Cordscan
CordScan is a custom-made network scanning and packet capture utility designed for telecommunications environments. It includes built-in logic for the application layer of telecom systems and is used to scan and capture common mobile telecom communication protocols, including SGSN traffic. Reported functionality includes targeting SGSN nodes to extract IMSI and operator data, crafting and sending GTP-C packets over UDP port 2123 using target operator and target IMSI values, and logging results to packet capture files such as packet.pcap or .pcap output. The tool has been associated with collection of mobile subscriber and location-related data, and reporting states it can be used to collect location data from mobile devices.
CordScan was observed in a 2024 campaign targeting mobile telecommunications networks in Southeast Asia and Southwest Asia. Palo Alto Networks Unit 42 tracked the responsible cluster as CL-STA-0969, and CrowdStrike reported heavy overlap with activity it tracks as Liminal Panda. Unit 42 assessed with high confidence that the activity was connected to Beijing, while CrowdStrike assessed with low confidence that Liminal Panda had ties to official Chinese operations. The broader campaign targeted telecom operators and critical telecommunications infrastructure, with likely objectives including tracking individuals’ locations and establishing persistent, stealthy access for future espionage. In investigated cases, researchers reported no clear evidence of data exfiltration or direct communication with mobile devices.
CordScan was deployed alongside other custom and public tools used by the same operators, including NoDepDNS, AuthDoor, GTPDoor, ChronosRAT, EchoBackdoor, SGSN emulator tooling, FRP, Microsocks, FScan, and Responder. The intrusion activity associated with CordScan involved likely initial access via SSH brute-force attacks using dictionaries tailored to telecommunications equipment, followed by deployment of backdoors and extensive defense evasion. Reported evasion and persistence measures in the campaign included process-name masquerading, timestomping, weakening or disabling SELinux by setting permissive mode, clearing authentication logs, sanitizing wtmp logs, and suppressing shell history. Unit 42 also published SHA-256 indicators for CordScan and related tooling, but specific hashes are not included in the provided content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cordscan: A network scanning and packet capture tool tailored for telecom environments. It targets SGSN nodes to extract IMSI and operator data. It crafts and sends GTP packets to scan for specific mobile subscribers, logging results in a .pcap file.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Lateral Movement
1 technique"Telecommunications organizations ... targeted ... to facilitate remote control over compromised networks... use of several tools to enable remote access"
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used in telecom-focused espionage activity; described as capable of collecting location data from mobile devices and used alongside other remote-access tooling.
A network scanning and packet capture tool designed for telecom environments, extracting IMSI and operator data from SGSN nodes and logging results in .pcap files.
Custom network scanning and packet-capture utility used in telecom intrusions; described as capable of capturing common mobile telecom communication protocols (including SGSN) to support tracking/location-related collection.
Custom network scanning and packet-capture utility used in telecom intrusions; described as capable of capturing common mobile telecom communication protocols (including SGSN) to support tracking/location-related collection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.