5G-GTP-ULateral Movement

GTP-U User-Plane Spoof

Mobile core GPRS Tunneling Protocol user-plane traffic often unfiltered between hops — inject packets into subscriber bearers; also useful for free-of-charge data tunnels.

§ Where this technique fits

5G-GTP-U is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

5G core GTP-U user-plane injection → subscriber MITM
Attacker on a transit network between mobile-core hops (or with compromised UPF). GTP-U packets are typically unfiltered between PEs; inject packets into subscriber bearers — credential capture, free-of-charge tunnels, downstream attacks.
step 3 / 5

§ What commonly comes next

01
Adversary-in-the-Middle
T1557 · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

5G core GTP-U user-plane injection → subscriber MITM

§ What commonly comes next