Rapid7 has published a whitepaper titled “The Weaponisation of Cellular Based IoT Technology”, examining how attackers with physical access to cellular-enabled Internet of Things (IoT) devices could exploit embedded modules to pivot into cloud and backend environments.
The paper describes scenarios where adversaries use the cellular module as an entry point to exfiltrate data and hide command-and-control activity inside traffic that appears normal for the device. The research focuses on attack mechanics, including observing and manipulating inter-chip communications such as USB and universal asynchronous receiver-transmitter (UART), and using hardware modifications to replace the device host so an external system can assume control of the cellular module.
Rapid7’s authors also developed proof-of-concept tooling, including a TCP port scanner that uses AT commands, an S3 bucket enumerator, a SOCKS5 proxy that routes traffic through the cellular module, and a Metasploit proxy module. The tools are intended to show how trusted relationships between devices and connected services can be abused for reconnaissance and lateral movement.
Across the devices tested, the research found recurring issues: cellular modules often exposed multiple interfaces, with unused UART or USB pathways potentially enabling direct access; printed circuit board modifications could allow attackers to reroute traffic through the cellular interface; and AT commands could support raw sockets, HTTP requests and TCP tunnelling. The researchers also reported that the cellular devices they examined lacked tamper protections, and that most did not encrypt sensitive data before transmission, which could increase exposure in environments using private access point names (APNs).
The paper recommends organisations treat cellular-enabled devices as privileged entry points into networks and connected data environments. Suggested mitigations include disabling or removing unused inter-chip interfaces, implementing end-to-end encryption before data traverses cellular modules, and adding monitoring and outbound controls within APN architectures. It also recommends including hardware-level security testing as part of standard product security practices.
You can read the full report here.
