✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Kali365: The Emerging Threat Bypassing MFA in Microsoft 365
In April 2026, a new Phishing-as-a-Service (PhaaS) platform named Kali365 emerged, enabling cybercriminals to hijack Microsoft 365 accounts by exploiting the OAuth device code flow. This method allows attackers to bypass multi-factor authentication (MFA) by tricking users into entering device codes on legitimate Microsoft verification pages, thereby granting unauthorized access to services like Outlook, OneDrive, and Teams. The FBI issued a public service announcement in May 2026, highlighting the widespread distribution of Kali365 via Telegram and its use in numerous attacks across various sectors, including manufacturing, education, government, financial services, and healthcare. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai)) The significance of this incident lies in its demonstration of how attackers can circumvent traditional security measures, such as MFA, by exploiting legitimate authentication processes. The accessibility of Kali365 through subscription services lowers the barrier for less-skilled attackers to conduct sophisticated phishing campaigns, posing a substantial threat to organizations relying on Microsoft 365. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai))
1 month ago
Kill Chain
Unveiling the Popa Botnet: A Threat Hidden in Plain Sight
In June 2026, cybersecurity researchers uncovered that the 'Popa' botnet, active for four years, had compromised millions of Android-based TV boxes, turning them into nodes for a residential proxy network. This network facilitated activities such as advertising fraud, account takeovers, and mass data scraping. Investigations linked the botnet to NetNut, a residential proxy provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd. The compromised devices, often marketed as offering free access to subscription services, were found to have pre-installed software that enrolled users' home internet connections into the proxy network without explicit consent. This incident highlights the growing threat posed by malicious software embedded in consumer devices, particularly those offering 'free' services. The use of residential proxy networks for illicit activities underscores the need for consumers to exercise caution when purchasing and installing such devices. It also emphasizes the importance of regulatory scrutiny over companies providing proxy services to ensure they are not facilitating cybercriminal activities.
1 month ago
Kill Chain
Surge in SSH Brute Force Attacks Correlates with Global Events in 2026
Between February and May 2026, a DShield honeypot recorded over 20 million SSH brute-force attempts, revealing a significant correlation between attack volumes and external events such as geopolitical tensions and cybersecurity advisories. Notably, a 2100% surge in attacks coincided with CISA's Emergency Directive 26-03 addressing Cisco SD-WAN vulnerabilities, and peaks in activity aligned with escalating conflicts involving Iran, Israel, and the United States. These findings underscore the adaptability of threat actors who exploit global events to intensify their malicious activities. The study highlights the persistent threat posed by coordinated SSH brute-force attacks and the necessity for organizations to implement robust security measures. As attackers continue to leverage global events to orchestrate large-scale attacks, it is imperative for entities to enhance their defenses, monitor for unusual activity, and stay informed about emerging threats to mitigate potential breaches.
1 month ago
Kill Chain
Navigating the 'Smash-and-Grab Era': Understanding Rapid AI-Driven Cyber Threats
In 2026, cybersecurity experts identified a significant shift in cyberattack methodologies, termed the 'Smash-and-Grab Era.' This new approach is characterized by rapid, parallel attacks facilitated by advanced technologies like Large Language Models (LLMs). Unlike previous 'low and slow' tactics, attackers now execute swift operations, exploiting vulnerabilities and exfiltrating data within hours. This evolution challenges traditional detection and response strategies, as defenders struggle to manage multiple simultaneous attack vectors effectively. The emergence of this era underscores the urgent need for organizations to adapt their cybersecurity frameworks. The integration of AI in cyberattacks has accelerated the speed and complexity of threats, rendering conventional defense mechanisms less effective. As attackers leverage AI to automate and scale their operations, it is imperative for defenders to enhance their capabilities to detect and respond to these rapid, multifaceted attacks.
1 month ago
Kill Chain
FreeBSD CVE-2026-3038: Understanding the Critical Kernel Vulnerability
In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a stack buffer overflow by crafting malicious routing socket requests, leading to immediate kernel panics due to stack canary corruption. The vulnerability affects FreeBSD versions 13.5, 14.3, and 15.0 prior to specific patches. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2026-3038&utm_source=openai)) The discovery of CVE-2026-3038 underscores the ongoing challenges in securing kernel-level code, highlighting the need for rigorous validation of user-supplied data. This incident serves as a reminder of the importance of timely patching and continuous monitoring to mitigate potential exploits that could lead to system crashes or privilege escalation.
1 month ago
Kill Chain
FortiBleed Leak Exposes Fortinet VPN Credentials for 73,000 Devices
In June 2026, a significant data breach known as 'FortiBleed' exposed VPN credentials for approximately 73,000 Fortinet devices worldwide. Security researcher Bob Diachenko discovered a server containing valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords. The leaked data encompassed entries from major organizations such as Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Sinopec, and State Grid. The breach was attributed to a Russian-speaking threat group that conducted extensive credential harvesting campaigns against FortiGate SSL VPN devices, leading to unauthorized access and potential lateral movement within affected networks. This incident underscores the escalating threat posed by sophisticated cyber actors targeting critical infrastructure through credential harvesting and exploitation of VPN vulnerabilities. Organizations are urged to implement robust security measures, including regular credential rotation, enforcement of multi-factor authentication, and continuous monitoring for unauthorized access attempts, to mitigate the risk of similar breaches.
1 month ago
Kill Chain
Understanding the HTTP/2 Bomb (CVE-2026-49975) Vulnerability
In June 2026, a critical denial-of-service vulnerability, CVE-2026-49975, known as the "HTTP/2 Bomb," was disclosed. This flaw exploits the HPACK compression and flow control features of the HTTP/2 protocol, allowing attackers to send minimal requests that rapidly exhaust server memory. Major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora, are affected in their default configurations. The attack can be executed remotely without authentication, leading to immediate service disruptions. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai)) The discovery of this vulnerability underscores the evolving threat landscape, where attackers leverage protocol features to amplify attacks. Organizations must prioritize patching affected systems and consider implementing additional security measures, such as Web Application Firewalls (WAFs), to mitigate potential exploits. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai))
1 month ago
Kill Chain
FortiBleed: Unprecedented Credential Harvesting Compromises 30,000+ Fortinet Devices
In June 2026, a large-scale credential harvesting operation, dubbed 'FortiBleed,' targeted Fortinet firewalls and VPN gateways, compromising over 30,000 internet-facing devices across nearly 200 countries. The attackers, suspected to be Russian-speaking threat actors, utilized automated tools to collect and verify login credentials, exploiting weak or default passwords without leveraging any known Fortinet vulnerabilities. This campaign affected various sectors, including government, telecommunications, healthcare, education, financial services, and critical infrastructure, with significant concentrations in India and the United States. The operation underscores the critical importance of robust password policies and the implementation of multi-factor authentication to safeguard network security devices. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices?utm_source=openai))
1 month ago
Kill Chain
Earth Lusca's Advanced Windows Malware Targets Government Entities
Between 2023 and 2024, the Chinese state-sponsored threat group Earth Lusca, also known as FishMonger, expanded its cyber espionage operations by deploying Windows variants of the previously Linux-based SprySOCKS malware. These sophisticated backdoors targeted government organizations in Taiwan, Thailand, Pakistan, and Honduras, focusing on sectors such as foreign affairs, technology, and telecommunications. The Windows versions, identified as WIN_DRV and WIN_PLUS, introduced advanced capabilities including kernel-level stealth mechanisms, enabling the malware to hide processes, network connections, and files, thereby evading detection. Both variants support over 30 command-and-control commands, facilitate communication over multiple protocols, and possess functionalities like keystroke logging and SOCKS proxy support. The emergence of these Windows variants underscores a significant evolution in Earth Lusca's tactics, highlighting the group's commitment to enhancing its toolset for broader and more effective cyber espionage campaigns. This development reflects a broader trend among nation-state actors to adapt and refine their malware to target diverse operating systems, emphasizing the need for organizations to implement comprehensive, cross-platform cybersecurity measures.
1 month ago
Kill Chain
Rokarolla Android Malware: A New Threat to Mobile Banking Security
In June 2026, a sophisticated Android banking Trojan named Rokarolla emerged, targeting 217 banking and cryptocurrency applications. Distributed through malicious websites masquerading as legitimate Google Chrome or TikTok apps, Rokarolla gains complete administrative control over infected devices. Its capabilities include stealing lock screen credentials, contact lists, SMS data, and continuously recording user input via keyloggers. The malware employs overlays to display fake login screens, capturing sensitive financial information when users access targeted applications. Additionally, Rokarolla disables Google Play Protect, hides its icon, and maintains persistence by preventing device sleep, thereby evading detection and removal. The emergence of Rokarolla underscores a significant evolution in Android malware, combining financial data theft with extensive device surveillance and control. This trend highlights the increasing sophistication of threat actors and the urgent need for enhanced mobile security measures to protect sensitive user information and maintain device integrity.
1 month ago
Kill Chain
SprySOCKS Windows Variant: A New Threat to Government Cybersecurity
In 2023 and 2024, the China-linked cyber-espionage group FishMonger, also known as Earth Lusca and Aquatic Panda, deployed a Windows variant of the SprySOCKS backdoor against government organizations in Honduras, Taiwan, Thailand, and Pakistan. This variant utilizes malicious kernel drivers to evade detection, allowing the backdoor to conceal its processes and files by intercepting system calls and modifying outputs. The attackers likely gained initial access through exploiting vulnerabilities in public-facing servers. The emergence of this Windows variant underscores the evolving tactics of nation-state actors in enhancing malware stealth capabilities. Organizations should be vigilant about the use of kernel drivers in malware, as they pose significant challenges to detection and mitigation efforts.
1 month ago
Kill Chain
Rokarolla Android Trojan: A New Era of Mobile Threats
In June 2026, the Rokarolla Android Trojan emerged, distributed through malicious websites masquerading as legitimate applications like Google Chrome and TikTok. This sophisticated malware not only compromised 217 banking and cryptocurrency apps to steal credentials but also executed 137 commands to gain full administrative control over infected devices. Its capabilities included harvesting lock screen credentials, exfiltrating sensitive data, deploying keyloggers, and rendering devices unusable by blocking calls, suppressing audio, and disabling security features such as Google Play Protect. ([darkreading.com](https://www.darkreading.com/endpoint-security/rokarolla-android-trojan?utm_source=openai)) The Rokarolla Trojan signifies a significant evolution in mobile malware, combining traditional banking fraud with extensive device surveillance and control. Its advanced persistence and evasion techniques highlight the increasing complexity of threats targeting Android devices, underscoring the necessity for robust mobile security measures and user vigilance against downloading apps from untrusted sources.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports