✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Iranian Cyber Actors Escalate Attacks on Global Infrastructure in 2026
In early March 2026, Iranian state-affiliated cyber actors launched a coordinated campaign targeting critical infrastructure across Israel, Gulf Cooperation Council countries, Europe, and North America. The attacks, coinciding with joint U.S.-Israeli military operations, included over 150 incidents such as DDoS attacks, website defacements, and data exfiltration operations against sectors like government, finance, aviation, telecommunications, and energy. ([objectwire.org](https://www.objectwire.org/google/news/iran-cyber-attacks-google-threat-intelligence-march-2026?utm_source=openai)) This escalation underscores the persistent and evolving cyber threat posed by Iranian actors, highlighting the need for heightened vigilance and robust cybersecurity measures to protect critical infrastructure globally.
4 months ago
Kill Chain
Urgent: Cisco SD-WAN Manager Vulnerabilities Under Active Exploitation
In March 2026, Cisco disclosed active exploitation of two vulnerabilities in its Catalyst SD-WAN Manager: CVE-2026-20122 and CVE-2026-20128. CVE-2026-20122 is a high-severity arbitrary file overwrite vulnerability that allows authenticated remote attackers with read-only API access to overwrite files on the local file system, potentially escalating privileges. CVE-2026-20128 is a medium-severity information disclosure flaw enabling authenticated local attackers with valid vManage credentials to access sensitive information, facilitating lateral movement within networks. These vulnerabilities affect all configurations of the Catalyst SD-WAN Manager software. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-authbp-qwCX8D4v.html?utm_source=openai)) The active exploitation of these vulnerabilities underscores the persistent targeting of network infrastructure by sophisticated threat actors. Organizations utilizing Cisco's SD-WAN solutions must prioritize immediate remediation to mitigate potential breaches and maintain network integrity. ([thehackernews.com](https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html?utm_source=openai))
4 months ago
Kill Chain
UAT-9244's New Malware Threatens South American Telecoms
Since 2024, the China-linked advanced persistent threat actor UAT-9244 has been targeting telecommunication service providers in South America, compromising Windows, Linux, and network-edge devices. The group employs three previously undocumented malware families: TernDoor, a Windows backdoor; PeerTime, a Linux backdoor utilizing the BitTorrent protocol; and BruteEntry, a brute-force scanner that establishes proxy infrastructure. These tools enable UAT-9244 to maintain persistent access, execute remote commands, and expand their network infiltration. This incident underscores the evolving sophistication of state-sponsored cyber threats targeting critical infrastructure. The use of novel malware and advanced techniques highlights the need for enhanced cybersecurity measures and vigilance within the telecommunications sector.
4 months ago
Kill Chain
APT28's BadPaw and MeowMeow Malware: A New Threat to Ukraine
In early March 2026, cybersecurity researchers identified a sophisticated cyber espionage campaign targeting Ukrainian entities. The attack, attributed with moderate confidence to the Russian state-sponsored group APT28, commenced with phishing emails sent from ukr[.]net addresses. These emails contained links to ZIP archives, leading to the deployment of two previously undocumented malware families: BadPaw, a .NET-based loader, and MeowMeow, a backdoor capable of remote command execution and file system manipulation. The malware employed advanced evasion techniques, including sandbox detection and obfuscation, to maintain persistence and avoid detection. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-linked-campaign-deploys-badpaw.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors and highlights the persistent cyber threats facing Ukraine. The use of novel malware strains and sophisticated delivery methods reflects a broader trend of increasing complexity in cyber attacks, necessitating enhanced vigilance and adaptive defense strategies among targeted organizations.
4 months ago
Kill Chain
Dust Specter 2026: Iranian APT's AI-Assisted Cyberattack on Iraqi Officials
In January 2026, the Iranian-linked Advanced Persistent Threat (APT) group known as Dust Specter launched a sophisticated cyberattack targeting Iraqi government officials. By impersonating Iraq's Ministry of Foreign Affairs, the attackers distributed previously undocumented malware—SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM—through two distinct infection chains. These campaigns utilized advanced techniques such as DLL sideloading, in-memory PowerShell execution, and the exploitation of compromised Iraqi government infrastructure to stage malicious payloads. The operation's complexity and the use of generative AI tools in malware development underscore the evolving capabilities of state-sponsored cyber actors. ([thehackernews.com](https://thehackernews.com/2026/03/dust-specter-targets-iraqi-officials.html?utm_source=openai)) This incident highlights a concerning trend in cyber warfare: the integration of artificial intelligence in malware development, enabling more adaptive and evasive threats. Organizations must enhance their cybersecurity measures to detect and mitigate such sophisticated attacks, emphasizing the need for continuous monitoring and advanced threat intelligence.
4 months ago
Kill Chain
Cisco SD-WAN Manager Vulnerabilities Exploited in 2026
In March 2026, Cisco disclosed active exploitation of two vulnerabilities in its Catalyst SD-WAN Manager: CVE-2026-20122 and CVE-2026-20128. CVE-2026-20122 allows authenticated remote attackers with read-only API access to overwrite arbitrary files on the local file system, potentially escalating privileges. CVE-2026-20128 enables authenticated local attackers to access credential files, granting Data Collection Agent (DCA) user privileges. These vulnerabilities affect multiple versions of the software, with patches released in late February 2026. Organizations are urged to update to fixed releases promptly to mitigate risks. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-authbp-qwCX8D4v.html?utm_source=openai)) The active exploitation of these vulnerabilities underscores the critical need for timely software updates and robust access controls. As attackers increasingly target network infrastructure components, organizations must prioritize patch management and monitor for unusual activities to prevent unauthorized access and potential data breaches.
4 months ago
Kill Chain
BadeSaba Calendar App Hack: A New Front in Cyber Warfare
In late February 2026, during coordinated military strikes by the United States and Israel on Iranian targets, the BadeSaba Calendar app—a widely used prayer-timing application with over 5 million downloads—was compromised. Users received push notifications in Persian urging military personnel and civilians to defect, lay down arms, or join opposition forces. Messages included phrases such as "Help has arrived" and "It's time for reckoning." This cyber operation coincided with physical airstrikes and resulted in a near-total internet blackout in Iran, disrupting government communications, state media, and public services. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Cyberwarfare_during_the_2026_Iran_war?utm_source=openai)) This incident underscores the evolving landscape of cyber warfare, where digital platforms are exploited to disseminate psychological operations alongside kinetic military actions. The strategic use of a trusted religious app to deliver propaganda highlights the need for robust cybersecurity measures, especially for applications with significant user bases in geopolitically sensitive regions.
4 months ago
Kill Chain
Silver Dragon APT41 Targets Governments with Cobalt Strike and Google Drive C2
Silver Dragon, an advanced persistent threat (APT) group linked to China's APT41, has been actively targeting government entities in Europe and Southeast Asia since mid-2024. The group gains initial access by exploiting vulnerabilities in public-facing servers and through phishing emails containing malicious attachments. To maintain persistence, Silver Dragon hijacks legitimate Windows services, allowing their malware to blend seamlessly into normal system activity. Notably, they employ Cobalt Strike beacons for persistence and utilize Google Drive for command-and-control (C2) communications, effectively evading traditional detection mechanisms. ([thehackernews.com](https://thehackernews.com/2026/03/apt41-linked-silver-dragon-targets.html?utm_source=openai))This incident underscores a concerning trend where threat actors increasingly leverage legitimate cloud services for C2 operations, complicating detection and mitigation efforts. The use of tools like Cobalt Strike and Google Drive in cyber-espionage campaigns highlights the need for enhanced monitoring of both inbound and outbound network traffic to identify and thwart such sophisticated attacks. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai))
