China's 'Liminal Panda' APT Attacks Telcos, Steals Phone Data

A newly unveiled threat actor has been spying on mobile phones in Asia and Africa for more than four years. 

On Nov. 19, Adam Meyers, senior vice president for counter-adversary operations at CrowdStrike, testified before the US Senate Judiciary Subcommittee on Privacy, Technology, and the Law, on the subject of Chinese cyber threats to critical infrastructure. In the process, he unveiled Liminal Panda, an advanced persistent threat (APT) hyper-focused on gathering intelligence from telecommunications networks.

Since 2020, Liminal Panda has been using network-based attacks to penetrate and pivot between telcos across geographic regions, gathering SMS messages, unique identifiers, and other metadata associated with mobile phones that could be of political or economic use to the Chinese state.

Liminal Panda's MO

Though the aim is to obtain data transmitted over telecommunications channels, a typical Liminal Panda attack might look a lot like any regular network breach.

"Your cellphone has a radio that talks to a tower, called a base station controller. And those things are connected, typically, by Internet-type protocols — network technology," Meyers explained. Where some attackers might focus on the towers and their transmissions, Liminal Panda targets the IT network infrastructure underpinning the system. "They're going to go in through the gateway of the telco, and inside there's going to be a lot of traditional IT systems."

Once inside a telco's network — so often staffed by outdated legacy systems — Liminal Panda has tools for collecting call and text records and other sensitive identifying data on large groups or individual targets. "When you send a text message from your mobile device, it goes to the tower via SMS that gets passed back into the core of the telco. Routing decisions are made, and then it goes to the next destination," he says. Liminal Panda malware acts on that interim step.

To facilitate the exfiltration of that information, the group's command-and-control (C2) setup emulates the Global System for Mobile Communications (GSM). GSM is a mobile communications standard that enables calling, texting, and the use of mobile data, and is the most widespread such standard in the world, used in more than 193 countries.

Hopping Between Telcos

Besides attacking specific telcos, Liminal Panda has also been observed hopping between them.

"When you go from one part of the country to another, or when you go from one country to another, you need to have interoperability. And there's a lot of infrastructure that goes into making that happen," Meyers said. Thing is: The open lines of communication between telecommunications providers, and their infrastructure over long distances, can also be weaponized. "There are multiple threat actors from China who really understand how telecommunications infrastructure works. They understand how it's all connected together, and they're able to abuse that in order to go between providers."

Though its understanding of industry-specific protocols helps, Liminal Panda also jumps between providers simply by abusing the Domain Name System (DNS). By the end of a campaign, the group has often established multiple, redundant routes for traveling between providers.

China's End Goals

Oppressive governments have long used telecommunications breaches to spy on foreign officials, internal political dissidents, journalists, and academics. "All of these groups are targeting telcos to perform bulk collection, because it gives them the opportunity to then [hone in on] an individual — see who they're texting, who they're calling, who they're with," Meyers explained.

If Liminal Panda is indeed working on behalf of China, as CrowdStrike assesses with admittedly low confidence, then this sort of spying might have a dual economic benefit as well. In his Senate testimony, Meyers highlighted how major national projects like the Belt and Road Initiative, Made in China 2025, the 2035 Vision, the Global China 2049, and the country's regular Five-Year Plans provide impetus for economic espionage.

"If you're doing a deal in that region, I want to know who you're meeting with. I can collect that information, if you're sending text messages about the deal," he says. "Or I can intercept them if you're meeting with somebody that is politically problematic for me."