80+
countries reached by Salt Typhoon's intrusions into telecom networks. In February 2026 the FBI called the threat "still very, very much ongoing."
CyberScoop, February 2026Every call, text, and signaling message your network carries claims to come from somewhere. DOR proves each one is authentic before the network routes it, rings it, or acts on it.
This is already happening.
The worst attacks on carriers in 2025 and 2026 did not need to break the network. They borrowed its identity: a cloned certificate, a leased signaling link, a top caller ID rating on a fraudulent call.
26.1M
SIM authentication keys South Korea's largest carrier stored without encryption when attackers broke in. The breach reached about 23 million subscribers and drew a record ₩134.8 billion fine.
Light Reading, August 202516,647
customers exposed after attackers built their own femtocell with a certificate cloned from a lost one, and phones joined it as part of the network. 368 of them were defrauded.
Infosecurity Magazine, August 2026100,000+
SIM cards in more than 300 servers found within 35 miles of the UN in New York. The Secret Service said the network could have shut down the city's cellular service.
The Register, September 202589.4%
of calls from the 10 most prolific robocall generators carried A-level attestation, the highest caller ID rating a carrier can give.
FCC, May 2026Apr 23, 2026
the day researchers reported surveillance vendors posing as mobile carriers, using signaling access leased from legitimate operators to track people's phones worldwide.
TechCrunch, April 2026Every signal proven before the network acts.
The core, the cell sites, the SIMs, the calls, and the people who run them all act on what they are told. DOR proves it first.
Core and SignalingThe messages carriers exchange to find phones, route calls, and connect to each other.Cell Sites and RadioTowers, small cells, femtocells, and the clocks that keep them in step.Subscribers and SIMsWho a number belongs to, and who is allowed to move it.Calls and MessagesThe caller ID, the text, and the voice on the line.Operations and RecordsNetwork changes, privileged access, and the record you answer for.
Core and Signaling
The messages carriers exchange to find phones, route calls, and connect to each other.
C-01
Signaling between carriers
Signaling messages tell a network where a phone is and where its calls should go, and anyone with leased access can send them. DOR proves each message came from the operator it names before your core answers it.
C-02
Routes and interconnects
A forged route or a changed interconnect setting can send traffic through someone else's network. DOR checks every routing change against where it came from before it takes effect.
C-03
Network software
Modern cores run as software, and software can be swapped or quietly modified while it keeps running. DOR confirms every network function is the approved build before it carries traffic.
Cell Sites and Radio
Towers, small cells, femtocells, and the clocks that keep them in step.
A-01
Small cells and femtocells
In 2025, attackers built their own femtocell with a certificate cloned from a lost one, and phones joined it. DOR verifies each cell by more than its certificate and confirms the hardware is the unit you installed.
A-02
Fake base stations
A rogue station can broadcast as part of your network and pull phones onto it. DOR checks what your network hears against its own record of its sites and flags a station that does not belong.
A-03
Timing at the site
Cell sites take precise time from satellites, and that signal can be faked or jammed. DOR checks time where it enters each site and keeps the site on verified time when the signal is wrong.
Subscribers and SIMs
Who a number belongs to, and who is allowed to move it.
S-01
SIM swaps and number moves
A number moved to an attacker's SIM hands over every code sent to it by text. DOR confirms the request came from the account holder before the number moves.
S-02
SIM keys and identities
SIM keys and subscriber identities are the credentials of the whole network. DOR keeps every change to them provable and flags one that did not come through an authorized path.
S-03
SIM farms
Banks of thousands of SIMs run by one operator can pass as thousands of customers, flood a site, or blend scam traffic into ordinary use. DOR ties traffic to the devices and accounts behind it.
Calls and Messages
The caller ID, the text, and the voice on the line.
V-01
Caller ID
The highest caller ID rating has been stamped on fraudulent calls at scale. DOR proves where a call actually came from, beyond the rating it carries.
V-02
Cloned voices
A cloned voice can call a customer, a help desk, or an executive and sound exactly right. DOR confirms who is on a call while it is happening.
V-03
Texts and codes
One-time codes and alerts travel by text, and texts can be faked, intercepted, or changed. DOR proves where each message came from and that it arrived unchanged.
Operations and Records
Network changes, privileged access, and the record you answer for.
O-01
Intercept and admin access
The systems carriers build for court-ordered intercepts and network administration are prime targets for impostors and insiders. DOR requires a verified request and a recorded reason for every use.
O-02
Configuration and logs
State hackers got into carrier networks through configuration errors and known flaws, then covered their tracks. DOR checks every configuration change against who approved it and keeps a record no one can edit.
O-03
The rules you answer to
The FCC, the UK Telecommunications Security Act, and the EU's NIS2 Directive all ask carriers to show what their networks did and when. DOR produces that record.
How DOR works with you.
Nothing to rip out. No dependence on a link to the outside. Every deployment starts with your network as it is.
Walk the network
DOR maps what your core, cell sites, and subscriber systems receive and act on, from the first signaling message to the final record.
Build to it
Every deployment is built to your vendors, your network design, and the rules you answer to.
Deploy on what you run
DOR runs as software on the systems you already operate, fully offline. Where a site has nothing suitable, DOR provides a compact host built for it.
Hand over the evidence
You get a record of what was checked, what was held, and why. It cannot be edited.
Inside every deployment
- Verification where it arrives
- Signaling messages, routes, clocks, and calls are proven authentic before your network or your people act on them.
- A hold, not just an alarm
- Anything that fails is held or flagged by rules you set, and released only by an authorized person with a recorded reason. Emergency calls always go through.
- A record that stands
- What was checked, held, and released, kept in a record no one can edit.
Questions carriers ask.
Straight answers to what network, security, and fraud leaders at carriers ask first.
Does DOR route traffic or run the network?
No. DOR checks whether messages, routes, and signals are authentic and unchanged. Routing, switching, and service decisions stay with your engineers and your systems.
Will DOR add delay to calls or signaling?
DOR verifies at the pace of the network it protects. Every deployment is built and tested against your core and your vendors' equipment before it goes live.
Do we have to replace our core, radio, or vendor equipment?
Usually not. DOR runs as software on the systems you already operate, and provides a compact host when a site has nothing suitable.
Does DOR replace our signaling firewall or fraud tools?
No. Signaling firewalls block known bad patterns, and fraud tools score behavior. DOR proves each message came from who it claims, which gives those tools firmer ground to work from.
What happens to emergency calls?
They always go through. DOR never stands between an emergency call, or any safety function, and the network that carries it.
Does DOR need a cloud connection?
No. DOR runs fully offline and depends on no outside service to verify anything.
What happens to subscriber data?
It stays where it already lives. DOR does not need subscriber data to leave your network to verify anything.
How does DOR help with FCC, UK, and EU requirements?
Each asks carriers to show what their networks did and when. DOR produces a verifiable record of what your network received, checked, and acted on that cannot be edited, which supports audits, incident reports, and regulator reviews. In the UK, the revised Telecommunications Security Code of Practice issued in July 2026 sets March 31, 2027 for measures covering the signaling plane, the management plane, and third-party suppliers. In May 2026 the FCC proposed tighter caller ID authentication rules, and the EU's NIS2 Directive covers telecom providers across the Union.
Is DOR only for the largest carriers?
No. Every deployment is built to the network in front of it, from a regional or rural carrier to a national operator.
What does an engagement with DOR look like?
DOR walks your network, builds to your equipment and rules, deploys on what you already run, and hands you the evidence. It starts with a briefing.
Reference
The Telecommunications Reference.
The full list behind this page: how core, cell site, subscriber, and call systems get fooled, in plain language, with what DOR does about each one.
Telecommunications
Start with a briefing.
Bring your network map and your vendor list, or just the question your security team keeps asking. DOR will show you exactly where it fits.