Cloud-native core assessment, API testing, monitoring (Bundles B3, B1, B7)

The scenario

During a rushed launch, a network function's API was exposed on a management network without mutual TLS or authorisation.

An attacker who had compromised a jump host discovered the API and queried subscriber and session data.

Data was exfiltrated slowly over weeks before unusual API usage was noticed.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No mutual authentication between network functions.
• Management segments were flat.
• Kubernetes and API controls were not reviewed before launch.
• Core telemetry was not monitored.

The impact

Operator C faced reporting obligations, potential DPDP exposure and a redesign of its core security architecture.

The regulatory lens

• Telecom Cyber Security Rules: security incidents reported within six hours.
• DPDP Act and Rules: subscriber data safeguards and breach intimation once provisions commence.
• CERT-In Directions: incidents reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Secure the core	Cloud-native core and Kubernetes review	B3
Test the APIs	Network function API testing	B1
Watch the core	Core telemetry monitoring	B7

Key lessons Mutually authenticate network functions. Segment management networks. Review the core before launch. Monitor core APIs.

The tunnel was always open, just in case.

At a glance
Organisation	An operator (“Operator D”) whose network vendor provides remote support
Threat	Phished vendor credentials used through a standing support tunnel
Why it is new	Standing vendor access is a back door into network management
Codec Networks services	Vendor assessment, access brokering, change monitoring (Bundles B9, B3, B7)

The scenario

Operator D's vendor kept a permanent VPN tunnel into network management systems for faster support.

Attackers phished a vendor engineer and used the tunnel to log into element managers.

They altered configurations to disrupt service across a region, causing a major outage.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Vendor access was standing, not on request.
• No MFA or session recording.
• Configuration changes were not monitored.
• Vendor security was never assessed.

The impact

Operator D suffered a regional outage, regulatory reporting and a dispute with its vendor.

The regulatory lens

• Telecom Cyber Security Rules: incident reporting within six hours and details within 24 hours.
• Trusted-source directive: trusted products and sources in the network.
• Licence conditions: network security and availability obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess the vendor	Vendor security assessment	B9
Broker access	Time-bound, recorded vendor access review	B3
Watch changes	Network change monitoring	B7

Key lessons Make vendor access on-request only. Require MFA and recording. Monitor configuration changes. Assess vendor security.

The network stayed up. Nobody could recharge, pay or connect new customers.

At a glance
Organisation	A broadband provider (“ISP E”) with a large consumer base
Threat	Ransomware spreading from IT into billing and provisioning
Why it is new	OSS/BSS outages stop revenue and service changes
Codec Networks services	SOC monitoring, ransomware response, exercises (Bundles B7, B8, B10)

The scenario

A phishing email compromised an IT administrator's account at ISP E.

The attacker moved into OSS/BSS, stole subscriber data and encrypted billing and provisioning systems.

Recharges, billing and new connections stopped for days, and ISP E had to report the incident.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• IT and OSS/BSS were not segmented.
• EDR alerts were not monitored 24x7.
• Backups were reachable by the attacker.
• Ransomware recovery was never rehearsed.

The impact

ISP E lost revenue, faced subscriber complaints, regulatory reporting and potential DPDP exposure.

The regulatory lens

• Telecom Cyber Security Rules: incident reporting within six hours.
• CERT-In Directions: incidents reported within six hours.
• DPDP Act and Rules: subscriber data breach intimation once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Detect early	24x7 SOC with EDR	B7
Recover	Ransomware response and restoration	B8
Rehearse	Ransomware and crisis exercises	B10

Key lessons Segment IT from OSS/BSS. Monitor endpoints around the clock. Protect backups. Rehearse ransomware recovery.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com