Keypoints
- GTPDOOR is Linux-based malware designed for deployment on systems in telco environments adjacent to GRX (GPRS Roaming eXchange) networks.
- The malware uses GTP-C (GPRS Tunnelling Protocol — Control Plane) signalling messages as its command-and-control (C2) channel.
- Embedding C2 in GTP-C allows traffic to blend with legitimate roaming signalling and to reuse ports already permitted to the GRX network.
- Actors with persistence on the roaming exchange can reach compromised hosts by sending GTP-C Echo Request messages containing a malicious payload.
- The technique leverages telecom-specific protocols and infrastructure to reduce visibility and evade typical network filtering focused on conventional C2 channels.
MITRE Techniques
- No MITRE ATT&CK technique IDs or names were explicitly mentioned in the article.
Indicators of Compromise
- [Domain] Reporting and analysis sources – https://doubleagent.net/telecommunications/backdoor/gtp/2024/02/27/GTPDOOR-COVERT-TELCO-BACKDOOR (detailed analysis), https://thehackernews.com/ (news report)
GTPDOOR targets Linux hosts positioned on or near GRX infrastructure, relying on the operator having already achieved persistence within that roaming exchange environment. Once present, the backdoor encodes its command-and-control channel inside GTP-C signalling — specifically leveraging control-plane messages — so that C2 traffic appears as normal GPRS signalling and traverses ports and paths routinely allowed for GRX traffic.
Operationally, the attacker can deliver commands and payloads by embedding them into GTP-C Echo Request messages sent to compromised hosts; this approach reuses existing, permitted signalling channels and reduces anomalous indicators at the IP/port level. Because GTP-C is a telecom-specific control protocol, standard enterprise network monitoring and detection tuned to common C2 protocols may fail to flag these sessions without inspection of GTP message contents or telemetry from GRX elements.
Detection and mitigation should therefore focus on telescoping visibility into GTP traffic at roaming exchange boundaries, validating the content and frequency of GTP-C messages (including Echo messages), restricting which hosts are permitted to send control-plane messages into GRX, and monitoring for unusual payloads or patterns within GTP signalling. Hardening GRX-facing hosts and applying strict segmentation and logging for control-plane traffic are key to reducing this attack surface.
Read more: https://doubleagent.net/telecommunications/backdoor/gtp/2024/02/27/GTPDOOR-COVERT-TELCO-BACKDOOR