Ransomware now hits telcos at scale alongside state activity.
Cyble’s 2025 telecommunications threat landscape records 90 ransomware attacks against telcos globally, up from 24 in 2022, running in parallel with nation-state intrusion campaigns already operating inside carrier networks.
Why Telecommunications is in the crosshairs
Five shifts shaping the global and Australian telco threat environment — what Salt Typhoon has exposed, and what regulators are now asking operators to demonstrate.
Salt Typhoon has reframed the sector globally
At least nine US telcos compromised, one to two years of undetected access, and in December 2025 Senator Cantwell's office said carriers had not shown the intruders were removed. The Senate Commerce minority's finding that router patches had been available for years and never applied captures the systemic failure that made the intrusion possible. Every major telco now has to assume edge infrastructure has been a target of this class of actor.
Lawful-intercept infrastructure is a specific systemic weakness
Salt Typhoon exploited US CALEA wiretapping infrastructure — systems that, by design, provide access to telecommunications metadata and content for lawful intercept. The FCC's ruling that vulnerabilities "are still being exploited" applies with particular force here. Australian carriers carry their own interception-capability obligations under the Telecommunications (Interception and Access) Act 1979.
Nation-state adversaries pre-position for disruption, not just espionage
The White House briefing was explicit: "for espionage, but potentially for disruption at a time of crisis or conflict as well." Volt Typhoon's pattern is pre-positioning against US critical infrastructure; Salt Typhoon's is persistent counterintelligence-relevant access. ASIO Director-General Mike Burgess said in November 2025 that Salt Typhoon has been probing Australian telecommunications networks, and that one nation state is making multiple attempts to penetrate Australian critical infrastructure.
Legacy edge infrastructure is a leading risk category
Router vulnerabilities left unpatched for years and former FCC official Deb Jordan's iPhone analogy capture the operational reality: core and provider-edge firmware often runs unpatched for reasons that range from operational risk aversion to loss of vendor support. Verizon's 2026 DBIR finding that vulnerability exploitation has overtaken stolen credentials as the top way into breaches, at 31%, lands with double weight in telco.
Ransomware now hits telcos at scale alongside state activity
Cyble's 2025 analysis counts 90 telecom ransomware attacks by 34 groups led by Qilin, Akira, and Play, up from 24 in 2022. Frontier Communications' April 2024 breach, claimed by RansomHub, exposed data on more than 750,000 people.
What experts are saying
Investigators found legacy equipment not updated in years … and hackers acquiring credentials through weak passwords.
We believe this one is for espionage, but potentially for disruption at a time of crisis or conflict as well.
To date, telecom companies infiltrated in the attack have failed to prove the Chinese hackers have been eradicated from their networks… Experts agree that the attack has not been fully remediated from telecommunications networks, and the FCC's ruling concedes that vulnerabilities "are still being exploited."
TSRMP Rules are now live
The telecommunications security regime under the SOCI Act commenced 4 April 2025. Carriers, and carriage service providers supplying 20,000+ active services or serving Commonwealth entities, have had to comply with a risk management program since the grace period ended in October 2025, and the asset definition now reaches any asset they own or operate in connection with supplying a carriage service.
Carriers, and carriage service providers supplying 20,000+ active services or serving Commonwealth entities, must have and comply with a risk management program under the SOCI Act, tailored by the TSRMP Rules. It must address cyber and information security, personnel, supply chain, and physical and natural hazards. For the cyber hazard, entities comply with Essential Eight, NIST CSF, ISO/IEC 27001, C2M2 or AESCSF (or an equivalent); carriers must reach maturity level two by October 2027. Carriers must also comply with carrier licence conditions under the Telecommunications Act 1997.
LegislationFederal legislation covering telecommunications as a critical infrastructure sector. Since April 2025, the TSRMP Rules moved telco obligations from the Telecommunications Act into the SOCI Act. Carriers, and carriage service providers above the Rules' thresholds, must maintain a CIRMP addressing four hazard vectors: cyber, personnel, supply chain, and physical and natural hazards. NodeZero produces attack-based evidence for the cyber hazard across the IT, cloud and network systems it can reach; personnel, supply chain and physical hazards need separate evidence.
Prescriptive and technically focused. Eight specific mitigation strategies with clear pass/fail controls. Common for government-adjacent entities, defence industry, and smaller organisations adopting ASD guidance.
Where NodeZero appliesBroad lifecycle coverage from governance through recovery without mandating specific technologies. Suited to entities operating across jurisdictions or mapping existing controls into a flexible structure.
Where NodeZero appliesInternational management system standard with formal certification. A natural fit for entities with international operations or an existing ISO certification.
Where NodeZero appliesMaturity model assessing organisational capability across 10 domains. Originally built for the US electricity sector. Process and governance oriented — less about specific controls, more about repeatable capability.
Where NodeZero appliesSector-specific to energy. Derived from C2M2 and NIST CSF with Australian privacy additions. Managed by AEMO. The default for electricity and gas market participants with OT/ICS environments.
Where NodeZero applies
Telcos hold extensive customer personal information including call records, location data, and account details subject to the Australian Privacy Principles and the data retention regime under the Telecommunications (Interception and Access) Act.
Where NodeZero applies
Relevant for telcos providing managed services, cloud connectivity, or hosted solutions to enterprise and government customers.
Where NodeZero applies
Applies to telecommunications providers processing customer billing and payment card transactions.
Where NodeZero applies
Mandatory 72-hour ransomware payment reporting for businesses over $3M turnover and SOCI Part 2B responsible entities.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
TSRMP Rules 2025 (asset scope expansion)
4 Apr 2025The security obligations in Part 14 of the Telecommunications Act moved into the SOCI Act. A critical telecommunications asset now includes any asset a carrier or carriage service provider owns or operates and uses in connection with supplying a carriage service, not just the core network.
Cyber Security Act 2024 (ransomware reporting)
30 May 2025Mandatory reporting to ASD within 72 hours of making a ransomware payment, for businesses over $3M turnover and SOCI Part 2B responsible entities. Cyber incident notification is a separate SOCI Part 2B obligation.
Cyber Incident Review Board
30 May 2025Independent review board can examine significant cyber incidents affecting critical infrastructure, with statutory power to require information and documents. Telecommunications operators should be able to reconstruct control failures for a potential no-fault post-incident review.
Smart Device Security Standards
4 Mar 2026Consumer smart devices manufactured from 4 March 2026 must meet minimum security standards (password rules, a vulnerability reporting channel, a published support period), and suppliers must not supply non-compliant products, including consumer modems or routers a telco supplies.
TSRMP maturity uplift
Oct 2026 / Oct 2027Every in-scope telco asset must meet its cyber framework's entry level (e.g. Essential Eight ML1) within 12 months of the grace period ending, and carriers must reach Essential Eight ML2 or an equivalent level by October 2027. NodeZero provides attack-based evidence of whether uplifted controls hold.
Government intervention powers
20 Dec 2024The Enhanced Response and Prevention Act 2024 lets the Secretary of Home Affairs (or the relevant regulator) direct a responsible entity to address a "seriously deficient" CIRMP: one posing a material risk to national security, defence, or social or economic stability. Non-compliance attracts civil penalties.
Find your organisation
See how the changes affect you specifically
Carriers & CSPs
Major and regional carriers facing TSRMP obligations, cloud and Kubernetes validation, and expanded SOCI Act obligations across critical national infrastructure.
View details →ISPs & wholesale providers
Regional ISPs, wholesale providers, and NBN access seekers needing cost-effective continuous security validation without dedicated red teams.
View details →Why security teams trust NodeZero
Validate your security posture before an attacker does
See how NodeZero tests across the expanded TSRMP asset scope in your environment