✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
2024 Android Infostealer Attack: How Termux and Telegram Fueled Stealthy Mobile Data Breaches
In October 2024, researchers identified a novel Android infostealer undetected by antivirus engines, leveraging Termux—a legitimate terminal emulator app—to collect sensitive data from mobile devices. The attacker deployed a Python-based stealer designed to extract user contacts, SMS, call logs, location data, and app-specific files, including those for Facebook, WhatsApp, and banking. Exfiltration occurred via Telegram API integration, and a persistent backdoor was installed for continued access. The operation showcased clever abuse of legitimate utilities, with initial device compromise mechanics still unclear, though social engineering leading to the installation of Termux is likely. This incident highlights the evolving landscape in which infostealers now aggressively target mobile platforms as device usage and data stored on them surge. With sophisticated yet undetectable malware exploiting legitimate tools and APIs, organizations and users face heightened risks from threats previously confined mostly to Windows environments.
6 months ago
Kill Chain
Salt Typhoon’s 2024 Attack: Nation-State Espionage Exploits Forgotten Network Devices
In early 2024, a cyber espionage campaign orchestrated by the China-linked Salt Typhoon group targeted forgotten and unpatched network perimeter devices, such as out-of-support routers, VPNs, and firewalls, across both public and private sector organizations in the U.S. and allied nations. Adversaries leveraged advanced "living off the land" tactics, establishing persistent access by exploiting technical debt and overlooked legacy hardware—bypassing hardened endpoint defenses and moving laterally within affected networks. Operational impacts included exposure of sensitive credentials, long-term surveillance risks, and significant challenges in incident detection and response due to the stealthy nature of the attacks. This incident highlights a surge in sophisticated nation-state threats adapting to improved endpoint security by targeting unmanaged infrastructure. The campaign underscores the urgency for organizations to reassess asset inventories, prioritize decommissioning of end-of-life devices, and deploy proactive detection strategies, as similar tactics are increasingly observed across multiple state-sponsored and ransomware actors.
6 months ago
Kill Chain
The 2024 Global Smishing Deluge: China-Based SMS Phishing at Scale
In early 2024, a China-based threat group orchestrated a massive global smishing campaign, flooding mobile devices across multiple continents with fraudulent SMS messages impersonating banks, government agencies, and delivery services. Leveraging a rapidly-evolving attack ecosystem, the actors utilized wide-scale automation and regional tailoring to bypass spam filters and trick users into revealing sensitive credentials or installing malware. The attack’s magnitude caught many organizations off guard, resulting in significant credential theft, unauthorized transactions, and growing operational strain as firms raced to block fast-moving SMS domains and educate affected users. This campaign signals a sharp escalation in the sophistication and reach of smishing attacks, highlighting persistent gaps in mobile security awareness and detection. As similar TTPs gain traction among organized threat groups, critical infrastructure and commercial service providers face increased risks of large-scale credential exposure and downstream fraud.
6 months ago
Kill Chain
F5 2025 Supply-Chain Breach: Nation-State Attackers Target Update Infrastructure
In October 2025, F5 Networks—an industry-leading provider of enterprise networking and security appliances—disclosed a sophisticated supply-chain breach attributed to a nation-state threat actor. Attackers maintained long-term, covert access to F5’s internal environment, ultimately compromising systems responsible for building and distributing software updates for its widely deployed BIG-IP products. The breach allowed unauthorized access to proprietary source code, documentation of unpatched vulnerabilities, and a trove of sensitive customer configuration data, significantly enlarging the risks of downstream exploitation for thousands of major enterprises and critical infrastructure providers globally. This incident underscores the growing threat of highly persistent, technically advanced supply-chain attacks targeting the software build and delivery processes of core technology vendors. The breach reflects recent escalation in nation-state tactics and highlights the continued exposure of global businesses to supply-chain and software update system threats.
6 months ago
Kill Chain
F5 Vulnerability Exposes Visibility Gaps in DHS’s CDM Program
In June 2024, a critical vulnerability affecting F5 devices exposed a major blind spot within the Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program, which is tasked with overseeing federal cybersecurity assets. The Cybersecurity and Infrastructure Security Agency (CISA) was forced to issue an emergency directive after learning that a nation-state actor had exploited F5 edge devices to gain persistent access across multiple civilian federal agencies. The directive revealed that while thousands of F5 systems were in use, there was significant uncertainty about their location due to gaps in federal asset inventory capabilities, particularly for internet-facing edge devices like F5 BIG-IP load balancers. As a result, agencies had to scramble to manually identify and secure affected systems, highlighting the operational impact of incomplete visibility and asset management. The incident underscores the growing risks associated with network edge devices, which have become prime targets for sophisticated attackers exploiting gaps outside traditional IT inventories. As cloud adoption and edge architectures proliferate, ensuring asset visibility and securing non-traditional endpoints have become urgent priorities for government and private sector organizations alike, as attackers increasingly exploit these visibility gaps.
6 months ago
Kill Chain
China-Linked ToolShell SharePoint Attacks Hit Four Continents in 2025
In 2025, a coordinated cyber-espionage campaign attributed to Chinese-state actors targeted organizations across government, academic, telecommunications, and finance sectors by exploiting the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint. Attackers gained initial access through unpatched SharePoint deployments, enabling lateral movement, exfiltration of sensitive data, and persistent covert access. Victims spanned four continents, highlighting the campaign's scale and impact on critical information flows and business operations. The attackers' use of encrypted communications and sophisticated toolsets complicated detection and eradication efforts, leading to material operational and reputational risks for affected entities. This incident underscores a broader trend of supply chain and platform vulnerabilities being weaponized by advanced, nation-state groups. With the rapid disclosure of exploits and a proliferation of similar techniques, patch management and visibility into east-west traffic remain urgent enterprise priorities.
6 months ago
Kill Chain
MuddyWater's 2025 Global Espionage Campaign Targets 100+ Organizations
In late 2025, the Iranian nation-state threat group known as MuddyWater launched a sophisticated espionage campaign targeting over 100 organizations across the Middle East and North Africa (MENA) region. Leveraging a compromised email account as an entry point, the attackers distributed a custom backdoor named Phoenix to high-value government entities, enabling covert infiltration and sustained intelligence gathering. The operation involved methods designed to evade detection and facilitate ongoing access to sensitive data, underscoring the persistent risk posed by nation-state actors. This campaign highlights a continued escalation in advanced cyberespionage activities targeting governmental and critical infrastructure sectors. With threat actors increasingly exploiting social engineering and custom malware, organizations face intensified pressure to strengthen defenses and adhere to evolving security frameworks.
6 months ago
Kill Chain
Chinese APT Group Rapidly Exploits SharePoint Vulnerability in Major 2025 Telecom Breach
In July 2025, Chinese state-affiliated threat actors exploited the recently patched ToolShell vulnerability in Microsoft SharePoint to breach a major telecommunications company in the Middle East. This advanced persistent threat (APT) group swiftly leveraged the disclosed flaw to gain unauthorized access, rapidly launching attacks just weeks after the patch was released. Their campaign extended to government bodies in Africa and South America, as well as academic and technology institutions in the US, highlighting a rapid weaponization of public vulnerabilities. The attackers used sophisticated techniques for lateral movement, data exfiltration, and persistence within the affected networks, likely resulting in compromise of sensitive communications, operational disruption, and potential regulatory exposure for the victims. This incident demonstrates how APT actors quickly adapt to disclosed vulnerabilities and underscores the urgency for organizations to accelerate patching cycles and bolster east-west security controls. The event marks an increasing trend of state-sponsored groups targeting hybrid cloud environments and critical infrastructure via freshly disclosed exploits.
6 months ago
Kill Chain
WhatsApp Bans NSO Group: Landmark Legal Win Over Spyware Surveillance (2024)
In June 2024, WhatsApp achieved a legal victory against NSO Group following a six-year battle over the use of commercial spyware targeting WhatsApp users. NSO Group had exploited zero-day vulnerabilities to deploy its Pegasus spyware, surreptitiously compromising user devices for surveillance. As a result of the court decision, NSO Group is permanently banned from accessing or reverse-engineering WhatsApp and must pay $4 million in damages. The court's judgement underscores the broader risks posed by commercial surveillance tools, impacting end-user privacy and digital trust on a global scale. This incident comes amidst intensifying global scrutiny over spyware vendors and increasing pressure for technology companies to safeguard user data. The legal ruling sets a precedent for software platforms defending against targeted surveillance campaigns, emphasizing the role of legal strategy alongside technical security countermeasures.
6 months ago
Kill Chain
RondoDox Botnet Unleashes 'Exploit Shotgun' on Edge Devices
In early 2024, cybersecurity researchers uncovered the RondoDox Botnet, a rapidly evolving threat that leverages an 'exploit shotgun' methodology to compromise a wide range of consumer edge devices worldwide. The botnet scans for and exploits multiple zero-day and known vulnerabilities across routers and IoT devices, often gaining initial access through unpatched firmware or exposed management interfaces. Once inside, RondoDox deploys malware that enables remote control, data exfiltration, and lateral movement, allowing attackers to build a resilient, distributed botnet infrastructure which has been used for DDoS attacks and potentially other malicious activities. The decentralized campaign demonstrates sophisticated automation, making incident response and containment significantly more difficult for defenders. This incident is highly relevant as it highlights the surge in automated botnet attacks targeting unmanaged edge devices, a trend driven by increasing adoption of IoT and remote work infrastructure. The RondoDox tactics underscore the urgency for organizations to address lateral movement, patch management, and zero trust segmentation, especially as regulatory scrutiny on device and network security continues to intensify.
6 months ago
Kill Chain
Volt Typhoon Breach Exposes Critical Infrastructure Vulnerabilities via Back-Office Data
In early 2024, multiple US critical infrastructure operators discovered that nation-state actors, most notably Volt Typhoon, exploited unsecured and unmonitored 'back-office' systems to gain persistence within operational technology (OT) and industrial control system (ICS) networks. The attackers bypassed perimeter defenses by identifying unencrypted data in transit, lateral east-west traffic vulnerabilities, and data sprawl in business support systems. Their operations evaded detection for months, leveraging encrypted channels and exploiting gaps in policy enforcement, leading to sensitive OT-adjacent data exfiltration and operational risk. This breach highlights a wider trend: sophisticated APTs are moving beyond headline-grabbing OT entry points, targeting unmonitored business data and hybrid network blind spots. Regulators, including CISA and NIST, emphasize organizations must urgently address visibility gaps and strengthen zero trust controls as attackers grow bolder and more evasive.
6 months ago
Kill Chain
F5 BIG-IP Breach 2024: Nation-State Attackers Exploit Zero-Day Flaws
In June 2024, F5 Networks disclosed a significant security breach impacting its BIG-IP application delivery products. The incident involved a nation-state threat actor exploiting previously unknown (zero-day) vulnerabilities to gain unauthorized access to F5’s internal systems. Attackers reportedly obtained proprietary source code and, in some cases, limited customer information. Sophisticated post-exploitation techniques were used to move laterally and exfiltrate sensitive data, highlighting the attacker’s expertise and persistence. The breach raises concerns around the supply-chain risk for organizations deploying F5 BIG-IP solutions, as exploitation of this trusted infrastructure could jeopardize downstream customer networks. This incident underscores the escalating trend of nation-state actors targeting critical infrastructure and supply-chain vendors through advanced, stealthy attack methods. Given the widespread use of F5 products in enterprise and government IT environments, the breach has heightened industry awareness around zero-day vulnerabilities and supply-chain security best practices.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports