✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
MuddyWater Deploys RustyWater RAT: 2026 State-Sponsored Espionage Hits Middle East
In January 2026, the Iranian state-aligned threat actor MuddyWater (also known as Mango Sandstorm and TA450) executed a targeted spear-phishing campaign against diplomatic, maritime, financial, and telecom organizations in the Middle East. Attackers used icon-spoofed phishing emails with malicious Microsoft Word documents, luring victims to enable macros which deployed the RustyWater remote access trojan—a Rust-based modular implant offering asynchronous command-and-control, anti-analysis techniques, registry persistence, and capability to expand post-compromise operations. The campaign reflects MuddyWater’s ongoing evolution from using commercial RATs to custom malware, with RustyWater providing high stealth and operational flexibility. This incident highlights the growing sophistication of state-affiliated threat actors leveraging new malware frameworks and advanced phishing tradecraft. MuddyWater’s rapid shift to Rust-based tooling demonstrates a broader attacker trend toward custom, evasive, and cross-platform implants targeting critical infrastructure and sensitive sectors.
6 months ago
Kill Chain
China-Nexus Hackers Breach Telecoms via Edge Device Exploitation
In January 2026, a sophisticated cyber-espionage campaign attributed to China-linked group UAT-7290 targeted telecommunications providers across South Asia and Southeastern Europe. The threat actors exploited known vulnerabilities in edge network devices using one-day exploits and targeted SSH brute-forcing for initial access, quickly escalating privileges and deploying Linux-based malware such as RushDrop, DriveSwitch, SilentRaid, and Bulbature. Their activities included extensive reconnaissance, persistent backdoor deployment, and converting compromised servers into operational relay boxes for further attacks, causing significant risk to sensitive communications infrastructure. This incident highlights escalating threats to critical telecom sectors, as state-affiliated actors increasingly leverage public exploits and shared toolkits for multi-layered attacks. Such breaches underscore urgent needs for proactive edge device security and improved lateral movement detection strategies amid rising geopolitical cyber operations.
6 months ago
Kill Chain
The Kimwolf & Aisuru Botnets: How Android TV Devices Fueled a Global Proxyware Crisis
In late 2025, the Kimwolf and Aisuru botnets collectively compromised over two million Android TV streaming boxes by leveraging factory-installed or bundled proxy malware. Attackers, operating through channels like Discord and Telegram, conscripted these devices for DDoS attacks, ad fraud, and mass content scraping. Investigations revealed overlapping cybercriminal operators, shared infrastructure, and direct monetization via residential proxy services such as Plainproxies, Maskify, and ByteConnect. The illicit operations exploited minimal device security, used decentralized technologies like Ethereum Name Service (ENS) for resilient command-and-control, and took advantage of poorly regulated server resellers in the U.S. and Europe. The incident underscores a rapidly evolving threat landscape where IoT/OTT devices are prime targets for distributed, difficult-to-mitigate botnets fueled by proxyware and privacy-invasive apps. It highlights urgent needs for better supply-chain security, IoT device hardening, and more robust detection and segmentation strategies to counter stealthy lateral movement and monetization tactics now seen across botnet campaigns.
6 months ago
Kill Chain
Global Cisco Switch Reboot Outage: DNS Client Vulnerability Hits Network Operations
In January 2026, numerous Cisco network switches globally experienced widespread, persistent reboot loops due to a software vulnerability in their DNS client service. Beginning around 2 AM UTC, administrators observed affected Cisco models—including CBS250, CBS350, SG350, SG350X, SG550X, and Catalyst C1200—entering repeated crashes when DNS queries for core domains (such as www.cisco.com or NTP servers) failed. The root trigger appears to be a firmware bug in the DNSC task, causing the switch OS to log a critical error and initiate an immediate reboot, with impacts observed across multiple organizations and networks worldwide. Temporary mitigations, such as disabling DNS or SNTP features, helped restore partial stability until Cisco and upstream CDN providers reverted the changes. The incident highlights the ongoing risk that latent software vulnerabilities in ubiquitous infrastructure devices pose to business continuity. As device automation and remote management expand, similar vulnerabilities can cause cascading operational outages across sectors, underscoring the need for robust patching, rigorous QA in embedded systems, and improved visibility over east-west traffic disruptions.
6 months ago
Kill Chain
China-Linked UAT-7290: Telecom Espionage Strikes via Linux Malware and ORB Nodes
In early 2026, a sophisticated China-linked threat actor designated UAT-7290 orchestrated targeted espionage campaigns against telecommunications providers across South Asia and Southeastern Europe. The attackers conducted meticulous intelligence gathering before leveraging one-day vulnerabilities and SSH brute-forcing to compromise exposed edge devices. Malicious payloads—including RushDrop, DriveSwitch, and the advanced SilentRaid—enabled persistent access, covert lateral movement, and deployment of Operational Relay Box (ORB) infrastructure, which can be used by other threat groups. Their arsenal blends open-source tools and bespoke Linux implants, demonstrating mature tradecraft and adaptability. This campaign reflects the increasing frequency and complexity of transnational espionage assaults on critical infrastructure, exploiting modern hybrid networks and advanced malware suites. Organizations in telecom and related sectors face mounting pressure to enhance east-west traffic controls, patch velocity, and incident response capabilities to defend against evolving APT operations.
6 months ago
Kill Chain
WhatsApp-Based Worm Drives Astaroth Banking Trojan Surge Across Brazil
In late 2025 and early 2026, a major cybersecurity campaign—codenamed Boto Cor-de-Rosa—targeted millions of WhatsApp users in Brazil with the Astaroth (Guildma) banking trojan. Threat actors leveraged a novel worm module written in Python that hijacked victims’ WhatsApp contact lists, automatically sending malicious ZIP files and spreading the malware with unprecedented speed. Upon execution, the ZIP archive dropped a Visual Basic script that downloaded further payloads, including a banking module capable of harvesting credentials when victims accessed online banking sites. Over 95% of reported infections occurred in Brazil, severely impacting personal and financial data security. This campaign highlights how cybercriminals are weaponizing popular messaging apps as attack vectors for financial malware, reflecting the rising sophistication and modularity of their methods. The shift to WhatsApp-based propagation, combined with multi-language modular code, signals a concerning trend for businesses and individuals in regions with high platform adoption rates.
6 months ago
Kill Chain
D-Link Router Zero-Day Exploited in 2024: A Network Infrastructure Wake-Up Call
In early 2024, security researchers identified active exploitation of a zero-day vulnerability affecting end-of-life D-Link DSL routers. Attackers leveraged the unpatched flaw to execute arbitrary code remotely, enabling them to gain full control over susceptible devices. The campaign targets legacy router models no longer supported with firmware updates, resulting in thousands of home and small-office networks being exposed to malware infection, data interception, and lateral movement within internal networks. Public disclosure led to warnings from multiple security vendors, though permanent remediation is unavailable due to the unsupported status of affected models. This incident highlights the ongoing risks posed by obsolete network infrastructure and the trend of threat actors exploiting unmaintained IoT and edge hardware. As organizations depend on interconnected devices, lack of timely decommissioning and patch management creates persistent attack surfaces for cybercriminals.
6 months ago
Kill Chain
Chinese Cyber Army Hits Taiwan: 2025 Critical Infrastructure Breach Analysis
In 2025, Taiwan experienced a major surge in cyberattacks attributed to Chinese nation-state actors, with over 2.6 million daily intrusion attempts targeting government agencies and critical infrastructure, including the energy and healthcare sectors. Attackers leveraged software and hardware vulnerabilities to breach networks, exfiltrate sensitive data from hospitals, and gain lateral access to backup communications, telecom networks, and supply chain partners in semiconductors and defense. These operations, often coordinated with political and military activity, aimed to steal technology, disrupt vital services, and compromise strategic intelligence. This campaign highlights a broader escalation in state-linked cyber offensives exploiting critical infrastructure vulnerabilities worldwide, emphasizing emerging tactics like supply chain targeting and increased ransomware attacks on healthcare. The incident underscores the urgent need for resilient security architectures and international cooperation as threat actors grow more sophisticated and persistent.
6 months ago
Kill Chain
D-Link Legacy Routers Under Siege: CVE-2026-0625 RCE Flaw Exploited in Active Campaigns
In late 2025 and early 2026, a critical security vulnerability (CVE-2026-0625, CVSS 9.3) in legacy D-Link DSL routers was actively exploited, enabling unauthenticated remote code execution. The flaw arises from insufficient input sanitization on the dnscfg.cgi endpoint, allowing attackers to inject arbitrary shell commands and modify DNS settings remotely. As reported by VulnCheck and observed by the Shadowserver Foundation, exploitation affected end-of-life models including DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B, leading to large-scale DNS hijacking, persistent traffic redirection, and compromised user privacy and security for any device behind these routers. This incident highlights the ongoing risk posed by end-of-life and unsupported network hardware, which remains prevalent in many organizations. The swift weaponization of unauthenticated RCE vulnerabilities in edge devices—especially those lacking patch support—underscores the need for proactive infrastructure lifecycle management, supply chain visibility, and robust segmentation to defend against fast-evolving infrastructure-targeted threats.
6 months ago
Kill Chain
How NoName057(16) Used DDoSia to Drive Hacktivist DDoS Attacks in 2024
In early 2024, the pro-Russian hacktivist group NoName057(16) leveraged their custom DDoS tool, DDoSia, to orchestrate large-scale distributed denial-of-service attacks targeting government, media, and institutional websites in Ukraine and Western countries. By mobilizing a network of volunteer participants through its affiliate model, NoName057(16) was able to coordinate and intensify attacks, resulting in substantial website downtime and service disruptions for organizations with links to Ukraine and the West. The campaign highlighted the effectiveness of modern hacktivist crowd-sourcing tactics and the increasing difficulty of defending against well-organized, politically motivated DDoS operations. This incident is particularly relevant in 2024 as DDoS-as-a-service tools and volunteer-driven hacktivist campaigns are on the rise, blurring the lines between state-driven threats and amateur activism. Organizations should review their DDoS mitigation and incident response defenses amid heightened geopolitical tensions and expanding threat capabilities among hacktivist collectives.
6 months ago
Kill Chain
How the 2020 Venezuelan Power Grid Cyberattack Set a New Precedent for Nation-State Warfare
In May 2020, Venezuela experienced a significant power grid disruption that coincided with an alleged US-backed military incursion. Intelligence sources and public statements, including hints from President Trump, suggested that nation-state cyber actors played a role in disabling critical infrastructure, likely by targeting unencrypted or poorly segmented network traffic in Caracas. The incident demonstrated the attackers’ use of advanced cyber capabilities to disrupt the nation's power supply, contributing to confusion and vulnerability during a period of political unrest. While the precise techniques remain classified, the attack highlighted significant weaknesses in Venezuela’s critical industrial control systems and network segmentation. The relevance of this event endures as cyber operations against power grids and critical infrastructure grow more sophisticated and frequent globally. Recent years have seen a surge in state-sponsored attacks leveraging both advanced persistent threats and rapid lateral movement, making robust east-west security, zero trust practices, and encrypted traffic defenses urgent imperatives for organizations.
6 months ago
Kill Chain
State-Sponsored Cyberattack: US Targets Venezuelan Power Grid (2019)
In March 2019, a significant power outage crippled Venezuela’s capital, Caracas, and other major cities, reportedly as part of a broader campaign by the United States involving offensive cyber operations. Although official attribution remains classified, senior U.S. officials and President Trump openly hinted at the use of advanced cyberattacks to disrupt Venezuela’s electrical grid during a period of heightened political instability and efforts to capture President Nicolás Maduro. This unprecedented event marked a rare instance of publicized state-sponsored cyber warfare, raising concerns about the direct targeting of national critical infrastructure and its immediate social, political, and economic impact. This incident highlights a growing trend of nations turning to cyber operations as a tool for geopolitical leverage, targeting vital systems with the intent to destabilize adversaries. The weaponization of cyber capabilities against critical infrastructure sets a precedent for both escalation and regulatory scrutiny worldwide.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports