The described technology is generally directed towards coordinated cellular network attack detection and mitigation. A security function deployed at a network node can monitor network traffic conditions for anomalous behavior indicative of a coordinated attack. In response to detecting the anomalous behavior, the security function can respond with any of several different attack mitigation procedures, in order to protect the network from the coordinated attack. Furthermore, the security function can collect data from connected devices, and use the data to identify malicious code. The security function can then send data and instructions to the connected devices to enable the connected devices to isolate or remove the malicious code.