How Telefónica turned suspicious IP activity into a clear assessment of the threat
Telefónica's security team used Lupovis to detect a threat within its telecommunications infrastructure and to understand what it was dealing with. By connecting suspicious IP activity with threat intelligence, analysts gained the context to investigate and to decide where to focus.
Telecommunications · Threat hunting
.png)
Threat hunting
Get research and insights on the vulnerabilities attackers are exploiting and what they mean for your defences.
Summary
Telefónica's security team used Lupovis to detect a threat within its telecommunications infrastructure and to understand what it was dealing with. By connecting suspicious IP activity with threat intelligence, analysts gained the context to investigate and to decide where to focus.
At a glance
- Used by: Security analysts
- Deployment: Self-managed
- Year: 2025
Headline results
- A threat detected within telecommunications infrastructure linked to an access broker campaign
- Suspicious IP activity connected to threat intelligence, giving analysts the context to investigate
- Clearer evidence to guide investigations, with investigation time cut by 50%
The challenge
A telecommunications provider sees a constant flow of activity against its infrastructure, and much of it looks suspicious without being a real danger. Spotting an unusual IP address is the easy part of the job. The harder part is knowing who is behind it, what they want and whether it deserves an analyst's time.
Telefónica's team needed a way to get from identifying suspicious activity to assessing the threat it posed to the services they protect.
The solution
Lupovis gave Telefónica's analysts threat intelligence built on confirmed attacker behaviour, which they could set against the activity they were seeing. That link between an IP address and what it had been observed doing elsewhere supplied the context an investigation needs.
What changed
Lupovis helped the team detect a threat within its telecommunications infrastructure and understand it. Analysts gained a clearer picture of what they were dealing with and where to focus their attention.
[purple-block-start]
The outcome
The visibility carried the team beyond flagging suspicious activity and into assessing the risk to its infrastructure. Investigations now start from clearer evidence, and decisions about how to respond are better informed.
[purple-block-end]
"Lupovis helped us detect a threat within our telecommunications infrastructure and gave our team the context needed to investigate it. By connecting suspicious IP activity with threat intelligence, we gained a clearer understanding of what we were dealing with and where to focus our attention.
That visibility helped us move from identifying suspicious activity to assessing the threat it posed to our infrastructure. For a security team protecting telecommunications services, this is a valuable outcome: clearer evidence to guide investigations and better informed decisions about how to respond."
Anthony Freire, Senior Security Analyst, Telefónica
