Here are some ideas:

-QUANTUMINSERT -> SS7

-CANDYMAN -> GOPHERSET

-WAP push

-Vuln. via specially-crafted SMS/MMS

-APN update