I think, there being GTP traffic originating from victim S-GW through interface to GRX destined to P-GW at complicit/compromised foreign carrier should be normal. Although, there being no corresponding traffic towards the cell towers for the GTP packets would be weird, and initial port knocking on which victim carrier S-GW would initiate VPN over would be weird too.

The diagram in the article is succinct but only a small part of complex full 3GPP architecture[1][2]. I kind of suspect it had probably been easy enough to chalk such traffic up to "a buggy implementation they're using over there" for a while.

1: https://yatebts.com/documentation/concepts/lte-concepts/

2: https://github.com/nickel0/3GPP-Overall-Architecture/blob/ma...