✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Telnyx PyPI Supply Chain Attack: A 2026 Case Study
In March 2026, the Telnyx Python package on the Python Package Index (PyPI) was compromised by the threat actor TeamPCP. Malicious versions 4.87.1 and 4.87.2 were uploaded, embedding malware that exfiltrated sensitive data such as SSH keys, cloud tokens, and cryptocurrency wallets. The attack utilized steganography, hiding the payload within WAV audio files, and affected both Linux/macOS and Windows systems. This incident underscores the escalating threat of supply chain attacks targeting widely used open-source packages, emphasizing the need for enhanced security measures in software development pipelines.
4 months ago
Kill Chain
Bearlyfy's 2025 Ransomware Campaign Against Russian Companies
In early 2025, the pro-Ukrainian cyber group Bearlyfy initiated a series of over 70 ransomware attacks targeting Russian companies. Employing custom strains like GenieLocker, Bearlyfy exploited vulnerabilities in public-facing applications to gain initial access, subsequently encrypting critical data and demanding ransoms. The group's operations have caused significant disruptions across various sectors in Russia. This incident underscores a growing trend of politically motivated cyberattacks, where hacktivist groups leverage ransomware to inflict economic damage. The Bearlyfy attacks highlight the evolving landscape of cyber threats, emphasizing the need for robust security measures to protect against both financially and ideologically driven adversaries.
4 months ago
Kill Chain
Coruna Exploit Kit: A Case Study in the Commercialization of Nation-State Cyber Tools
In February 2025, Google's Threat Intelligence Group (GTIG) identified 'Coruna,' a sophisticated iOS exploit kit comprising 23 vulnerabilities across five exploit chains, targeting devices running iOS 13 through 17.2.1. Initially deployed by a surveillance vendor for government clients, Coruna was later utilized by Russian state actors in espionage campaigns against Ukrainian users. By December 2025, the exploit kit had proliferated to financially motivated Chinese cybercriminals, who employed it to steal cryptocurrency from over 42,000 iOS devices via malicious websites. This rapid transition from state-sponsored espionage to widespread financial crime underscores the growing commercialization and accessibility of nation-state-level cyber tools. The Coruna incident highlights the urgent need for organizations to stay vigilant against advanced threats, as sophisticated exploit kits once exclusive to government entities are increasingly available to cybercriminals, posing significant risks to both individuals and enterprises.
4 months ago
Kill Chain
UK Sanctions Xinbi Marketplace Linked to Asian Scam Centers
In March 2026, the United Kingdom's Foreign, Commonwealth and Development Office (FCDO) imposed sanctions on Xinbi, a Chinese-language online marketplace operating via Telegram. Xinbi has been implicated in facilitating the sale of stolen data and satellite internet equipment to scam networks across Southeast Asia. Additionally, the platform is believed to have assisted North Korean threat actors in laundering cryptocurrency obtained from significant cyber heists targeting global companies and individuals. Between 2021 and 2025, Xinbi processed over $19.9 billion, engaging in activities ranging from unlicensed over-the-counter trades and money laundering to the distribution of stolen personal databases. The UK's sanctions aim to sever Xinbi's connections to the legitimate cryptocurrency ecosystem, thereby disrupting its operations and preventing further illicit activities. This action underscores the growing international efforts to combat cybercrime infrastructures that enable large-scale financial fraud and data breaches. The sanctions against Xinbi highlight the necessity for organizations to enhance their cybersecurity measures and remain vigilant against platforms that facilitate cybercriminal activities.
4 months ago
Kill Chain
Coruna Exploit Kit: A Cautionary Tale of Advanced Hacking Tools in Cybercriminal Hands
In 2025, the Coruna exploit kit emerged as a sophisticated tool targeting iPhones running iOS versions 13.0 through 17.2.1. Initially deployed by a surveillance vendor for government clients, Coruna was later utilized by Russian espionage groups in attacks against Ukrainian users and by financially motivated hackers in China. The kit comprises five exploit chains and 23 vulnerabilities, including CVE-2023-32434 and CVE-2023-38606, previously exploited in Operation Triangulation. These vulnerabilities enable remote code execution and privilege escalation, granting attackers full control over affected devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of government-grade hacking tools into the broader cybercriminal ecosystem. This incident highlights the urgent need for organizations to implement robust security measures, promptly apply software updates, and monitor for emerging threats to protect sensitive data and maintain operational integrity. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))
4 months ago
Kill Chain
Unveiling Red Menshen's 2026 BPFDoor Espionage in Telecom Networks
In 2026, the China-linked threat actor Red Menshen, also known as Earth Bluecrow, conducted a prolonged cyber espionage campaign targeting telecommunications networks across the Middle East and Asia. Utilizing the stealthy Linux backdoor BPFDoor, the group infiltrated critical infrastructure, including Home Subscriber Servers (HSS), to exfiltrate sensitive subscriber data. BPFDoor's advanced evasion techniques allowed it to bypass traditional security measures, enabling Red Menshen to maintain persistent access and conduct surveillance undetected for extended periods. This incident underscores the increasing sophistication of nation-state cyber threats targeting telecom infrastructure. The use of kernel-level implants and passive backdoors like BPFDoor highlights the need for enhanced detection capabilities and proactive security measures to protect critical communication networks from such covert operations.
4 months ago
Kill Chain
OpenCode Systems 2026 Access Control Vulnerability Exposes SMS Messages
In March 2026, a significant security vulnerability (CVE-2025-70614) was identified in OpenCode Systems' OC Messaging and USSD Gateway version 6.32.2. This flaw allowed authenticated users with low privileges to access SMS messages beyond their authorized scope by manipulating company or tenant identifier parameters. The vulnerability posed a substantial risk to data confidentiality across multi-tenant environments. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-70614/?utm_source=openai)) The incident underscores the critical importance of robust access control mechanisms in multi-tenant systems. Organizations are urged to review and strengthen their access control policies to prevent similar vulnerabilities and protect sensitive information.
4 months ago
Kill Chain
Critical Authentication Bypass Vulnerability in TP-Link Routers Exposes Networks to Attack
In March 2026, TP-Link disclosed a critical authentication bypass vulnerability (CVE-2026-0834) affecting Archer C20 v6.0 and Archer AX53 v1.0 routers. This flaw resides in the TP-Link Device Debug Protocol (TDDP) module, allowing unauthenticated attackers on the same network to execute administrative commands, such as factory resets and reboots, without credentials. Exploitation of this vulnerability can lead to complete configuration loss and service disruption. This incident underscores the persistent risks associated with network infrastructure vulnerabilities, particularly in consumer-grade routers. The exploitation of such flaws can facilitate broader cyberattacks, including the formation of botnets and unauthorized access to sensitive information. Organizations and individuals must prioritize timely firmware updates and implement robust network security measures to mitigate these risks.
4 months ago
Kill Chain
Red Menshen's BPFDoor Malware: A 2026 Telecom Security Wake-Up Call
In early 2026, the Chinese state-sponsored Advanced Persistent Threat (APT) group known as Red Menshen executed a sophisticated cyber-espionage campaign targeting telecommunications providers across multiple regions, including South America and Southeast Asia. Utilizing an advanced variant of their BPFDoor malware, the attackers exploited vulnerabilities in edge network devices to gain initial access. Once inside, they deployed custom Linux-based implants to establish persistent backdoors, enabling them to conduct extensive reconnaissance and exfiltrate sensitive subscriber data over an extended period. The stealthy nature of BPFDoor allowed the attackers to bypass traditional security measures, remaining undetected for months. This breach underscores the evolving tactics of nation-state actors in targeting critical infrastructure sectors, particularly telecommunications, to gather intelligence and potentially disrupt services. The incident highlights the urgent need for enhanced security measures, including robust monitoring of network edge devices and the implementation of advanced threat detection systems to identify and mitigate such sophisticated attacks.
4 months ago
Kill Chain
Yanluowang Ransomware Access Broker Sentenced to 81 Months
In March 2026, Russian national Aleksey Olegovich Volkov was sentenced to 81 months in prison for his role as an initial access broker for the Yanluowang ransomware group. Between July 2021 and November 2022, Volkov infiltrated at least eight U.S. companies' networks, selling access to ransomware operators who demanded ransoms ranging from $300,000 to $15 million. Volkov's activities resulted in significant financial and operational disruptions for the affected organizations. This case underscores the critical role of initial access brokers in the ransomware ecosystem and highlights the importance of robust cybersecurity measures to prevent unauthorized access. The sentencing also reflects increased international cooperation in prosecuting cybercriminals, signaling a stronger stance against such activities.
4 months ago
Kill Chain
FCC Bans Foreign-Made Routers Over Security Risks
In March 2026, the Federal Communications Commission (FCC) expanded its Covered List to include all consumer routers manufactured outside the United States, effectively banning the sale of new foreign-made router models in the U.S. This decision was based on a National Security Determination that identified foreign-produced routers as potential risks to the U.S. economy, critical infrastructure, and national defense. The FCC highlighted that such devices had been exploited in cyberattacks targeting vital U.S. infrastructure. This action underscores the growing concerns over supply chain vulnerabilities and the potential for foreign-manufactured networking equipment to be used in cyber espionage or attacks. Organizations are urged to assess their current network infrastructure and consider sourcing equipment from trusted domestic manufacturers to mitigate security risks.
4 months ago
Kill Chain
Crunchyroll's 2026 Data Breach Raises User Privacy Concerns
In March 2026, Crunchyroll, a leading anime streaming platform, faced a class-action lawsuit alleging violations of the Video Privacy Protection Act (VPPA). The lawsuit claims that Crunchyroll shared users' personal data, including email addresses, device IDs, and viewing histories, with the marketing company Braze without obtaining proper consent. This alleged data sharing has raised significant privacy concerns among users and industry observers. ([animecorner.me](https://animecorner.me/crunchyroll-hit-with-class-action-lawsuit-over-allegedly-disclosing-anime-viewing-habits-to-third-party/?utm_source=openai)) This incident underscores the critical importance of adhering to data privacy regulations and obtaining explicit user consent before sharing personal information. It also highlights the potential legal and reputational risks companies face when failing to protect user data adequately.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports