The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Critical Backdoor Found in Zbtlink Routers: 'ENDLESSDOORS' Exposes Networks to Remote Exploitation
In August 2026, cybersecurity researchers uncovered a factory-implanted backdoor, dubbed 'ENDLESSDOORS,' in at least 20 router models from Chinese manufacturer Zbtlink. This backdoor, present in all 21 firmware images available over the past two years, automatically initiates and attempts to communicate with command-and-control servers every 35 seconds. Masquerading as legitimate Linux kernel threads, these userland processes run with root privileges, allowing unauthorized remote control of the devices. The backdoor utilizes a tool called 'rctl' to establish connections without authentication, enabling attackers to execute arbitrary commands or spawn interactive root shells remotely. The affected models include CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM. This discovery underscores the critical risks associated with supply chain vulnerabilities in networking hardware, particularly those manufactured overseas. The incident has prompted heightened scrutiny of foreign-made networking equipment and reinforces the importance of rigorous security assessments in the procurement process.
1 month ago
Kill Chain
Over 4,400 Rockwell PLCs Exposed Online: A Wake-Up Call for Critical Infrastructure Security
In August 2026, Forescout identified 4,407 internet-exposed Rockwell Automation programmable logic controllers (PLCs) worldwide, with 2,844 located in the United States. Notably, 22 of these exposed PLCs were found in cities recently targeted by cyberattacks on U.S. water utilities, with 19 utilizing the same mobile carrier network. Attackers exploited these vulnerabilities by altering IP addresses and setting passwords on accessible controllers, leading to operators losing visibility and control over connected equipment. This incident underscores the critical need for securing industrial control systems against unauthorized internet exposure. The prevalence of internet-exposed PLCs highlights a significant security gap in critical infrastructure, particularly within the water sector. The ease with which attackers can manipulate these systems without exploiting specific vulnerabilities emphasizes the urgency for organizations to implement robust network segmentation, remove unnecessary internet exposure, and enforce strong authentication measures to protect against potential disruptions and threats to public safety.
1 month ago
Kill Chain
Snowflake 2024 Data Breach: A Wake-Up Call for Cloud Security
In mid-2024, a significant cybersecurity incident unfolded involving unauthorized access to over 165 customer environments hosted on Snowflake Inc.'s cloud platform. Threat actors, notably including Connor Moucka, exploited stolen credentials—often lacking multi-factor authentication—to infiltrate these environments. High-profile victims such as AT&T, Ticketmaster, and Santander Bank suffered extensive data theft, leading to substantial financial losses and reputational damage. The attackers utilized the stolen data for extortion, demanding ransoms to prevent public disclosure. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Snowflake_data_breach?utm_source=openai)) This breach underscores the critical importance of robust access controls and the implementation of multi-factor authentication (MFA) in cloud environments. The incident serves as a stark reminder of the vulnerabilities associated with single-factor authentication and the necessity for organizations to enforce stringent security measures to protect sensitive data. ([techtarget.com](https://www.techtarget.com/searchsecurity/news/366587555/Snowflake-No-evidence-of-platform-breach?utm_source=openai))
1 month ago
Kill Chain
Snowflake Data Breach 2024: A Wake-Up Call for Cloud Security
Between February and October 2024, cybercriminals exploited stolen credentials to access Snowflake customer accounts lacking multi-factor authentication (MFA). This led to unauthorized access to sensitive data from at least 165 organizations, including AT&T, Ticketmaster, and Santander. The attackers, notably Connor Riley Moucka and John Erin Binns, utilized infostealer malware to harvest login information, resulting in the theft of terabytes of data and extortion of millions of dollars from affected companies. The incident underscores the critical importance of implementing robust security measures, such as MFA, to protect cloud-based data. As cloud services become increasingly integral to business operations, organizations must prioritize stringent access controls and continuous monitoring to mitigate the risk of similar breaches.
1 month ago
Kill Chain
OpenAI's Intervention in Poipet Scam Network Exploiting ChatGPT
In August 2026, OpenAI identified and dismantled a sophisticated scam network operating from Poipet, Cambodia, that exploited its ChatGPT technology to orchestrate various fraudulent schemes, including investment scams, romance frauds, gambling cons, and law enforcement impersonations. The perpetrators utilized ChatGPT to create fake online personas, generate and translate deceptive messages, and produce promotional content targeting victims primarily in Bangladesh and India. This operation highlights the evolving misuse of AI tools in cybercrime, enabling scammers to scale their activities and enhance the credibility of their deceptive practices. The incident underscores the urgent need for robust AI governance and proactive measures to prevent the exploitation of generative AI technologies in fraudulent activities.
1 month ago
Kill Chain
Unitel Cyberattack Disrupts Services Ahead of IPO
On July 28, 2026, Unitel, Angola's leading telecommunications provider, experienced a significant cyberattack targeting its technological infrastructure. Detected at approximately 2:20 AM local time, the attack disrupted voice, mobile data, and internet services nationwide, affecting over 21 million customers. The incident occurred just one day before Unitel's scheduled listing on the Angola Debt and Securities Exchange (BODIVA), following a public offering of a 15% stake in the company. In response, Unitel activated its response and containment mechanisms, mobilizing technical and cybersecurity teams to mitigate the effects and restore services. As of the latest reports, services remain affected, with ongoing efforts to fully stabilize and normalize the network. ([businessday.co.za](https://www.businessday.co.za/world/international-companies/2026-07-28-cyberattack-hits-angolas-unitel-a-day-before-its-listing/?utm_source=openai)) This incident underscores the escalating threat landscape facing critical infrastructure sectors, particularly telecommunications. The timing of the attack, coinciding with Unitel's IPO, highlights the potential for cyber adversaries to exploit significant corporate events. Organizations must prioritize robust cybersecurity measures and incident response strategies to safeguard against such disruptions, especially during pivotal business milestones.
1 month ago
Kill Chain
CISA Adds Critical Vulnerabilities in Langflow, Tomcat, and N-central to KEV Catalog
On August 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2026-9198, a critical code injection flaw in Langflow allowing unauthenticated remote code execution; CVE-2026-34486, a missing encryption vulnerability in Apache Tomcat enabling bypass of EncryptInterceptor; and CVE-2026-18556, an authentication bypass in N-able N-central. These flaws have been exploited by threat actors, including AI-enabled autonomous hacking campaigns attributed to Chinese-speaking adversaries, targeting internet-exposed devices and government infrastructure across over 100 countries. The inclusion of these vulnerabilities in the KEV catalog underscores the escalating threat posed by sophisticated cyber actors leveraging both manual and autonomous techniques to exploit critical infrastructure. Organizations are urged to apply the necessary patches promptly to mitigate potential risks associated with these actively exploited vulnerabilities.
1 month ago
Kill Chain
Critical OVSwrap Vulnerability in Linux Kernel's Open vSwitch Module (CVE-2026-64531)
In July 2026, security researcher Asim Manizada disclosed a critical vulnerability in the Linux kernel's Open vSwitch (OVS) datapath, identified as CVE-2026-64531 and codenamed OVSwrap. This flaw allows local unprivileged users to escalate privileges to root by exploiting a memory corruption issue in the OVS flow action parser. The vulnerability affects multiple Linux distributions, including Rocky Linux 9 and 10, and has been present since a March 2025 commit removed a 32 KiB internal action size limit, exposing the underlying truncation bug. A public exploit with pre-built records for approximately 800 kernel builds has been released, highlighting the widespread impact of this issue. The OVSwrap vulnerability underscores the critical importance of timely patch management and vigilant monitoring of kernel module configurations. Organizations must assess their exposure to this flaw, especially in environments where unprivileged user namespaces are enabled, and apply the necessary patches or mitigations to prevent potential exploitation.
1 month ago
Kill Chain
Critical Vulnerabilities in TP-Link Omada ZTP Mechanism Pose Security Risks
In August 2026, TP-Link addressed 15 vulnerabilities in the Zero-Touch Provisioning (ZTP) mechanism of its Omada network devices, as disclosed by Forescout’s Vedere Labs at the Black Hat USA security conference. These flaws, encompassing hard-coded cryptographic keys, information disclosure, remote code execution, and device hijacking, could be exploited to infiltrate networks by compromising Omada’s chain of trust. Notably, attackers could combine these vulnerabilities with previously identified command-injection flaws (CVE-2025-7850 and CVE-2025-7851) to achieve remote code execution. The affected products include Omada Controllers, Gateways, Switches, Access Points, OLT platforms, Cloud services, and TP-Link mobile applications. This incident underscores the critical importance of securing network infrastructure, especially as routers and switches have become primary threat vectors, surpassing traditional endpoints. Organizations are urged to promptly apply firmware updates, enforce strong authentication measures, and monitor network traffic to mitigate potential exploits stemming from these vulnerabilities.
1 month ago
Kill Chain
Phishing Service Exploits RingCentral to Compromise Microsoft 365 Accounts
In August 2026, the 'Greatness' phishing-as-a-service platform expanded its operations to include adversary-in-the-middle attacks and device-code phishing, specifically targeting Microsoft 365 accounts. Cybercriminals leveraged this platform to impersonate RingCentral, a widely-used communications service, by sending fraudulent emails that appeared to originate from service@ringcentral.com. These emails, often containing fake voicemail and performance-review notifications, successfully bypassed email security filters due to RingCentral's whitelisted status. Upon clicking embedded links, victims were redirected to phishing sites designed to capture authentication tokens, enabling attackers to access and exfiltrate data from Outlook, Teams, SharePoint, and OneDrive, with unauthorized access persisting for over two weeks in some instances. This incident underscores a significant evolution in phishing tactics, highlighting the increasing sophistication of phishing-as-a-service platforms and their ability to exploit trusted services to bypass security measures. The use of adversary-in-the-middle techniques to capture multi-factor authentication tokens represents a notable advancement in cybercriminal methodologies, emphasizing the need for organizations to continually adapt their security protocols to counteract these evolving threats.
1 month ago
Kill Chain
Botnet Exploits Command Injection Vulnerabilities in Diagnostic Tools
In August 2026, cybersecurity researchers identified a botnet actively scanning for vulnerabilities in diagnostic tools across various web interfaces. The botnet targeted specific URLs associated with diagnostic functions, such as "/apply.cgi" and "/cgi-bin/diagnostic.cgi," exploiting known command injection vulnerabilities like CVE-2024-12856 and CVE-2013-7179. These vulnerabilities allowed attackers to execute arbitrary commands on affected systems, potentially leading to unauthorized access and data exfiltration. The exploitation of diagnostic tools underscores the critical need for secure coding practices and regular vulnerability assessments to prevent such attacks. This incident highlights a growing trend where botnets leverage command injection flaws in diagnostic utilities to compromise systems. Organizations must prioritize the security of diagnostic interfaces, ensuring they are not exposed to unauthorized access and are regularly updated to mitigate known vulnerabilities. Implementing robust input validation and employing secure coding practices are essential steps in defending against such threats.
1 month ago
Kill Chain
Unveiling the BTMOB Android RAT's Expanding Underground Ecosystem
In August 2026, cybersecurity researchers uncovered the expansive underground ecosystem surrounding the BTMOB Android Remote Access Trojan (RAT). Initially launched as a centralized malware-as-a-service (MaaS) platform, BTMOB evolved into a complex network involving resellers, source-code vendors, and independent operators. This transformation led to unauthorized distribution channels offering cheaper subscriptions, alleged source code, and customized versions, complicating the original operator's control over the malware's proliferation. The rapid expansion of BTMOB's ecosystem underscores the challenges in containing malware once it enters the cybercriminal marketplace. The emergence of unauthorized resellers and the availability of source code facilitate the creation of new variants, increasing the threat landscape for Android users globally.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports