Recently, security analysts uncovered a sophisticated cyber espionage campaign targeting global telecommunications that has spanned over two years. The threat actors, dubbed “LightBasin” or “UNC1945”, have compromised and established persistence in at least thirteen (13) mobile communication systems throughout the world and have been harvesting data that would serve “intelligence organizations”. LightBasin commonly targets infrastructure operating with External DNS servers, Service Delivery Platform and SIM/IMEI systems, which are all encompassed in the General Packet Radio Service (GPRS) which enables roaming between mobile operators. Threat actors were discovered to be brute-forcing computer systems with default user/password combinations in hopes of compromising the system. Once compromised, LightBasin actors deployed a highly sophisticated malware “SLAPSTICK” which enables backdoor access to the systems. Alongside this malware, LightBasin also utilizes a network packet capture utility “CordScan” to fingerprint mobile devices and gather additional data vectors. Remediation efforts are underway, with security firms urging telecommunications companies to verify the integrity of their systems, ensuring proper firewall rules, changing of default system credentials, and restricting networking protocols to only ones deemed essential. CTAPT will continue to monitor the fallout of this espionage campaign and provide an update if needed.