4 months ago
Kill Chain
2025 Mobile Malware Surge: Key Threats and Protective Measures
In 2025, Kaspersky's analysis revealed a significant surge in mobile malware attacks, with over 14 million incidents involving malicious, advertising, or unwanted software targeting mobile devices. Notably, adware constituted 62% of these detections, while the number of new Trojan banker installation packages for Android escalated to 255,090, marking a 271% increase from the previous year. This sharp rise underscores the growing profitability of such attacks for cybercriminals. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai)) The proliferation of preinstalled backdoors like Triada and Keenadu, embedded during device manufacturing, presents a formidable challenge, granting attackers extensive control over compromised devices. Additionally, the emergence of the Kimwolf IoT botnet, which exploits Android TV boxes for DDoS attacks and as reverse proxies, highlights the expanding threat landscape. These developments necessitate heightened vigilance and robust security measures to safeguard mobile users. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai))
4 months ago
Kill Chain
Surge in Hacktivist DDoS Attacks Amid Middle East Tensions
Between February 28 and March 2, 2026, a surge of 149 hacktivist-driven distributed denial-of-service (DDoS) attacks targeted 110 organizations across 16 countries. This wave of cyber assaults was primarily in response to the U.S.-Israel coordinated military campaign against Iran, codenamed Epic Fury and Roaring Lion. The attacks predominantly focused on government entities, financial institutions, and telecommunications sectors, with the majority occurring in the Middle East, particularly in Kuwait, Israel, and Jordan. Notably, two hacktivist groups, Keymous+ and DieNet, were responsible for nearly 70% of the attack activity during this period. ([thehackernews.com](https://thehackernews.com/2026/03/149-hacktivist-ddos-attacks-hit-110.html?utm_source=openai)) This incident underscores the escalating trend of cyber retaliation in geopolitical conflicts, highlighting the need for organizations to bolster their cybersecurity defenses against ideologically motivated threat actors. The concentrated nature of these attacks emphasizes the importance of proactive threat intelligence and robust incident response strategies to mitigate potential disruptions to critical infrastructure and services.
4 months ago
Kill Chain
Understanding the Coruna iOS Exploit Kit: Implications and Protections
In early 2026, Google’s Threat Intelligence Group identified 'Coruna,' a sophisticated iOS exploit kit targeting devices running iOS versions 13.0 through 17.2.1. The kit comprises five full exploit chains utilizing 23 vulnerabilities, enabling attackers to execute remote code and escalate privileges. Initially observed in February 2025 within a surveillance vendor's operations, Coruna was subsequently employed by Russian espionage groups in mid-2025 and later by financially motivated Chinese cybercriminals by December 2025. The exploit kit facilitates the deployment of malware capable of exfiltrating sensitive data, including cryptocurrency wallets and personal information. ([thehackernews.com](https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html?utm_source=openai)) The emergence of Coruna underscores a concerning trend where advanced cyber tools, potentially developed by nation-states, proliferate into the hands of various threat actors. This incident highlights the critical need for organizations and individuals to maintain up-to-date software and implement robust security measures to mitigate the risks posed by such sophisticated exploits. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))
4 months ago
Kill Chain
Qualcomm Android Zero-Day Exploited in 2026
In March 2026, Google disclosed a high-severity vulnerability, CVE-2026-21385, affecting Qualcomm's open-source display driver used in Android devices. This integer overflow flaw leads to memory corruption when processing user-supplied data without proper buffer size validation. The vulnerability was reported to Qualcomm on December 18, 2025, and patches were included in the March 2026 Android security update. Google noted indications of limited, targeted exploitation of this zero-day vulnerability in the wild. The March 2026 Android security bulletin addressed a total of 129 vulnerabilities, including this actively exploited flaw. The presence of an actively exploited zero-day vulnerability underscores the critical need for timely security updates. Organizations and individuals should prioritize applying the March 2026 security patch to mitigate potential risks associated with this and other vulnerabilities addressed in the update.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports