The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
U.S. Authorities Dismantle Huione Group's Cybercrime Infrastructure in 2026
In June 2026, the U.S. Department of Justice seized a cloud computing account linked to subsidiaries of the Cambodia-based Huione Group, a conglomerate implicated in extensive cyber scams and money laundering activities. This infrastructure supported Huione Guarantee, a Telegram-based marketplace facilitating the sale of stolen personal data, malware-enabled thefts, and laundering of proceeds from various scams, including romance and investment frauds. The operation disrupted a significant node in the global cybercrime ecosystem, which had laundered over $4 billion in illicit funds between August 2021 and January 2025. This action underscores the escalating efforts by U.S. authorities to dismantle transnational cybercriminal networks exploiting digital platforms for large-scale fraud. The seizure highlights the critical need for robust cybersecurity measures and international cooperation to combat the evolving landscape of cyber threats targeting individuals and financial systems worldwide.
3 months ago
Kill Chain
Critical Cisco Unified CM Vulnerability CVE-2026-20230 Under Active Exploitation
In June 2026, a critical server-side request forgery (SSRF) vulnerability, identified as CVE-2026-20230, was discovered in Cisco Unified Communications Manager (Unified CM) and its Session Management Edition (Unified CM SME). This flaw allows unauthenticated remote attackers to send crafted HTTP requests, enabling them to write files to the underlying operating system and potentially escalate privileges to root. Cisco released security updates on June 3, 2026, to address this vulnerability. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Communications+Manager+Server-Side+Request+Forgery+Vulnerability%26vs_k%3D1&utm_source=openai)) By June 23, 2026, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild. Attackers were observed using file:// payloads to create test files on vulnerable devices, indicating reconnaissance activities. The availability of a proof-of-concept exploit increases the urgency for organizations to apply the provided patches promptly.
3 months ago
Kill Chain
Tata Electronics Cyberattack: A Wake-Up Call for Supply Chain Security
In June 2026, Tata Electronics, a division of the Tata Group specializing in electronic components and semiconductor manufacturing, confirmed a cyberattack that impacted parts of its IT infrastructure. The company stated that operations remained unaffected. The World Leaks threat group claimed responsibility, leaking over 200,000 files totaling approximately 630 GB, including sensitive manufacturing data for Apple and Tesla products. The leaked information comprises internal component schematics, PCB designs, material specifications, and SDK files. ([business-standard.com](https://www.business-standard.com/companies/news/tata-electronics-hit-by-cyber-breach-exposing-apple-tesla-trade-secrets-126062201241_1.html?utm_source=openai)) This incident underscores the escalating threat posed by data extortion groups like World Leaks, which focus on stealing and leaking sensitive corporate data without deploying traditional ransomware. The breach highlights the critical need for robust cybersecurity measures and supply chain security, especially for companies handling proprietary information of major technology firms. ([business-standard.com](https://www.business-standard.com/companies/news/tata-electronics-cyber-breach-apple-tesla-supply-chain-security-126062300396_1.html?utm_source=openai))
3 months ago
Kill Chain
Scattered Spider Hackers Plead Guilty in TfL Cyberattack
In August 2024, Transport for London (TfL) suffered a significant cyberattack orchestrated by the Scattered Spider hacking group, leading to the compromise of personal data for approximately 10 million individuals and causing substantial disruptions to TfL's online services. The attack, executed through sophisticated social engineering tactics, resulted in operational challenges and financial losses for the organization. ([livemint.com](https://www.livemint.com/news/world/transport-for-london-2024-hack-around-10-million-had-their-data-stolen-says-report-11772807389186.html?utm_source=openai)) The recent guilty pleas by key members of Scattered Spider underscore the persistent threat posed by cybercriminal groups employing advanced social engineering techniques. This incident highlights the critical need for organizations, especially those managing essential services, to enhance their cybersecurity measures and remain vigilant against evolving cyber threats.
3 months ago
Kill Chain
SIM Swap Attack Highlights Need for Enhanced Authentication Measures
In June 2026, Torsten George, a chief cybersecurity evangelist, experienced a SIM swap attack that led to an attempted account takeover. The attacker, posing as an AT&T representative, had previously conducted a SIM swap, allowing them to intercept one-time passwords (OTPs) sent via text. During a subsequent call, the attacker sought additional credentials to gain full access to George's AT&T account. Recognizing the threat, George acted swiftly to regain control, preventing unauthorized access. This incident underscores the vulnerabilities associated with SMS-based OTPs and highlights the need for multi-layered security measures. The resurgence of SIM swap attacks, as demonstrated in this case, emphasizes the importance of adopting more secure authentication methods, such as app-based OTPs or hardware tokens, to mitigate the risks of account takeovers.
3 months ago
Kill Chain
Critical Vulnerability in Hubbell Aclara Metrum Cellular Web Interface (CVE-2026-1840)
In June 2026, a critical vulnerability (CVE-2026-1840) was identified in the Hubbell Aclara Metrum Cellular Web Interface, affecting versions prior to v2.1.0.105. This flaw allows unauthorized access to critical system functions due to missing authentication controls, enabling attackers to alter device configurations and disrupt operations, potentially leading to loss of communications. The vulnerability poses significant risks to the energy sector, particularly in the United States, where these devices are widely deployed. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1740?utm_source=openai)) The incident underscores the importance of robust authentication mechanisms in industrial control systems. With increasing cyber threats targeting critical infrastructure, organizations must prioritize timely firmware updates and implement comprehensive security measures to mitigate such vulnerabilities.
