The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Earth Lusca's Advanced Windows Malware Targets Government Entities
Between 2023 and 2024, the Chinese state-sponsored threat group Earth Lusca, also known as FishMonger, expanded its cyber espionage operations by deploying Windows variants of the previously Linux-based SprySOCKS malware. These sophisticated backdoors targeted government organizations in Taiwan, Thailand, Pakistan, and Honduras, focusing on sectors such as foreign affairs, technology, and telecommunications. The Windows versions, identified as WIN_DRV and WIN_PLUS, introduced advanced capabilities including kernel-level stealth mechanisms, enabling the malware to hide processes, network connections, and files, thereby evading detection. Both variants support over 30 command-and-control commands, facilitate communication over multiple protocols, and possess functionalities like keystroke logging and SOCKS proxy support. The emergence of these Windows variants underscores a significant evolution in Earth Lusca's tactics, highlighting the group's commitment to enhancing its toolset for broader and more effective cyber espionage campaigns. This development reflects a broader trend among nation-state actors to adapt and refine their malware to target diverse operating systems, emphasizing the need for organizations to implement comprehensive, cross-platform cybersecurity measures.
3 months ago
Kill Chain
Rokarolla Android Malware: A New Threat to Mobile Banking Security
In June 2026, a sophisticated Android banking Trojan named Rokarolla emerged, targeting 217 banking and cryptocurrency applications. Distributed through malicious websites masquerading as legitimate Google Chrome or TikTok apps, Rokarolla gains complete administrative control over infected devices. Its capabilities include stealing lock screen credentials, contact lists, SMS data, and continuously recording user input via keyloggers. The malware employs overlays to display fake login screens, capturing sensitive financial information when users access targeted applications. Additionally, Rokarolla disables Google Play Protect, hides its icon, and maintains persistence by preventing device sleep, thereby evading detection and removal. The emergence of Rokarolla underscores a significant evolution in Android malware, combining financial data theft with extensive device surveillance and control. This trend highlights the increasing sophistication of threat actors and the urgent need for enhanced mobile security measures to protect sensitive user information and maintain device integrity.
3 months ago
Kill Chain
SprySOCKS Windows Variant: A New Threat to Government Cybersecurity
In 2023 and 2024, the China-linked cyber-espionage group FishMonger, also known as Earth Lusca and Aquatic Panda, deployed a Windows variant of the SprySOCKS backdoor against government organizations in Honduras, Taiwan, Thailand, and Pakistan. This variant utilizes malicious kernel drivers to evade detection, allowing the backdoor to conceal its processes and files by intercepting system calls and modifying outputs. The attackers likely gained initial access through exploiting vulnerabilities in public-facing servers. The emergence of this Windows variant underscores the evolving tactics of nation-state actors in enhancing malware stealth capabilities. Organizations should be vigilant about the use of kernel drivers in malware, as they pose significant challenges to detection and mitigation efforts.
3 months ago
Kill Chain
Rokarolla Android Trojan: A New Era of Mobile Threats
In June 2026, the Rokarolla Android Trojan emerged, distributed through malicious websites masquerading as legitimate applications like Google Chrome and TikTok. This sophisticated malware not only compromised 217 banking and cryptocurrency apps to steal credentials but also executed 137 commands to gain full administrative control over infected devices. Its capabilities included harvesting lock screen credentials, exfiltrating sensitive data, deploying keyloggers, and rendering devices unusable by blocking calls, suppressing audio, and disabling security features such as Google Play Protect. ([darkreading.com](https://www.darkreading.com/endpoint-security/rokarolla-android-trojan?utm_source=openai)) The Rokarolla Trojan signifies a significant evolution in mobile malware, combining traditional banking fraud with extensive device surveillance and control. Its advanced persistence and evasion techniques highlight the increasing complexity of threats targeting Android devices, underscoring the necessity for robust mobile security measures and user vigilance against downloading apps from untrusted sources.
3 months ago
Kill Chain
China-Linked SprySOCKS Backdoor Expands to Windows with Advanced Stealth Techniques
In June 2026, cybersecurity researchers identified two new Windows variants of the previously Linux-exclusive backdoor, SprySOCKS. These variants, named WIN_DRV and WIN_PLUS, are equipped with hard-coded command-and-control configurations and support communication over TCP, UDP, and WebSocket protocols. Notably, WIN_DRV employs kernel drivers to conceal its network connections, processes, files, and registry keys, enhancing its stealth capabilities. The initial access method remains undetermined, but the group has a history of exploiting known vulnerabilities in public-facing applications to gain entry. This development underscores the evolving tactics of state-sponsored threat actors, particularly those linked to China, in adapting and expanding their malware across multiple operating systems. Organizations must remain vigilant and implement robust security measures to detect and mitigate such sophisticated threats.
3 months ago
Kill Chain
Cisco Catalyst SD-WAN Manager Vulnerability CVE-2026-20262: Immediate Action Required
In June 2026, Cisco disclosed a medium-severity vulnerability (CVE-2026-20262) in its Catalyst SD-WAN Manager, formerly known as SD-WAN vManage. This flaw allows authenticated remote attackers with at least write access to create or overwrite files on the system's filesystem. Exploitation involves sending crafted HTTP requests to specific API endpoints, potentially leading to root-level privilege escalation. Cisco has observed limited exploitation of this vulnerability in the wild and has released software updates to address the issue. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-arbfw-c2rZvQ.html?utm_source=openai)) The exploitation of CVE-2026-20262 underscores the critical importance of timely patch management and vigilant monitoring of network management systems. Organizations are urged to apply the provided updates promptly to mitigate potential risks associated with this vulnerability.
3 months ago
Kill Chain
CISA Highlights Active Exploitation of Two Critical Vulnerabilities
On June 15, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-20262 and CVE-2026-54420. CVE-2026-20262 affects Cisco Catalyst SD-WAN Manager, allowing authenticated remote attackers to create or overwrite files on the system, potentially leading to root access. CVE-2026-54420 impacts the LiteSpeed cPanel Plugin, where improper handling of symbolic links enables users with FTP or web shell access to exploit shared hosting servers running CloudLinux/CageFS. Both vulnerabilities have been actively exploited in the wild, posing significant risks to affected systems. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-arbfw-c2rZvQ.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the critical need for organizations to prioritize patching and mitigation efforts. The active exploitation of these flaws highlights the evolving threat landscape and the importance of maintaining up-to-date security measures to protect against potential breaches.
3 months ago
Kill Chain
Critical Zero-Day Vulnerability in Cisco SD-WAN vManage Exploited in the Wild
In June 2026, Cisco disclosed a critical vulnerability (CVE-2026-20262) in its Catalyst SD-WAN Manager, formerly known as SD-WAN vManage. This flaw allowed authenticated remote attackers with low-level privileges to execute arbitrary commands as root by exploiting insufficient input validation during file uploads. The vulnerability affected all deployment types, including on-premises, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed), and Cisco SD-WAN for Government (FedRAMP). Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation of this zero-day vulnerability earlier in the month and strongly advised customers to apply the released security updates promptly. The exploitation of CVE-2026-20262 underscores a concerning trend of attackers targeting critical infrastructure components through zero-day vulnerabilities. Organizations must remain vigilant, ensuring timely patch management and robust security practices to mitigate such risks.
3 months ago
Kill Chain
Sniper Dz Scams Exploit Fake Facebook Offers to Target MENA Users
In June 2026, cybersecurity researchers uncovered a series of fraudulent activities targeting users in the Middle East and North Africa (MENA) region. Cybercriminals employed fake Facebook accounts impersonating politicians, public figures, and trusted organizations to promote deceptive offers such as free mobile internet packages and financial compensations. Victims who clicked on these offers were redirected through a series of intermediary websites leading to phishing pages and monetization schemes, including browser notification abuse and premium SMS subscriptions. This incident highlights the evolving tactics of cybercriminals who exploit social engineering and trusted platforms to deceive users. The use of legitimate services like link-aggregation platforms and browser notifications underscores the need for heightened vigilance and advanced security measures to protect against such sophisticated scams.
3 months ago
Kill Chain
FBI Dismantles AI-Powered Phishing Operation 'Outsider Enterprise'
In June 2026, the FBI, in collaboration with Google and Black Lotus Labs, dismantled 'Outsider Enterprise,' a Chinese phishing-as-a-service operation active since at least 2023. This cybercrime network utilized AI to distribute phishing kits, creating over 9,000 fake websites and more than a million fraudulent URLs. These sites impersonated trusted brands, leading to the theft of approximately 3.8 million credit card records and causing an estimated $1.9 billion in losses. The takedown, part of Operation Riptide, involved seizing multiple servers, a Shopify storefront, and around $100,000 USDT from Outsider's payment wallets. Thousands of phishing domains now redirect to an FBI splash page. This incident underscores the escalating use of AI in cybercrime, enabling large-scale, sophisticated phishing campaigns. The success of Operation Riptide highlights the importance of coordinated efforts between law enforcement and private sector entities in combating such threats.
3 months ago
Kill Chain
Operation Highland: Unveiling a Decade of Stealthy Cyber-Espionage
In 2026, cybersecurity researchers uncovered 'Operation Highland,' a decade-long cyber-espionage campaign by the Chinese state-sponsored group Velvet Ant. Beginning in 2016, the attackers initially compromised internet-facing servers, deploying modified GS-Netcat reverse shells for encrypted remote access. They then installed custom SOCKS5 proxies to tunnel traffic, enabling access to isolated networks. By backdooring Linux Pluggable Authentication Modules (PAM) and OpenSSH components, Velvet Ant harvested credentials and maintained persistent access, effectively embedding themselves within the authentication process. This allowed them to monitor administrative activities and exfiltrate sensitive data undetected for ten years. The discovery of this prolonged intrusion underscores the evolving sophistication of state-sponsored cyber threats. It highlights the critical need for organizations to implement robust monitoring of authentication systems, conduct regular integrity checks of security components, and adopt a zero-trust security model to mitigate the risk of such stealthy and persistent attacks.
3 months ago
Kill Chain
FBI Dismantles Outsider Cybercrime Network Responsible for $1.9 Billion in Losses
In June 2026, the FBI, in collaboration with Google and Lumen Technologies, dismantled a significant China-based cybercrime network known as Outsider Enterprise. This operation, dubbed 'Operation Ghost Hook,' targeted a phishing-as-a-service platform that had been active since July 2023. Outsider provided cybercriminals with phishing kits and hosted infrastructure, enabling them to impersonate trusted brands and defraud victims across 55 countries, including the United States. The takedown resulted in the seizure of several core admin server domains, a Shopify storefront, approximately $100,000 from Outsider's payment wallets, and thousands of domains registered through U.S.-based providers. Authorities linked Outsider's phishing domains to nearly 3.9 million stolen credit cards, contributing to an estimated $1.9 billion in losses. This incident underscores the evolving sophistication of cybercriminal operations, particularly the use of AI to enhance phishing campaigns. The Outsider platform's integration of AI tools like Google's Gemini allowed for the creation of highly convincing phishing lures, making it increasingly challenging for individuals and organizations to detect and prevent such attacks. The takedown highlights the necessity for continuous advancements in cybersecurity measures and the importance of international cooperation in combating cyber threats.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports