Security for Internet Service Providers and Telecoms

Why providers and carriers are a priority target

Internet service providers and telecom carriers occupy a unique position in the attack chain: they control not only their own systems, but the connectivity infrastructure and the equipment sitting inside every subscriber's home. This turns the ISP into two targets at once. The first is the network infrastructure itself — edge routers, BNGs, DNS servers, CGNAT, and transit links — whose unavailability affects thousands of customers simultaneously. The second is the installed base of CPEs (modems, ONUs, Wi-Fi routers) which, when compromised at scale, becomes a powerful botnet operating from within the provider's own network.

This dual exposure changes the economics of the attack. For an adversary, compromising a single CPE model with vulnerable firmware can mean hijacking tens of thousands of devices at once. For the provider, the cost is not only technical: it is reputational (a customer with no internet calls to complain), contractual (SLA with a corporate customer), and regulatory (subscriber data is personal data under the LGPD).

Mobile carriers and providers with voice/portability offerings also carry an additional vector: SIM swap fraud. By convincing (through social engineering) or bribing an agent, the fraudster transfers the victim's line to a SIM under their control, intercepting authentication SMS messages and taking over banking and digital accounts. Here the weak point is not a server, it is the customer service and activation process.

An ISP's threat map

The five fronts that generate the most incidents

Each of these fronts requires a distinct control, but all share a common requirement: visibility. Without collection and correlation of NetFlow/sFlow, BNG logs, CPE telemetry, and edge events, the incident is only noticed when the customer is already without service or when the data has already leaked. Decripte treats visibility as a precondition, not as an optional deliverable.

Anatomy of a botnet hijacking CPEs

The following anonymized real-world example is the most characteristic of the sector and guides the case study on this page. An adversary identifies a CPE model widely distributed by a provider whose firmware has a known vulnerability and whose management interface (often TR-069 on port 7547, or a web panel) is reachable over the WAN. From there, an automated worm scans the provider's ASN IP ranges, exploits the flaw, injects a malicious payload, and recruits the device into a botnet.

The initial symptom is rarely obvious. The subscriber notices slowness. The NOC sees an increase in outbound traffic at unusual hours. What is happening is that the hijacked CPEs begin participating in DDoS attacks against third parties, mining, malicious traffic proxying, or exfiltration — all originating from within the provider's network, which can land the ASN on reputation lists and blocklists.

Containment carries a delicate tension: blocking the compromised CPEs may leave legitimate subscribers without internet. The correct response combines selective quarantine (isolating the malicious traffic without cutting off the customer when possible), forced firmware update via a TR-069/ACS server, and closing the exposed management ports — all coordinated so that remediation does not become a second unavailability incident.

Edge security: the first line against DDoS

The edge layer is where the provider wins or loses the battle against DDoS. Decripte builds volumetric and application-layer mitigation, with WAF rules for the exposed services (subscriber portals, customer area, provisioning APIs) and filtering of anomalous traffic before it consumes the transit link. The goal is to absorb and drop attack traffic as early as possible along the path.

Well-executed edge security also protects the ASN's reputation. Filtering malicious outbound traffic (botnet egress, spoofing) prevents the provider's IP blocks from landing on blacklists, which would create a hard-to-reverse secondary problem: legitimate customers being blocked by third-party services because of the block's poor reputation.

SOC 24x7: continuous detection on the provider's network

A provider's network never sleeps, and the security operation cannot sleep either. Decripte's SOC 24x7 ingests and correlates network telemetry — NetFlow/sFlow, BNG/CGNAT logs, edge events, CPE telemetry, and application logs — looking for the patterns that precede an incident: clusters of CPEs with synchronized behavior, anomalous egress spikes, internal scans, and exploitation attempts against the infrastructure.

The value of the SOC lies not only in detecting, but in shortening the time between the first signal and the action. The sooner a cluster of compromised CPEs is identified, the fewer devices are recruited, the smaller the impact on the ASN's reputation, and the shorter the window in which subscriber data is exposed.

Incident response and subscriber data protection

When the incident happens — and in a provider with a large installed base, it is a matter of when, not if — what makes the difference in the outcome is the speed and structure of the response. Decripte operates with a containment SLA of up to one hour, mobilizing containment, eradication, and recovery in a coordinated way, with evidence preservation for forensic analysis and eventual response to authorities.

For carriers with a mobile offering, response to SIM swap and portability fraud is in scope. Here Decripte acts both on the technical side (correlation of suspicious SIM change events, anomalous portability alerts) and on the process (review of the customer service and activation flows, reinforced authentication controls before a SIM change).

Pentest: find the hole before the attacker

You cannot defend what you do not know. Decripte's Pentest for providers combines assessment of the external surface (ASN IP ranges, exposed services, portals, and APIs) with sector-specific tests: firmware and management interfaces of the CPE models in the field, provisioning flows (TR-069/ACS), subscriber portals, and the portability and SIM activation processes.

The goal is not just to list vulnerabilities, but to prioritize by real impact: a flaw in a CPE distributed to 50,000 subscribers is incomparably more serious than the same flaw in a low-reach internal system. The report delivers a demonstrated exploitation path, blast radius, and an executable remediation plan — not a generic scanner PDF.

Start with the free assessment

The lowest-friction entry point is the free Threat Management plan at decripte.com.br/intelligence-center, which gives initial visibility into the provider's exposure surface — what is open to the internet, which services and ranges are exposed, and where the obvious risks are. From that snapshot, contracting SOC 24x7, Edge Security, Incident Response, and Pentest is done at decripte.io/start, and any questions can be handled through the contact form.

The adoption logic we recommend is incremental: the free assessment reveals the current state; Edge Security and SOC 24x7 establish continuous defense; Incident Response ensures speed when something slips through; and periodic Pentest keeps the posture honest, validating that the controls really hold off a real attacker. None of these layers replaces another — they reinforce each other.

Anatomy of a botnet hijacking subscriber CPEs (anonymized real-world example)

How Decripte responds to incidents at providers and carriers

The response follows a structured cycle, with a containment SLA of up to one hour and evidence preservation, calibrated for the at-scale impact that ISP incidents generate on thousands of subscribers.

1. Triage and classification: the SOC 24x7 confirms the incident, determines the type (DDoS, CPE botnet, leak, SIM fraud), and estimates the blast radius on the subscriber base.
2. Immediate containment: within the SLA of up to 1h, it isolates the vector — selective quarantine of CPEs, DDoS mitigation at the edge, blocking of exposed management ports, or suspension of fraudulent portability flows.
3. Evidence preservation: it collects BNG/CGNAT logs, NetFlow, CPE telemetry, and application records in a forensic manner, ensuring a trail for root-cause analysis and eventual legal response.
4. Eradication: it removes the payload, forces a firmware update via ACS/TR-069, resets compromised credentials, and closes the exposures that allowed the breach.
5. Controlled recovery: it reintegrates devices and services after validation, monitors the ASN's reputation, and confirms the normalization of traffic patterns.
6. Regulatory assessment: when subscriber data is involved, it supports the impact analysis and the notification trail to the ANPD and the data subjects in accordance with the LGPD.
7. Report and lessons learned: it delivers root cause, timeline, blast radius, and a prioritized remediation plan.
8. Post-incident hardening: it builds the permanent controls (firmware management, anti-DDoS edge, continuous monitoring) to prevent recurrence.

How Decripte builds a provider's security

The build is organized into pillars covering the network infrastructure, the CPE fleet in subscribers' homes, personal data, and the critical customer service processes.

Recommended plans for Internet Service Providers and Telecoms

Frequently asked questions

Sector terms

CPE (Customer Premises Equipment)

Equipment in the subscriber's home — modem, ONU, or Wi-Fi router — that connects the customer to the provider's network. At scale, compromised CPEs become ammunition for botnets.

TR-069

Remote CPE management protocol (CWMP) used by providers for provisioning and updates via an ACS server. When exposed to the internet without protection (typically on port 7547), it becomes a mass-hijacking vector.

CGNAT (Carrier-Grade NAT)

A technique in which several subscribers share the same public IP. It requires translation logging (port/time/subscriber) to attribute abuse and respond to legal requests.

SIM swap

Fraud in which the attacker transfers the victim's mobile line to a SIM under their control, intercepting authentication SMS messages. It exploits the carrier's customer service and activation process.

Volumetric DDoS

A denial-of-service attack that saturates the transit link with massive traffic (floods, DNS/NTP amplification). Because it hits the uplink, it requires mitigation at the edge and upstream coordination.

BGP hijacking

Route hijacking in the BGP protocol in which an adversary announces IP prefixes that do not belong to it, diverting or intercepting traffic. Mitigated with prefix filters and RPKI.