OneLayer Turns Real Cellular Threats Into Automatic Detections

As threats to private cellular grow more sophisticated, OneLayer analyzes how they work, maps the underlying behavior to private cellular environments, and translates those findings into automatic detections for customers

BOSTON, Aug. 31, 2026 (GLOBE NEWSWIRE) -- OneLayer, the cybersecurity and visibility layer for enterprise private cellular networks, today highlighted four real-world threat patterns its OneLayer Bridge platform is built to catch: unauthorized device-to-device connections across a shared private APN, cellular modems from manufacturers on the FCC's Covered List, spoofed device identities on the SIM and modem, and devices appearing behind a router they were not onboarded on. Each is the result of OneLayer's ongoing threat research, delivered as a standing detection with nothing for customers to configure.

Private cellular attacks keep evolving, so OneLayer keeps researching: tracking disclosures, testing them against the device and traffic data OneLayer Bridge already collects, and turning what holds up into a detection every customer gets automatically. The four examples below are not a claim to have every angle covered. They show how the process works.

The clearest example is the December 2025 attack on a Polish combined heat and power plant serving roughly 50,000 residents, where attackers pivoted from an unrelated wind farm through SSH tunnels opened across a shared private APN. OneLayer published a technical breakdown the same day CERT Polska released its follow-up report, on August 11, 2026, ahead of the mainstream security press. OneLayer Bridge's Observe pillar already flags that same east-west SSH activity the moment a tunnel opens, with nothing to configure.

A second pattern is playing out in regulation. As the FCC's Covered List grows, and federal scrutiny of certain overseas cellular hardware manufacturers keeps expanding, a provisioned device can no longer be assumed trustworthy. OneLayer Bridge fingerprints the make, model, and chipset of every device it onboards, and flags any modem from a manufacturer on the Covered List automatically, the moment it is seen or the list changes.

A third pattern surfaced this month in research showing a malicious SIM card can run commands directly on a device's modem, demonstrated against EV chargers, industrial routers, and telematics units built on widely deployed cellular modem chipsets. It is the same identity layer behind OneLayer's IMEI spoofing detection: a device presenting an identifier that is not its own. OneLayer Bridge fingerprints every device against its known identity, so a spoofed or swapped identifier is flagged on connection.

The fourth pattern shows up at the edge. Newly disclosed vulnerabilities in industrial cellular routers, widely used across utilities and manufacturing, would let an attacker remotely impersonate a legitimate device. It is the scenario OneLayer customers ask about most: a device shows up behind a different router than the one it was onboarded on, whether that move was intentional or not. OneLayer Bridge fingerprints every device against the router it's onboarded on, so that migration is flagged the moment it happens.

"Every one of these threats comes at the enterprise from a different direction: the SIM, the modem, the router, the traffic moving between devices. What enterprises need is one layer of protection across the whole cellular estate," said Dave Mor, CEO, OneLayer. "That layer is built on data that is hard to bring together: signaling, the core, the routers, and the devices themselves, fused into a single picture."

"Every one of these detections started the same way: our team spotted a pattern and validated that OneLayer Bridge could already see it, using the device fingerprinting and traffic visibility built into the platform," said Liron Ben-Horin, VP of Systems Engineering, OneLayer. "That is the value we bring: cellular domain expertise and a research process that keeps running, so customers are not the ones who have to catch the next one."

All four detections are available today to every customer running OneLayer Bridge, with no new hardware or configuration required, and OneLayer's threat research keeps adding to the library as new patterns emerge. The Polish incident breakdown is on the OneLayer blog; documentation on the other three is available to customers and press on request.

About OneLayer

OneLayer provides advanced asset management, operational intelligence, and Zero Trust security for private LTE/5G and private APN networks. Its technology empowers enterprises to manage and secure cellular-connected devices across both private and carrier environments, without the need for cellular expertise.

For more information, visit https://www.onelayer.com.

Media Contact:
Mor Ben-Horin

mor.ben.horin@onelayer.com

Photos accompanying this announcement are available at:
https://www.globenewswire.com/NewsRoom/AttachmentNg/daf98ab1-76d8-40d5-abf4-f954a70e991c
https://www.globenewswire.com/NewsRoom/AttachmentNg/8e60498e-d1e5-4e94-a169-7920b1419ffe

Device-to-Device SSH Detection in OneLayer Bridge

OneLayer Bridge flags an SSH connection opened directly between two devices on a shared private APN. This is the same lateral movement pattern used in the December 2025 attack on a Polish combined heat and power plant, and the detection runs as standard for every customer with nothing to configure.

Unauthorized Modem Manufacturer Detection in OneLayer Bridge

OneLayer Bridge fingerprints the make, model, and chipset of every device it onboards and raises an Unauthorized Modem Manufacturer alert the moment a restricted modem appears on the network or the FCC's Covered List changes.