✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
CISA Adds Two Known Exploited Vulnerabilities to Catalog
On June 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2022-0492, a Linux Kernel Improper Authentication Vulnerability, and CVE-2025-48595, an Android Framework Integer Overflow Vulnerability. Both vulnerabilities are actively exploited, posing significant risks to federal enterprises. CVE-2022-0492 allows unauthorized access to Linux systems, while CVE-2025-48595 enables local privilege escalation on Android devices without user interaction. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48595?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the critical need for organizations to promptly address known security flaws. With active exploitation in the wild, timely remediation is essential to mitigate potential threats and protect sensitive information.
1 month ago
Kill Chain
Google Addresses Actively Exploited Android Zero-Day CVE-2025-48595 in June 2026 Security Update
In June 2026, Google released security patches addressing 124 vulnerabilities in the Android operating system, notably including CVE-2025-48595. This high-severity zero-day flaw in the Android Framework allows local attackers to execute code and escalate privileges on devices running Android 14 and later. Exploitation does not require user interaction, suggesting potential use of malicious applications to gain unauthorized access. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/?utm_source=openai)) The active exploitation of CVE-2025-48595 underscores the persistent threat posed by zero-day vulnerabilities in widely used platforms. Organizations must prioritize timely application of security updates to mitigate risks associated with such flaws, especially given the increasing sophistication of targeted attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/?utm_source=openai))
1 month ago
Kill Chain
Google's June 2026 Android Security Update: Addressing 124 Vulnerabilities, Including Actively Exploited CVE-2025-48595
In June 2026, Google released security updates addressing 124 vulnerabilities in the Android operating system, notably including CVE-2025-48595—a high-severity privilege escalation flaw in the Framework component. This vulnerability affects Android versions 14 through 16 QPR2 and allows attackers to gain elevated privileges without user interaction, potentially leading to full device compromise. Google has acknowledged indications of limited, targeted exploitation of this flaw in the wild. The active exploitation of CVE-2025-48595 underscores the persistent threat posed by privilege escalation vulnerabilities in widely used mobile platforms. Organizations and individuals are urged to promptly apply the June 2026 security patches to mitigate potential risks associated with this and other addressed vulnerabilities.
1 month ago
Kill Chain
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
In May 2026, Dutch authorities dismantled a massive botnet comprising over 17 million infected devices, including computers, smartphones, and IoT devices. The operation, conducted by the Dutch National Police and the National Cyber Security Centre (NCSC), involved seizing more than 200 servers located in the Netherlands that controlled the botnet's infrastructure. The botnet was reportedly linked to Asocks, a company offering residential proxy services, which had been exploited for various cybercriminal activities such as DDoS attacks, phishing, and malware distribution. ([arstechnica.com](https://arstechnica.com/security/2026/05/botnet-of-more-than-17-million-devices-dismantled/?utm_source=openai)) This incident underscores the growing threat posed by large-scale botnets leveraging residential proxy networks to mask malicious activities. The takedown highlights the importance of international cooperation in combating cybercrime and the need for robust security measures to protect consumer devices from being co-opted into such networks.
1 month ago
Kill Chain
Charter Communications Data Breach 2026: A Case Study in Social Engineering Attacks
In early April 2026, Charter Communications, a major U.S. telecommunications provider, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers gained access through a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account, allowing them to infiltrate Charter's Salesforce system. This breach resulted in the exfiltration of personal information from approximately 4.9 million accounts, including names, email addresses, physical addresses, phone numbers, phone types, plan information, support ticket data, and some Customer Proprietary Network Information (CPNI). Charter confirmed the breach but stated that no sensitive personal or CPNI data was exfiltrated. After the company refused to pay the ransom demanded by ShinyHunters, the stolen data was leaked on the dark web. This incident underscores the growing threat posed by sophisticated social engineering attacks targeting employee credentials to access sensitive corporate systems. The breach highlights the critical need for robust security measures, including comprehensive employee training on phishing tactics and the implementation of multi-factor authentication, to prevent unauthorized access and protect customer data.
1 month ago
Kill Chain
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
In May 2026, Dutch authorities dismantled a massive botnet comprising 17 million infected devices, including computers, tablets, and smartphones. The operation involved seizing over 200 servers located in the Netherlands that controlled the botnet's infrastructure. This network was utilized for various cyberattacks, such as distributed denial-of-service (DDoS) attacks and malicious traffic proxying. The botnet was linked to a service called Asocks, which offered proxy services using compromised devices without the owners' knowledge. This incident underscores the growing threat posed by botnets leveraging residential devices, highlighting the need for enhanced security measures to protect consumer hardware from unauthorized exploitation.
1 month ago
Kill Chain
GREYVIBE's AI-Powered Cyberattacks on Ukraine: A 2025 Case Study
In August 2025, a previously undocumented threat actor named GREYVIBE initiated a series of cyberattacks targeting Ukrainian military, government, civilian, and business entities. Operating from the Russian time zone and aligning with Kremlin state interests, GREYVIBE employed multiple attack vectors, including spear-phishing emails, fake CAPTCHA pages, and fraudulent websites, to deliver custom-developed malware such as PhantomRelay and LegionRelay. Notably, the group leveraged generative artificial intelligence (GenAI) and large language models (LLMs) to enhance their operations, facilitating rapid development of obfuscators, loaders, and malware. ([thehackernews.com](https://thehackernews.com/2026/05/new-russian-linked-greyvibe-targets.html?utm_source=openai)) The integration of AI technologies in cyberattacks signifies a concerning evolution in threat actor capabilities, enabling even low-to-moderately sophisticated groups to execute complex operations. This trend underscores the urgent need for organizations to adopt advanced cybersecurity measures to detect and mitigate AI-assisted threats. ([t.co](https://t.co/WAHU7GJnZC?utm_source=openai))
1 month ago
Kill Chain
BTMOB: The No-Code Android Malware Service Empowering Cybercriminals
In May 2026, cybersecurity researchers identified BTMOB, an Android remote access trojan (RAT) offered as a malware-as-a-service (MaaS) platform. BTMOB provides cybercriminals with a no-code APK builder, enabling the creation of customized phishing payloads without programming expertise. The malware grants attackers extensive control over infected devices, including data exfiltration, financial transaction interception, screenshot capture, and remote operation. Distributed primarily through phishing websites impersonating legitimate services, BTMOB has been notably active in Brazil and Latin America. Its accessibility and comprehensive feature set pose a significant threat to Android users globally. The emergence of BTMOB underscores a concerning trend in the cyber threat landscape: the commoditization of sophisticated malware through MaaS platforms. This development lowers the barrier to entry for cybercriminals, facilitating the rapid proliferation of advanced threats. Organizations must remain vigilant, as the ease of deploying such malware increases the risk of widespread attacks targeting mobile devices.
1 month ago
Kill Chain
GreyVibe Hackers Leverage AI in 2025 Cyberattacks
In August 2025, the Russian-linked threat group GreyVibe initiated a cyberespionage campaign targeting Ukrainian military, government, civilian, and business sectors. Utilizing AI tools like ChatGPT and Google Gemini, they crafted sophisticated lures and developed custom malware, including LegionRelay and PhantomRelay, to infiltrate systems and exfiltrate sensitive data. Their tactics encompassed spear-phishing emails, fake CAPTCHA pages, and counterfeit websites, leading to significant data breaches and operational disruptions. This incident underscores the escalating use of AI in cyberattacks, enabling threat actors to enhance the scale and sophistication of their operations. Organizations must adapt by implementing advanced security measures and continuous monitoring to counteract these evolving threats.
1 month ago
Kill Chain
BTMOB RAT: A New Android Malware-as-a-Service Threat
In May 2026, cybersecurity researchers identified BTMOB, an Android Remote Access Trojan (RAT), actively targeting users in Brazil and Latin America. Distributed through phishing campaigns that mimic legitimate services, BTMOB is sold as a malware-as-a-service (MaaS), allowing attackers to create malicious apps without coding expertise. Once installed, it exploits Android's Accessibility Services to gain elevated permissions, enabling data exfiltration, screen capture, and full remote control of infected devices. This comprehensive access poses significant risks, including financial theft and privacy breaches. The emergence of BTMOB underscores a growing trend in the commoditization of sophisticated malware, lowering the barrier for cybercriminals and expanding the threat landscape. Its MaaS model facilitates rapid adaptation and distribution, making it a formidable challenge for cybersecurity defenses worldwide.
1 month ago
Kill Chain
Grandoreiro and BTMOB Malware Campaigns: A 2026 Cybersecurity Threat
In May 2026, cybersecurity firms WatchGuard and ESET identified two sophisticated banking trojan campaigns targeting Windows and Android users in Latin America and Europe. The Grandoreiro malware, active since 2016, employs DLL side-loading techniques to infiltrate Windows systems, primarily targeting financial institutions in Portugal. Concurrently, the BTMOB remote access trojan (RAT) compromises Android devices, enabling attackers to exfiltrate sensitive data and gain remote control. These campaigns utilize phishing emails and deceptive websites to distribute malicious payloads, posing significant threats to both individual users and organizations. The persistence and evolution of these malware families underscore the adaptability of financially motivated threat actors. By leveraging legitimate services and employing advanced evasion techniques, such as WebRTC communications and anti-analysis checks, these campaigns highlight the increasing complexity of modern cyber threats and the necessity for robust, multi-layered security defenses.
2 months ago
Kill Chain
Cybercriminals Exploit Government Data in Latin America: The 2026 Antel Breach
In May 2026, the cybercriminal group La Pampa Leaks claimed to have breached Uruguay's government-sponsored identity service, TuID, managed by the state-owned telecommunications company Antel. The attackers alleged prolonged access to the platform's infrastructure, potentially exposing sensitive personal data of Uruguayan citizens, including identification numbers, full names, birth dates, email addresses, phone numbers, residential addresses, biometric information, and digital signature data. Antel confirmed the cyberattack but stated that authentication credentials and highly sensitive data remained uncompromised. Immediate containment measures were implemented, and the incident was reported to the relevant authorities. This incident underscores a growing trend in Latin America, where cybercriminals increasingly target government agencies to monetize citizen data. The public-administration sector in the region has become the most-breached industry in the past year, highlighting the urgent need for enhanced cybersecurity measures and regulatory compliance to protect sensitive information.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports