[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAk84N6RyHtunqHi8GpgmBURIt4xBQ1GXIsC7QT86OYw":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":107},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"9f9b0431-177b-4aec-bfd3-1c240c7064cd","5G-Shark Lures Phones to Rogue 5G Cells Without Network Jamming","5g-shark-lures-phones-to-rogue-5g-cells-without-network-jamming-ba7c34","Researchers have developed 5G-Shark to lure phones onto rogue base stations, collect subscriber IDs, force network downgrades and…","Researchers have developed a new tool called 5G-Shark that can lure mobile phones onto rogue 5G base stations without jamming legitimate networks. This allows attackers to collect subscriber IDs and force network downgrades, potentially enabling further attacks. The technique bypasses existing security measures designed to detect jamming.","Researchers develop 5G-Shark to lure phones to rogue 5G cells and collect subscriber IDs.","https:\u002F\u002Fhackread.com\u002F5g-shark-phones-rogue-cells-jamming-mobile-networks\u002F",null,"2026-09-25T20:03:38+00:00","2026-09-25T22:00:14.467013+00:00",8,[17,20],{"name":18,"type":19},"5G","technology",{"name":21,"type":22},"5G-Shark","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":12,"name":25,"slug":26},"Vulnerabilities","vulnerabilities",[28,33,35,40],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":34},{"id":23,"icon":12,"name":25,"slug":26},{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":48,"vendors":106},[49,78],{"slug":50,"name":51,"problem":52,"products":53},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":44,"name":79,"problem":80,"products":81},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":108,"title":109,"body":110,"framework_refs":111,"framework_notes":120},"5g-shark-tool-silently-hijacks-mobile-devices-via-rogue-base-stations","5G-Shark Tool Silently Hijacks Mobile Devices via Rogue Base Stations","The 5G-Shark tool exploits weaknesses in how mobile devices authenticate and connect to 5G base stations, allowing attackers to silently lure phones onto malicious cells without triggering jamming-detection defenses. By harvesting subscriber IDs (IMSIs\u002FSUPIs) and forcing protocol downgrades to less secure generations (e.g., 4G\u002F3G), attackers can enable eavesdropping, location tracking, and man-in-the-middle attacks. This matters because the attack is passive enough to evade current countermeasures, placing millions of devices at risk in public spaces. The vulnerability highlights a fundamental gap in mutual authentication and signal-anomaly detection within current 5G deployments.",[112,113,114,115,116,117,118,119],"NIST SP 800-187 (Guide to LTE Security)","NIST CSF DE.CM-7 (Monitoring for unauthorized activity)","CIS Control 13 (Network Monitoring and Defense)","CIS Control 4 (Secure Configuration of Enterprise Assets)","3GPP TS 33.501 (5G Security Architecture)","GSMA FS.40 (5G Security Guide)","NIST SP 800-124 (Guidelines for Managing Mobile Device Security)","ETSI TS 133 501 (Subscriber Identity Privacy)",{}]