3 months ago
Kill Chain
Unveiling the WhatsApp VBS RMM Campaign: A 2026 Cybersecurity Threat
In June 2026, a sophisticated malware campaign was identified, leveraging WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. These scripts, once executed, initiated a multi-stage infection chain that ultimately installed Remote Monitoring and Management (RMM) software, granting attackers persistent remote access to compromised Windows systems. The campaign employed social engineering tactics, using deceptive file names to entice users into executing the scripts. Notably, the malware utilized renamed legitimate Windows utilities and retrieved payloads from trusted cloud services, effectively evading detection mechanisms. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/31/whatsapp-malware-campaign-delivers-vbs-payloads-msi-backdoors/?utm_source=openai)) This incident underscores a concerning trend in cyber threats, where attackers exploit widely-used communication platforms and legitimate tools to infiltrate systems. The use of trusted cloud services for payload delivery and the manipulation of standard Windows utilities highlight the evolving sophistication of threat actors. Organizations must remain vigilant, enhancing their security protocols to detect and mitigate such deceptive tactics.
3 months ago
Kill Chain
INTERPOL Highlights Escalating Cyber Threats in Asia-Pacific
INTERPOL's 2025/2026 Asia and South Pacific Cyberthreat Assessment Report highlights a significant surge in cybercrime across the region, driven by rapid digitalization and organized criminal networks. Phishing has emerged as the most prevalent and financially damaging form of cybercrime, with over half of the surveyed countries reporting that cybercrime accounts for more than 30% of all recorded crimes. The report also notes a rise in ransomware attacks, deepfake scams, and AI-driven frauds targeting sectors such as real estate, manufacturing, and financial services. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai)) This escalation underscores the urgent need for enhanced cybersecurity measures and international cooperation to combat the evolving threat landscape. The increasing sophistication of cybercriminal tactics, including the use of AI and ransomware-as-a-service models, poses a substantial risk to both public and private sectors. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai))
3 months ago
Kill Chain
AryStinger Malware Hijacks 4,300 Legacy Routers in 2026
In June 2026, security researchers at QiAnXin's XLab identified a new malware strain named AryStinger, which has compromised over 4,300 outdated routers, primarily D-Link models like DIR-850L and DIR-818LW. The malware exploits old vulnerabilities—CVE-2013-3307 and CVE-2016-5681—to transform these devices into a distributed network for reconnaissance and proxying malicious traffic. Unlike typical botnets used for DDoS attacks, AryStinger focuses on pre-intrusion activities such as internet scanning, service fingerprinting, subdomain enumeration, and traffic tunneling, effectively masking the attacker's origin. This incident underscores the critical risks posed by unpatched, legacy hardware in both residential and small office environments. The widespread infection, notably concentrated in South Korea and China, highlights the necessity for regular firmware updates and the decommissioning of unsupported devices to prevent their exploitation in sophisticated cyber operations.
3 months ago
Kill Chain
CSIS's Landmark Operation: Neutralizing Botnet Threats in Canada
In May 2024, the Canadian Security Intelligence Service (CSIS) obtained a Federal Court warrant to neutralize two foreign-operated botnets that had infected servers, home routers, and IoT devices across Canada. This unprecedented legal authorization allowed CSIS to alter, degrade, and destroy malicious data on compromised devices, effectively severing their connection to the botnet networks. The operation targeted a range of devices, including Ring doorbells, security cameras, and Wi-Fi-enabled appliances, to mitigate potential threats to critical infrastructure and national security. This case underscores the evolving landscape of cyber threats and the necessity for intelligence agencies to adopt proactive measures. The legal framework established by this warrant sets a precedent for future cyber defense operations, highlighting the importance of balancing national security interests with individual privacy rights.
3 months ago
Kill Chain
AryStinger Botnet Hijacks Over 4,000 D-Link Routers Globally
In June 2026, the AryStinger botnet compromised over 4,000 outdated D-Link routers worldwide, transforming them into proxies for malicious activities. The malware exploited known vulnerabilities, including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, primarily targeting D-Link DIR-850L and DIR-818LW models. Infected devices were utilized for scanning, proxying, tunneling, and command execution, with the capability to tamper with DNS settings and monitor network traffic. The majority of infections were reported in South Korea (48.5%), China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%). This incident underscores the critical need for organizations to replace end-of-life hardware and apply the latest firmware updates to mitigate risks associated with outdated devices. The AryStinger botnet's exploitation of legacy vulnerabilities highlights the ongoing threat posed by unpatched systems in the cybersecurity landscape.
3 months ago
Kill Chain
FortiBleed: Unprecedented Exposure of Fortinet Credentials in 2026
In June 2026, a significant cybersecurity incident known as 'FortiBleed' was uncovered, exposing nearly 74,000 Fortinet firewall and VPN credentials. Security researcher Volodymyr 'Bob' Diachenko discovered a server containing valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for 73,932 firewall URLs worldwide. The exposed data also included organizational details such as industry, revenue, and employee count, suggesting the information was compiled to facilitate future attacks. Threat intelligence company Hudson Rock described this as one of the largest known collections of compromised Fortinet credentials, spanning 21,632 unique domains across 194 countries. The 'FortiBleed' incident underscores the critical importance of securing network devices against credential-based attacks. Organizations are urged to implement robust password policies, enable multifactor authentication, and regularly monitor for unauthorized access to mitigate such threats.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports