I am not sure this is the ISP here -- (out of the air) I think this might be simpler to answer by saying the spammer is abusing vulnerabilities in the SS7 network.

learning about those vulnerabilities can be done by watching public CCC and other similar conference talks