✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Inside Google’s 2025 Crackdown on the Lighthouse Phishing Platform
In November 2025, Google filed a landmark lawsuit in the U.S. District Court for the Southern District of New York, targeting a group of China-based threat actors operating the Lighthouse Phishing-as-a-Service (PhaaS) platform. Lighthouse enabled massive SMS phishing attacks, leveraging trusted brands such as E-ZPass and USPS to lure victims. The operation compromised more than 1 million users across 120 countries by automating credential theft at scale, enabling untraceable criminal campaigns, and facilitating both lateral movement and data exfiltration. The attackers' infrastructure capitalized on encrypted traffic obfuscation and rapid brand impersonation techniques. This lawsuit marks a significant escalation in technology companies' pursuit of legal remedies against sophisticated cybercriminal ecosystems. It underscores the rising threat of PhaaS platforms enabling non-technical actors, the rapid proliferation of phishing kits, and the urgent need for zero trust and multi-layered defenses in digital infrastructure.
6 months ago
Kill Chain
Maverick Malware Exploits WhatsApp to Target Brazil's Largest Banks
In November 2025, cybersecurity researchers identified a new banking malware called Maverick targeting users in Brazil via malicious WhatsApp messages. Leveraging similarities to the known Coyote strain, Maverick is written in .NET and specifically attacks customers of major Brazilian banks. The malware deceives users into installing it, then hijacks browser sessions, intercepts banking credentials, and enables real-time monitoring of financial transactions to facilitate fraud. This attack underscores the growing sophistication of financially-motivated threats exploiting popular messaging platforms as infection vectors, while leveraging encrypted communications to bypass traditional security controls. This incident is indicative of a rising trend in banking malware that utilizes encrypted and social engineering channels, challenging established security models. It highlights the need for organizations—particularly in financial services—to adopt advanced detection, segmentation, and encrypted traffic monitoring to reduce the impact of evolving threats.
6 months ago
Kill Chain
Kimsuky APT Abuses Remote Wipe and KakaoTalk in South Korean Mobile Espionage (2024)
In early 2024, South Korean organizations were targeted by the Kimsuky APT, a North Korean-linked cyberespionage group notorious for sophisticated attacks against geopolitical rivals. Leveraging Google Find My Device’s legitimate remote-wipe capabilities, the attackers first gained access to Android phones through spear-phishing and malicious apps, then remotely wiped data or hijacked accounts. They also abused KakaoTalk, South Korea’s leading messaging app, for persistent access and exfiltration of sensitive information. This operation signifies an evolution in threat actor tactics by exploiting trusted platform features rather than relying solely on novel malware. This incident is highly relevant as cyberespionage groups increasingly leverage mobile platform features and popular apps for stealth operations. The case highlights advanced social engineering, trendsetting abuse of account-wiping tools, and the urgent need for stronger security controls for BYOD (Bring Your Own Device) environments.
6 months ago
Kill Chain
F5's 2024 Supply Chain Breach: Nation-State Attackers Steal BIG-IP Source Code
In mid-2024, F5 Networks disclosed that a highly sophisticated nation-state threat actor breached its internal systems, stealing segments of BIG-IP source code and detailed information on 44 then-unknown vulnerabilities. The intrusion, discovered in August and reported in October, specifically targeted internal assets and intelligence related to the company’s business-critical appliance products. While none of the stolen vulnerabilities are believed to be immediately exploitable remotely or considered critical by external experts, the pilfered data underscores an increasingly effective focus on software supply chain attacks. Although remediations and detailed hunting guides have been made available to customers, the theft of core product source code raises significant concerns about longer-term risks. The incident highlights a persistent trend: adversaries leveraging supply chain footholds to amplify potential downstream exploitation across enterprise and government infrastructure.
6 months ago
Kill Chain
CISA Orders Emergency Patching After Samsung Zero-Day Exploited in LandFall Spyware Attacks
In June 2024, U.S. federal agencies were ordered by CISA to urgently patch a critical Samsung zero-day vulnerability (CVE-2023-21492) after evidence emerged of its exploitation in targeted attacks delivering LandFall spyware. The attackers leveraged the flaw, which enabled privilege escalation, to compromise Samsung Android devices of high-value targets via WhatsApp. Once exploited, the vulnerability allowed unauthorized actors to bypass security controls, deploy surveillance tools, and covertly exfiltrate sensitive communications and data from affected devices, potentially impacting agency operations and confidentiality. This incident highlights a growing trend of mobile zero-day exploitation linked to sophisticated surveillance operations targeting both governmental and private sector entities. The rapid response from CISA underlines the rising regulatory and operational urgency as attackers increasingly exploit unpatched endpoints and messaging platforms in tailored cyber-espionage campaigns.
6 months ago
Kill Chain
AI-Powered Malware & Hyper-V Exploits: The 2025 Multi-Vector Attack Recap
In early November 2025, a series of sophisticated cyberattacks targeted enterprise and consumer systems worldwide, exploiting vulnerabilities in Hyper-V virtual machines, RDP protocols, and leveraging malicious AI bots. Attackers deployed stealthy malware within virtualized environments to evade detection, while advanced spyware campaigns targeted Android devices using side-channel techniques to capture sensitive AI chat data. Additionally, high-profile service disruptions, including a mass WhatsApp account lockdown, affected millions of users and raised concerns about systemic vulnerabilities and cross-platform exploitation. The threat actors behind these incidents demonstrated new levels of coordination and adaptability, with alliances between major cybercrime groups amplifying the scope and impact of the campaigns. This incident underscores an accelerating trend toward multi-vector, AI-enabled cybercrime and highlights the convergence of ransomware, lateral movement, and novel attack methods across cloud and hybrid infrastructures. Security leaders should anticipate further escalation in both the sophistication and frequency of such attacks through 2025, heightening urgency for layered defenses and zero trust strategies.
6 months ago
Kill Chain
CISA Flags Samsung Mobile Devices for Critical Exploited Vulnerability (CVE-2025-21042)
In November 2025, CISA added CVE-2025-21042, an out-of-bounds write vulnerability affecting Samsung Mobile Devices, to its Known Exploited Vulnerabilities (KEV) Catalog following active exploitation in the wild. Threat actors have leveraged this flaw to gain unauthorized control over affected devices, potentially allowing them to execute arbitrary code, escalate privileges, and compromise sensitive user data. The vulnerability poses significant risks to both federal agencies and commercial enterprises, prompting CISA to mandate remediation by federal civilian agencies under Binding Operational Directive (BOD) 22-01. Failure to remediate exposes organizations to data breaches and operational disruption. This incident highlights a broader wave of targeted exploits against widely used mobile platforms, illustrating attackers’ ongoing shift toward mobile devices as primary entry vectors. With regulatory attention intensifying, the urgency for rapid vulnerability management and proactive defense measures is escalated for all sectors.
6 months ago
Kill Chain
ClickFix Hospitality Breach: Infostealer Attack Impacts Hotels and Their Customers
In early 2024, a cybercrime campaign known as "ClickFix" targeted hospitality providers globally using infostealer and remote access trojan (RAT) malware. Threat actors gained initial access via spear phishing and malicious links, compromising hotel systems to harvest sensitive booking data and customer contact information. Attackers leveraged this stolen data to conduct highly convincing secondary phishing attacks directed at hotel customers via both email and WhatsApp channels, exposing guests to social engineering, fraud, and further credential theft. This cascading impact emphasized the attacker's focus on exploiting trusted relationships across business and customer environments. The incident is notable for its dual-target strategy, harnessing a single breach to fuel broader downstream attacks and demonstrating attackers' sophisticated use of layered social engineering. As infostealer activity surges across the hospitality and service sectors, defenders must adapt to increasingly persistent, multi-stage campaigns that pose risks for both enterprise operations and their customers.
6 months ago
Kill Chain
Landfall Malware: Covert Mobile Surveillance Hits Samsung Galaxy in 2024
In early 2024, cybersecurity researchers uncovered a sophisticated mobile surveillance campaign targeting Samsung Galaxy users through a malware strain dubbed 'Landfall.' Delivered primarily via malicious apps and phishing schemes, Landfall granted attackers covert access to device microphones, cameras, geolocation, and sensitive stored data. The threat actors capitalized on advanced evasion tactics to remain undetected, enabling them to record conversations, track user locations, collect photos, and exfiltrate contacts without the victims’ knowledge. The incident highlights the growing complexity of targeted mobile threats and the operational risks facing organizations with a mobile workforce. With the rise of mobile malware like Landfall exploiting modern smartphones’ vast attack surface, security teams must reassess their controls for device management, east-west traffic monitoring, and policy enforcement. This case underscores the urgency for enterprises to adopt zero trust defenses and adapt to evolving mobile threat tactics.
6 months ago
Kill Chain
APT Groups Exploit Hybrid & Multicloud Gaps: Insights from ESET Q2–Q3 2025 Activity Report
In Q2 and Q3 of 2025, ESET Research identified a surge in advanced persistent threat (APT) activity, with multiple sophisticated threat actors targeting organizations across various industries and geographies. These groups leveraged techniques such as east-west lateral movement within hybrid and multicloud environments, encrypted traffic tunneling, and exploitation of zero trust segmentation gaps. Attackers infiltrated networks via phishing campaigns, supply chain vulnerabilities, and exploitation of unpatched cloud workloads, achieving persistent access and data exfiltration. The business impacts included service disruptions, data breaches, and regulatory scrutiny for affected organizations. This incident underscores the increasing complexity of APT operations in cloud-centric architectures and highlights the urgency of implementing comprehensive east-west visibility, zero trust controls, and robust anomaly detection. The trends reported by ESET indicate a continued escalation of multicloud security risks and a persistent threat landscape adapting to modern enterprise environments.
6 months ago
Kill Chain
How State-Sponsored APTs Bypassed Multi-Cloud Defenses in 2025
Between Q2 and Q3 2025, ESET researchers identified a significant rise in sophisticated Advanced Persistent Threat (APT) attacks spanning multiple regions and industry verticals. State-sponsored actors leveraged encrypted communications and advanced lateral movement tactics to compromise organizations’ east-west cloud traffic, successfully bypassing conventional perimeter defenses. These campaigns exploited unmonitored internal traffic and insufficient network segmentation, leading to the exfiltration of sensitive data and critical infrastructure disruptions. The attackers demonstrated thorough knowledge of multi-cloud environments, combining zero-day exploits with stolen credentials to maintain persistent access and evade detection for weeks. This incident is emblematic of a broader trend—APT groups are accelerating the use of sophisticated, stealthy methods in hybrid cloud contexts. Modern enterprises must recognize the increased risk to east-west workloads, stay vigilant to evolving TTPs, and augment internal defenses in the face of rising geopolitical tensions and regulatory enforcement.
6 months ago
Kill Chain
Landfall Spyware Campaign Exposes Samsung Galaxy Devices in the Middle East
In mid-2024, security researchers from Palo Alto Networks' Unit 42 uncovered 'Landfall', a sophisticated commercial-grade spyware campaign targeting Samsung Galaxy S22, S23, S24, and Fold/Flip devices in the Middle East, specifically in Iran, Iraq, Morocco, and Turkey. Attackers exploited a Samsung-specific zero-day vulnerability using malicious DNG image files, often distributed via WhatsApp, enabling zero-click infection without user interaction. Once compromised, Landfall enables extensive surveillance capabilities, such as microphone activation and unauthorized data collection—including contacts and photos. While attribution remains inconclusive, similarities in infrastructure hint at possible links to the Stealth Falcon APT group. This incident highlights the rising use of zero-click exploits and highly-targeted mobile spyware attacks against consumer devices. The sophistication and persistence of such campaigns are forcing device vendors, regulators, and enterprises to invest in rapid patching, threat detection, and zero trust mobile security strategies to counter fast-evolving mobile threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports