✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
ArcaneDoor 2024: Unveiling the Cisco ASA Zero-Day Exploitation
In early 2024, a sophisticated cyber espionage campaign, dubbed 'ArcaneDoor,' targeted Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Attackers exploited zero-day vulnerabilities—CVE-2024-20353 and CVE-2024-20359—to implant malware, execute arbitrary code, and potentially exfiltrate data. The campaign primarily affected government entities, leveraging the compromised devices as persistent footholds within networks. ([techtarget.com](https://www.techtarget.com/searchsecurity/news/366582137/Cisco-zero-day-flaws-in-ASA-FTD-software-under-attack?utm_source=openai)) This incident underscores the critical need for organizations to promptly apply security patches and maintain up-to-date systems. The exploitation of edge devices highlights a growing trend where attackers focus on perimeter infrastructure to gain initial access, emphasizing the importance of comprehensive security strategies that encompass both endpoint and network defenses.
3 months ago
Kill Chain
FreePBX 2026: INJ3CTOR3's EncystPHP Web Shell Exploitation
In early 2026, over 900 Sangoma FreePBX instances were compromised through the exploitation of a post-authentication command injection vulnerability, CVE-2025-64328. This flaw allowed attackers, notably the INJ3CTOR3 group, to deploy the EncystPHP web shell, enabling remote command execution and persistent access. The majority of affected systems were located in the United States, with significant numbers also in Brazil, Canada, Germany, and France. The exploitation led to unauthorized outbound calls and potential lateral movement within networks. This incident underscores the critical importance of promptly applying security patches and restricting administrative access to trusted networks. The widespread nature of these attacks highlights the ongoing threat to VoIP infrastructures and the necessity for organizations to implement robust security measures to protect against such vulnerabilities.
3 months ago
Kill Chain
Unveiling Webloc: The Ad-Based Geolocation Surveillance Tool Used by Law Enforcement
In April 2026, Citizen Lab uncovered that law enforcement agencies in Hungary, El Salvador, and the United States utilized Webloc, an ad-based geolocation surveillance system developed by Cobwebs Technologies and later sold by Penlink. Webloc accesses data from up to 500 million mobile devices worldwide, including device identifiers, location coordinates, and profile data harvested from mobile apps and digital advertising. This system enables authorities to monitor individuals' locations and movements without warrants, raising significant privacy and civil liberties concerns. The revelation underscores the growing use of commercial data for surveillance purposes, highlighting the need for stringent oversight and regulation to protect individual privacy rights.
3 months ago
Kill Chain
Hims & Hers Data Breach: A Wake-Up Call for Third-Party Service Security
In early February 2026, telehealth company Hims & Hers experienced a data breach when unauthorized actors accessed its third-party customer service platform between February 4 and February 7. The attackers obtained customer support tickets containing personal information, including names and contact details. The company detected the intrusion on February 5 and promptly secured the affected system. While medical records and provider communications remained unaffected, the breach exposed sensitive customer data. ([techcrunch.com](https://techcrunch.com/2026/04/02/telehealth-giant-hims-hers-says-its-customer-support-system-was-hacked/?utm_source=openai)) This incident underscores the growing trend of cyberattacks targeting third-party service providers, exploiting their access to sensitive data. Organizations must reassess and strengthen their vendor risk management and cybersecurity measures to prevent similar breaches.
3 months ago
Kill Chain
Safeguarding AI Systems: Addressing Indirect Prompt Injection Vulnerabilities
In April 2026, security researchers identified a critical vulnerability in AI-integrated customer service solutions utilizing Large Language Models (LLMs). The attack, termed 'indirect prompt injection,' involves embedding malicious instructions within user profile fields or external data sources that the LLM processes as context. This method allows attackers to bypass supervisor agents designed to monitor direct user inputs, leading to unauthorized actions by the AI system. The exploitation of this vulnerability underscores the need for comprehensive security measures that encompass all data sources influencing LLM behavior. As AI systems become more integrated into critical workflows, the prevalence of such sophisticated attacks is expected to rise, highlighting the urgency for organizations to reassess and fortify their AI security protocols.
3 months ago
Kill Chain
FBI Dismantles APT28's Global Router-Based Espionage Network
In April 2026, the FBI, in collaboration with international partners, executed Operation Masquerade to dismantle a sophisticated cyberespionage campaign orchestrated by APT28, also known as Fancy Bear or Forest Blizzard. This Russian state-sponsored group had compromised over 18,000 TP-Link routers across more than 120 countries, infiltrating over 200 organizations. By exploiting vulnerabilities in these routers, APT28 altered DNS settings to redirect internet traffic through attacker-controlled servers, enabling the interception of sensitive data, including credentials for Microsoft Outlook and Office 365 services. The operation involved sending commands to reset the compromised routers' DNS settings, effectively severing the attackers' access and mitigating further data exfiltration. ([justice.gov](https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled?utm_source=openai)) This incident underscores the escalating threat posed by nation-state actors targeting network infrastructure to conduct large-scale espionage. The use of DNS hijacking to perform adversary-in-the-middle attacks highlights the need for organizations to secure all network devices, including SOHO routers, and to implement robust monitoring and response strategies to detect and mitigate such sophisticated threats. ([ncsc.gov.uk](https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations?utm_source=openai))
3 months ago
Kill Chain
Iranian Cyberattacks on U.S. Critical Infrastructure: A 2026 Analysis
In March 2026, Iranian-affiliated cyber actors initiated a series of attacks targeting U.S. critical infrastructure sectors, including energy, water, and government services. These attackers exploited vulnerabilities in internet-exposed Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs), leading to operational disruptions and financial losses. The Cybersecurity and Infrastructure Security Agency (CISA), along with other federal agencies, issued a joint advisory warning of these ongoing threats and provided mitigation strategies to affected organizations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-warns-of-iranian-hackers-targeting-critical-infrastructure/?utm_source=openai)) This incident underscores the escalating cyber threat landscape, particularly from nation-state actors targeting industrial control systems. Organizations must prioritize securing operational technology environments to prevent similar disruptions and safeguard critical services.
3 months ago
Kill Chain
EngageLab SDK Flaw Exposes Millions to Data Breach Risks
In April 2026, a critical security vulnerability was discovered in the EngageLab SDK, a widely used third-party Android software development kit. This flaw allowed malicious applications on the same device to bypass Android's security sandbox, granting unauthorized access to private data. The vulnerability exposed approximately 50 million Android users, including 30 million cryptocurrency wallet users, to potential data breaches and financial theft. The issue was promptly addressed with a security patch, mitigating further risks. This incident underscores the escalating threat of supply chain vulnerabilities in mobile applications, particularly those handling sensitive financial information. It highlights the necessity for developers to rigorously vet third-party SDKs and for organizations to implement robust security measures to protect user data against emerging threats.
3 months ago
Kill Chain
Handala Hack Team's 2026 Cyberattack on Stryker: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, the pro-Iranian hacktivist group Handala Hack Team executed a significant cyberattack against Stryker Corporation, a U.S.-based multinational medical technology firm. The attackers deployed wiper malware, resulting in the destruction of data on over 200,000 devices and servers, and exfiltrated approximately 50 terabytes of sensitive information. This attack led to substantial operational disruptions for Stryker, particularly affecting its global operations and innovation hubs. ([ndtv.com](https://www.ndtv.com/world-news/handala-hacktivist-stryker-iran-war-live-how-iran-group-hacked-2-00-000-devices-in-cyber-onslaught-on-us-medtech-11210681?utm_source=openai)) This incident underscores the escalating cyber threats posed by nation-state-affiliated actors targeting critical infrastructure sectors. The use of destructive malware and large-scale data exfiltration highlights the need for enhanced cybersecurity measures and vigilance within the healthcare industry and beyond.
3 months ago
Kill Chain
APT28's 2025 SOHO Router DNS Hijacking: A Wake-Up Call for Network Security
In August 2025, the Russian state-sponsored group APT28 (also known as Forest Blizzard) initiated a large-scale cyber-espionage campaign targeting small office/home office (SOHO) routers, primarily from TP-Link and MikroTik. By exploiting known vulnerabilities, such as CVE-2023-50224, the attackers gained unauthorized access to these routers and modified their DNS settings to redirect traffic through malicious servers under their control. This allowed them to intercept and steal credentials for web and email services, including Microsoft Outlook, from over 200 organizations and 5,000 consumer devices across more than 120 countries. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/?utm_source=openai)) The campaign, which peaked in December 2025, underscores the critical need for securing network infrastructure, especially SOHO devices that may lack robust security measures. The U.S. Department of Justice, in collaboration with the FBI and international partners, conducted Operation Masquerade to disrupt this malicious network, highlighting the ongoing threat posed by state-sponsored cyber activities and the importance of proactive defense strategies. ([justice.gov](https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled?utm_source=openai))
3 months ago
Kill Chain
DISGOMOJI Malware: A New Era of Emoji-Based Cyber Attacks
In 2024, the Pakistan-based Advanced Persistent Threat (APT) group UTA0137 launched a cyber-espionage campaign targeting Indian government entities. The group deployed a sophisticated malware named DISGOMOJI, written in Golang and designed for Linux systems. DISGOMOJI uniquely utilized Discord for command-and-control (C2) communications, employing emojis to execute commands such as taking screenshots, exfiltrating files, and terminating processes. The malware was delivered via spear-phishing emails containing a ZIP archive with a Golang ELF binary. Upon execution, the binary downloaded a lure file and the DISGOMOJI payload, establishing a dedicated Discord channel for each infected system, allowing individualized interaction with each victim. This campaign underscores the evolving tactics of state-sponsored threat actors in leveraging unconventional methods to evade detection and maintain persistent access to targeted systems. The use of emojis in C2 communications highlights a broader trend of adversaries adopting more visual and adaptive forms of interaction to obfuscate their activities and complicate monitoring efforts.
3 months ago
Kill Chain
EngageLab SDK Vulnerability: A Wake-Up Call for Android Developers
In April 2025, a critical intent redirection vulnerability was discovered in the EngageLab SDK, a widely used third-party Android library for managing messaging and push notifications. This flaw allowed malicious applications to exploit the SDK's exported activity, MTCommonActivity, to gain unauthorized access to private data by bypassing Android's security mechanisms. The vulnerability affected numerous applications, including cryptocurrency wallets, with over 30 million installations, exposing sensitive user information to potential risk. EngageLab addressed the issue by releasing version 5.2.1 on November 3, 2025, which set the vulnerable activity to non-exported, mitigating the risk. This incident underscores the significant security implications of vulnerabilities in third-party SDKs, especially in high-value sectors like digital asset management. It highlights the necessity for developers to rigorously review and monitor third-party components integrated into their applications to prevent similar security breaches.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports