✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
On June 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. These include CVE-2026-20245, an improper encoding vulnerability in Cisco Catalyst SD-WAN Manager; CVE-2026-11645, an out-of-bounds read and write flaw in Google Chrome's V8 engine; and CVE-2026-7473, an incomplete comparison vulnerability in Arista's Extensible Operating System (EOS). These vulnerabilities could allow attackers to execute arbitrary code or process unauthorized tunnel traffic, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by actively exploited flaws in widely used software and hardware. Organizations are urged to apply the necessary patches or mitigations promptly to safeguard their systems against potential attacks.
1 month ago
Kill Chain
CISA Highlights Active Exploitation of Three New Vulnerabilities
On June 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2026-7473 affecting Arista's Extensible Operating System, CVE-2026-11645 in Google Chromium's V8 engine, and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. These vulnerabilities pose significant risks to federal enterprises, as they are commonly targeted by malicious cyber actors. The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software flaws. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and protect their networks against active threats.
1 month ago
Kill Chain
NSO Group's Continued Targeting of WhatsApp Users Despite Legal Prohibitions
In June 2026, WhatsApp identified and disrupted a spear-phishing campaign linked to the NSO Group, a spyware firm previously barred by a court order from targeting WhatsApp users. The attackers attempted to deceive users into clicking malicious links leading to external websites, aiming to install spyware on their devices. This incident follows a 2019 campaign where NSO exploited a WhatsApp vulnerability to target approximately 1,400 users, leading to a lawsuit and a permanent injunction against NSO. ([techcrunch.com](https://techcrunch.com/2026/06/08/whatsapp-says-it-caught-new-spyware-attacks-linked-to-nso-group-in-violation-of-court-order/?utm_source=openai)) The recurrence of such attacks underscores the persistent threat posed by spyware firms and highlights the challenges in enforcing legal restrictions against them. Organizations must remain vigilant and proactive in defending against sophisticated phishing and spyware campaigns that continue to evolve despite legal deterrents.
1 month ago
Kill Chain
U.S. Military's Covert Use of GPS for Encrypted Key Distribution Unveiled
In June 2026, security researcher Steven Murdoch uncovered that the U.S. military has been utilizing public GPS signals to broadcast encrypted cryptographic keys for nearly two decades. This method effectively transformed GPS satellites into global 'numbers stations,' enabling the Over-the-Air Distribution (OTAD) and Over-the-Air Rekeying (OTAR) systems to remotely update cryptographic keys for military GPS receivers worldwide. The discovery highlights the military's innovative approach to secure key distribution without relying on physical couriers. ([404media.co](https://www.404media.co/the-u-s-military-quietly-turned-gps-into-a-global-numbers-station-evidence-suggests/?utm_source=openai)) This revelation underscores the critical importance of secure key management in military operations and the potential for leveraging existing infrastructure for covert communications. It also raises questions about the transparency of such methods and their implications for both military and civilian users of GPS technology.
1 month ago
Kill Chain
Cisco SD-WAN Zero-Day CVE-2026-20245: A Critical Security Alert
In June 2026, Cisco disclosed CVE-2026-20245, a zero-day vulnerability in its Catalyst SD-WAN Manager, marking the seventh such exploit in their SD-WAN products that year. This flaw allows authenticated attackers with netadmin privileges to execute arbitrary commands as root by uploading a crafted file, potentially leading to unauthorized configuration changes on edge devices. Exploitation requires valid credentials or prior exploitation of vulnerabilities like CVE-2026-20182 or CVE-2026-20127. Cisco has observed limited cases where this vulnerability resulted in configuration changes pushed to edge devices. As of now, no patch or workaround is available, and the company advises upgrading to fixed software released in May 2026 as a protective measure. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/05/cisco-sd-wan-cve-2026-20245-0-day-exploited/?utm_source=openai)) The recurrence of such vulnerabilities underscores the critical need for organizations to maintain rigorous access controls and promptly apply security updates. The exploitation of multiple zero-days within a short period highlights the evolving threat landscape targeting network infrastructure, emphasizing the importance of proactive vulnerability management and continuous monitoring to safeguard against potential breaches.
1 month ago
Kill Chain
Meta Challenges NSO Group Over New WhatsApp Spyware Attacks
In June 2026, Meta identified and disrupted a spear-phishing campaign linked to the Israeli spyware firm NSO Group, targeting WhatsApp users. This activity violated a permanent injunction issued in 2025, which barred NSO from engaging with WhatsApp and its users. The campaign involved deceptive messages designed to lure individuals into clicking malicious links, leading to external websites, and the creation of test accounts and groups within WhatsApp. Meta responded by filing a contempt-of-court complaint against NSO Group for defying the court order. ([cyberscoop.com](https://cyberscoop.com/meta-contempt-complaint-nso-group-spyware/?utm_source=openai)) This incident underscores the persistent threat posed by spyware vendors and the challenges in enforcing legal actions against them. It highlights the need for continuous vigilance and robust security measures to protect users from sophisticated cyber threats.
1 month ago
Kill Chain
Critical UniFi OS Vulnerabilities Enable Remote Code Execution
In May 2026, Ubiquiti's UniFi OS was found to have three critical vulnerabilities—CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910—each with a CVSS score of 10.0. These flaws allow unauthenticated remote attackers to execute arbitrary code with root privileges by chaining improper access control, path traversal, and command injection vulnerabilities. The vulnerabilities affect UniFi OS Server versions 5.0.6 and earlier, potentially compromising network management systems, surveillance cameras, and physical access controls. This incident underscores the escalating risks associated with network management systems as prime targets for cyberattacks. Organizations must prioritize timely patching and robust access controls to mitigate such vulnerabilities, especially given the increasing sophistication of threat actors targeting critical infrastructure.
1 month ago
Kill Chain
Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required
In February 2026, a critical vulnerability identified as CVE-2026-23111 was discovered in the Linux kernel's nf_tables subsystem. This flaw, resulting from an inverted genmask check in the nft_map_catchall_activate() function, allows unprivileged local users to escalate privileges to root. The vulnerability affects systems with user namespaces and nftables enabled, common configurations in many Linux distributions. Exploits leveraging this vulnerability have been publicly released, demonstrating the ease with which attackers can gain root access and potentially break out of containerized environments. The disclosure of CVE-2026-23111 underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel. The rapid development and public release of exploits for such vulnerabilities highlight the need for organizations to promptly apply security patches and review system configurations to mitigate potential risks.
1 month ago
Kill Chain
Meta Thwarts NSO Group's Latest WhatsApp Phishing Scheme
In June 2026, Meta identified and disrupted spear-phishing attempts linked to the Israeli spyware vendor NSO Group. These attacks aimed to deceive users into clicking malicious links, redirecting them to external websites outside of WhatsApp. Meta also discovered that NSO Group had created test accounts and groups on WhatsApp, which were subsequently removed. This activity violated a permanent injunction issued in 2025 that barred NSO from targeting WhatsApp and its users. In response, Meta filed a federal court contempt order against NSO Group for breaching this injunction. ([about.fb.com](https://about.fb.com/news/2026/06/fighting-spyware-an-update-from-whatsapp/?utm_source=openai)) This incident underscores the persistent threat posed by spyware vendors like NSO Group, who continue to develop and deploy sophisticated attacks against communication platforms. The recurrence of such activities highlights the need for ongoing vigilance and robust security measures to protect user privacy and maintain platform integrity.
1 month ago
Kill Chain
VerdantBamboo's Prolonged Cyber Espionage via BRICKSTORM Backdoor
In September 2025, cybersecurity firm Volexity identified a prolonged cyber espionage campaign by the Chinese state-sponsored group VerdantBamboo, also known as UNC5221. The attackers exploited a local privilege escalation vulnerability in an Egnyte Storage Sync appliance to deploy a BSD variant of the BRICKSTORM backdoor, maintaining undetected access for at least 18 months. This access facilitated further infiltration into the victim's Microsoft 365 environment and the deployment of additional malware, including PLENET and AGENTPSD, on various network appliances. The campaign underscores the increasing targeting of network appliances and storage systems by sophisticated threat actors, exploiting their lack of endpoint detection capabilities to establish long-term persistence. Organizations are urged to enhance monitoring and security measures for such devices to mitigate similar threats.
1 month ago
Kill Chain
C0XMO Botnet's 2026 Exploitation of DD-WRT Router Vulnerability
In June 2026, the C0XMO botnet, a sophisticated variant of the Gafgyt malware, exploited a buffer overflow vulnerability (CVE-2021-27137) in DD-WRT router firmware to compromise devices across multiple CPU architectures, including ARM, MIPS, and x86. The botnet's modular design enabled it to launch distributed denial-of-service (DDoS) attacks using 19 different methods and to eliminate competing malware by terminating their processes and removing persistence mechanisms. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/?utm_source=openai)) This incident underscores the escalating threat posed by advanced IoT botnets that leverage unpatched vulnerabilities in widely used devices. Organizations must prioritize timely firmware updates, enforce strong authentication practices, and disable unnecessary remote access to mitigate such risks.
1 month ago
Kill Chain
Cisco SD-WAN Vulnerability CVE-2026-20245: Root Privilege Escalation Risk
In June 2026, Cisco disclosed a high-severity vulnerability (CVE-2026-20245) in its Catalyst SD-WAN Manager, formerly known as SD-WAN vManage. This flaw arises from insufficient validation of user-supplied input, allowing authenticated local attackers with netadmin privileges to execute arbitrary commands as the root user by uploading crafted files. Exploitation of this vulnerability has been observed in limited cases, leading to unauthorized configuration changes pushed to edge devices. The ongoing exploitation of this zero-day vulnerability underscores the persistent targeting of network management systems by threat actors. Organizations utilizing Cisco's SD-WAN solutions should prioritize reviewing their systems for indicators of compromise and apply recommended mitigations promptly to prevent potential breaches and maintain network integrity.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports