Defending mobile networks against modern threats such as the exploitation of cellular-connected unmanned aerial vehicles requires sophisticated network intelligence and proactive security measures.
In June 2025, an operation known as Operation Spiderweb reportedly disabled or destroyed roughly 20 aircraft across multiple airbases by routing drone telemetry, command-and-control instructions, and audio‑visual feeds through the target nation’s own mobile networks. That incident made clear how readily UAVs can leverage standard telecom infrastructure to bypass conventional radio-frequency jamming and other traditional countermeasures.
For years military planners tended to discount civilian networks for tactical use. Meanwhile, commercial development of LTE and 5G technologies evolved to support airborne devices: 3GPP Releases 15 through 18 introduced native capabilities for drone communications. Those commercial improvements created a widespread, high-bandwidth connectivity fabric that malicious actors can now exploit using off‑the‑shelf 4G/5G modems and foreign SIM cards.
This shift forces mobile operators to reassess both infrastructure risk and regulatory compliance. Cellular-connected drones typically use the public network for three primary functions: sending telemetry, streaming audio-visual feeds, and receiving command-and-control messages. A drone fitted with a Wi‑Fi camera and a 4G or 5G modem can broadcast real‑time video across the same networks that support consumer internet and enterprise services.
When a malicious actor routes an attack through an operator’s cell sites, the bluntest responses—disabling base stations or shutting down mobile internet—are sometimes considered. But such sweeping actions inflict massive economic harm and disrupt essential services, potentially costing hundreds of millions of dollars per day while impeding business continuity for critical industries.
Operators therefore need more refined defensive tools to preserve service while neutralising airborne threats. Reactive measures like temporary or permanent network suspensions around sensitive locations reduce risk but also degrade legitimate connectivity for residents, businesses, and first responders.
Simple device controls—such as blocking newly activated foreign SIMs or imposing waiting periods on roamers—often prove inadequate. Determined attackers can generate misleading activity to bypass time-based restrictions or alter device identifiers like IMEI numbers to evade filters.
A more effective approach is targeted network activity blocking informed by deep packet inspection and behavioural analysis. That requires operators to detect device behaviours consistent with drones: unusual movement trajectories, altitude-associated signal patterns, and distinct data-consumption profiles that distinguish a fast-moving UAV from a passenger on a high-speed train.
Achieving this level of network intelligence relies on machine learning models combined with careful feature engineering. Improperly tuned systems risk high false-positive rates that could disconnect legitimate enterprise IoT devices or roaming users. Conversely, a highly accurate detection capability enables operators to isolate the malicious device from the network or, when control links are unencrypted and identifiable, even disrupt the command channel and force a safe landing.
Operators should treat their networks as contested spaces and build cybersecurity partnerships to strengthen defences. Integrating behavioural network analysis supports broader commercial objectives as well—such as offering secure private 5G slices, providing managed security services, and monetising API access for enterprise clients who demand trustworthy, resilient connectivity.
By preparing for cellular-connected drone threats, communication service providers can maintain the resilience and uptime industrial and enterprise customers expect, protecting critical operations against an increasingly complex and adaptive threat landscape.
Learn more about this topic from Enea in their report “Riders on the Cellular Storm” (PDF).
See also: Why AI is altering planning for 6G mobile networks
Want to learn about the IoT from industry leaders? Check out IoT Tech Expo, held in Amsterdam, California, and London. The event is part of TechEx and runs alongside other technology conferences including AI & Big Data Expo and the Cyber Security Expo.
Telecoms coverage is produced by TechForge Media. Explore upcoming enterprise technology events and webinars from TechForge Media.