✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
RedNovember: Chinese APT Weaponizes Public PoCs for Rapid Government Espionage in 2024
In 2024, a state-aligned Chinese advanced persistent threat (APT) group known as RedNovember, or Storm-2077, conducted an extensive cyber espionage campaign targeting high-profile organizations, especially government agencies and technology firms across Asia and Europe. Rather than developing custom exploits or zero-days, RedNovember systematically monitored security researcher disclosures and quickly weaponized publicly released proof-of-concept (PoC) vulnerability exploits to compromise edge devices such as VPN gateways, firewalls, and remote access platforms. Notable targets included Taiwan’s technology sector and Fijian government entities, coinciding with periods of heightened geopolitical activity. The group's attacks enabled deep network intrusion and intelligence exfiltration in line with Chinese state interests. This campaign exemplifies a fast-growing threat: sophisticated threat actors operationalize public vulnerability disclosures before organizations can patch, increasing the risk of high-impact breaches. The reliance on open-source PoCs reduces barriers to entry, accelerates attacks, and puts pressure on organizations to shorten vulnerability patch cycles.
6 months ago
Kill Chain
Scattered Spider Ransomware: Teen Member Arrested, Group Claims Shutdown in 2024
In June 2024, law enforcement arrested a teenage member of the notorious Scattered Spider ransomware group, a cybercriminal collective linked to disruptive attacks against major organizations including MGM Resorts and Caesars Entertainment. The arrest followed claims by the group that it was shutting down operations amid heightened law enforcement scrutiny and infighting among its members. Scattered Spider became infamous for leveraging social engineering and identity-based attacks to gain initial entry, then rapidly moving laterally to deliver ransomware and conduct data theft. This latest development underscores the increasingly aggressive response from law enforcement to high-impact ransomware threats. The recent action highlights the continued evolution and volatility of ransomware groups, many of which are now using sophisticated identity compromise and cloud-based attack chains. Organizations should remain vigilant as law enforcement disruptions may cause threat actors to splinter, rebrand, or accelerate new attack campaigns using similar techniques.
6 months ago
Kill Chain
Stately Taurus: 2022 Bookworm APT Campaign Unveiled in Southeast Asia
In 2022, cybersecurity researchers traced sophisticated spear-phishing attacks against government and commercial entities in Southeast Asia to Stately Taurus, a Chinese advanced persistent threat (APT) group active since at least 2012. Using the Bookworm malware, a modular remote access trojan (RAT) with advanced C2 and lateral movement capabilities, the threat actor gained initial access via tailored phishing emails, followed by persistence and data exfiltration. Detailed code analysis, shared infrastructure, unique PDB paths, and parallel tooling (e.g., ToneShell) confirmed high-confidence attribution. The campaign exposed OPSEC artifacts and overlapping infrastructure, confirming Stately Taurus’s long-term commitment to targeted espionage. This incident underscores a broader surge in targeted APT campaigns using modular malware and sophisticated infrastructure reuse. The precision of the Unit 42 Attribution Framework exemplifies the growing emphasis on multi-layered, evidence-based attribution, which is now critical as state-linked groups automate and diversify their attack techniques.
6 months ago
Kill Chain
Cisco SNMP Zero-Day: Active Exploits Target IOS XE Network Devices in 2025
In September 2025, Cisco disclosed a critical vulnerability (CVE-2025-20352) affecting its IOS and IOS XE operating systems, actively exploited via the SNMP subsystem. The flaw stems from a stack-based buffer overflow that allows authenticated remote attackers to trigger denial-of-service or potentially achieve root-level remote code execution. Attackers utilized crafted SNMP packets over both IPv4 and IPv6 to compromise devices with SNMP enabled, including popular models like the Meraki MS390 and Catalyst 9300. Cisco confirmed attacks in the wild following credential compromise, urging immediate patching, as no reliable workarounds exist. This incident highlights the ongoing risks associated with ubiquitous network protocols like SNMP and the necessity of rapid response to zero-day exploits within core infrastructure. The rise of attacks targeting network management systems signals both increased attacker sophistication and heightened regulatory scrutiny.
6 months ago
Kill Chain
Unpatched SMS Flaw in OnePlus Phones Leaves User Messages Exposed
In September 2025, a critical, still-unpatched vulnerability (CVE-2025-10184) was publicly disclosed in OnePlus smartphones running OxygenOS 12 through 15. Discovered by Rapid7, the flaw enables any installed app—without explicit permissions or user input—to access and exfiltrate SMS content and metadata on affected devices. This exposure was caused by insecurely exported content providers in the custom Android Telephony package, allowing SQL injection-style inference attacks. Despite multiple disclosure attempts, OnePlus did not respond for over four months; the details, including a proof of concept, were disclosed publicly to accelerate a fix. The case underscores rising risks from insecure mobile customizations and vendor slow response, especially as attackers increasingly exploit flaws in widely deployed consumer devices. With the proliferation of mobile-centric attacks and regulatory scrutiny on data privacy, this breach highlights the urgent need for robust patch management and proactive mobile security.
6 months ago
Kill Chain
Cisco's 2025 SNMP Zero-Day: Credential Compromise Drives Network Device Exploit Surge
In September 2025, Cisco disclosed a high-severity zero-day vulnerability (CVE-2025-20352) affecting IOS and IOS XE network infrastructure devices. The flaw, a stack-based buffer overflow in the SNMP subsystem, allowed remote, authenticated attackers with low privileges to cause denial-of-service and, in some cases, permitted high-privileged attackers to fully compromise devices. Exploitation was detected after local administrator credentials were stolen, enabling threat actors to send malicious SNMP packets over IPv4/IPv6, impacting unpatched devices globally. Immediate patching was recommended as no workarounds existed except tightly restricting SNMP access. This incident underscores the criticality of timely patching and robust identity and network access controls, as attackers increasingly target network infrastructure via both credential compromise and protocol-level vulnerabilities. Industry-wide, it marks an escalating trend of high-impact, infrastructure-level exploits requiring urgent coordinated response.
6 months ago
Kill Chain
RedNovember: 2025 Chinese State Cyber Espionage Campaign Hits Global Governments
In mid-2025, a Chinese state-sponsored threat group known as RedNovember (previously tracked as TAG-100) orchestrated a widespread cyber espionage campaign targeting government and private sector organizations across Africa, Asia, North America, South America, and Oceania. The attackers leveraged sophisticated tools including the Pantegana backdoor and Cobalt Strike to establish persistence, perform lateral movement, and exfiltrate sensitive data. Entry vectors included spear-phishing emails and exploitation of known network vulnerabilities, allowing RedNovember to stealthily compromise high-value systems and harvest intelligence for extended periods before discovery. The impact included unauthorized access to confidential government documents and disruption of critical data workloads. This incident underscores the persistent evolution of state-sponsored attack tactics, with RedNovember employing advanced, evasive techniques and custom malware. The growing use of encrypted command-and-control traffic and living-off-the-land strategies sets a concerning precedent, especially for government agencies and regulated enterprises facing a surge in sophisticated espionage operations.
6 months ago
Kill Chain
Scattered Spider’s $115M Ransomware Blitz: How Hybrid Attacks Changed Compliance Expectations in 2025
In 2025, U.K. and U.S. law enforcement charged members of the cybercrime group Scattered Spider, including Thalha Jubair and Owen Flowers, with a $115 million ransomware and extortion campaign targeting sectors such as retail, transportation, hospitality, and healthcare. The group, also known as 0ktapus and UNC3944, leveraged advanced social engineering, SIM-swapping, phishing, and remote access tactics to breach hundreds of organizations—including notorious attacks on MGM Resorts, Caesars Entertainment, Transport for London, and major U.K. retailers. Law enforcement tracked cryptocurrency ransoms to the group, seizing millions in illicit funds and identifying extensive operational overlap with LAPSUS$ and other threat collectives. This incident highlights the escalating threat posed by young, identity-driven ransomware affiliates employing blended TTPs, exploiting cloud and hybrid infrastructures, and leveraging insider access. Their success in spanning critical infrastructure and commercial targets underscores the urgent need for multilayered defenses, compliance vigilance, and aggressive regulatory and incident response readiness.
6 months ago
Kill Chain
Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova
In June 2024, researchers revealed that REST Media, an online outlet targeting Moldova’s elections, is actually a front for the Russian disinformation group Rybar. Rybar, already sanctioned by the EU and wanted by the U.S., used REST Media to amplify anti-EU narratives and undermine the Party of Action and Solidarity, leveraging platforms like TikTok, Telegram, and X to achieve millions of views. Technical forensics linked REST Media’s online infrastructure and production workflows directly to Rybar, demonstrating operational overlap and deliberate efforts at obfuscation. The campaign exploited Moldova's fragmented media regulations, using cloaked registration accounts, privacy services, and anonymized hosting, making attribution complex while rapidly expanding its influence ahead of key elections. This incident exemplifies the growing sophistication of state-sponsored information operations, exploiting both technology and weak local controls. As hybrid threats, including coordinated disinformation and cyberattacks, continue to undermine democratic processes across Eastern Europe, organizations and governments face mounting regulatory, reputational, and operational risks from similar campaigns.
6 months ago
Kill Chain
Arrest of UK Teen Halts Core Scattered Spider Ransomware Operations in 2024
In June 2024, UK authorities arrested Thalha Jubair, a 19-year-old national identified as a core operator within the Scattered Spider ransomware group. Jubair, linked to at least 120 cyberattacks and $89.5 million in cryptocurrency transactions, was accused of orchestrating sophisticated extortion campaigns against major organizations, including the 2024 attack on the U.S. federal court system and Transport for London. The investigation utilized blockchain analysis and traced ransom payments that funded essential purchases, directly implicating Jubair despite advanced operational security measures such as VPNs and amnesiatic operating systems. This landmark arrest exposes the evolution and persistence of decentralized ransomware groups, highlighting challenges in attribution and apprehension. The incident demonstrates the growing use of identity obfuscation tools and cryptocurrencies among cybercriminals, underscoring the urgent need for robust detection, response, and regulatory frameworks across industries.
6 months ago
Kill Chain
US Secret Service Seizes Massive SIM Server Network Threatening Government Officials
In September 2025, the U.S. Secret Service announced it had dismantled a large-scale illicit telecommunications infrastructure across the New York tri-state area, seizing over 300 SIM servers and 100,000 SIM cards. These devices, co-located at multiple sites, were used by unknown malicious actors to facilitate threats against U.S. government officials, particularly near the United Nations. Investigators discovered that this network enabled covert communications and potentially enabled bypasses of monitoring controls, raising national security concerns. The takedown required coordinated federal action to secure the assets, neutralize the risk, and support ongoing intelligence operations. This incident highlights the ongoing evolution and physical sophistication of threat actor infrastructure, especially targeting high-profile government personnel. The scale and automation facilitated by such hardware underline the growing intersection of physical and cyber threats and serve as a wake-up call for risk teams facing advanced, hybrid attack models.
6 months ago
Kill Chain
Iranian APT Extends Reach: 2024 Nimbus Manticore Malware Hits Europe
In early 2024, a sophisticated Iran-backed threat group known as “Nimbus Manticore” launched targeted cyberattacks against several European organizations using enhanced variants of its custom malware. The attackers leveraged spear-phishing emails embedding malicious attachments as their initial access vector, resulting in the deployment of advanced payloads that enabled persistent access and lateral movement within affected networks. Once inside, the group utilized encrypted communication channels and east-west movement to exfiltrate sensitive data and evade common detection mechanisms. The incident has caused operational disruptions and triggered regulatory notifications in multiple EU member states. This breach illustrates a strategic expansion of Iran-linked APT operations beyond their traditional region, pointing to escalating risks for European enterprises. The exposed techniques underscore the necessity for advanced detection, robust internal segmentation, and regulatory alignment as attackers increasingly shift tactics to bypass perimeter controls.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports