The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Tchap Messenger Breach: Data of 73,000 French Government Employees Exposed
In June 2026, the French government's encrypted messaging platform, Tchap, experienced a security breach when a threat actor gained access through a compromised user account. This intrusion led to the exposure of data from public chat rooms, affecting over 73,000 public sector employees. The compromised information included users' names, email addresses, avatar images, and their affiliated public sector organizations. Private conversations remained encrypted and were not accessed during the breach. This incident underscores the persistent threat posed by social engineering attacks and highlights the importance of securing even internal communication platforms. Organizations must remain vigilant and continuously enhance their security measures to protect sensitive information from unauthorized access.
3 months ago
Kill Chain
China-Linked Hackers Backdoor Linux Login Systems for Nearly a Decade
In June 2026, cybersecurity firm Sygnia uncovered that the China-linked threat group known as Velvet Ant had infiltrated Linux systems by backdooring the Pluggable Authentication Modules (PAM) and OpenSSH components, enabling unauthorized access and credential harvesting. This sophisticated attack, which began as early as 2016, involved replacing trusted login programs with malicious versions, allowing the attackers to maintain persistent access and evade detection. The incident underscores the evolving tactics of nation-state actors targeting critical infrastructure components that are often overlooked, highlighting the need for organizations to implement rigorous integrity checks and continuous monitoring of authentication systems to detect and mitigate such stealthy intrusions.
3 months ago
Kill Chain
China-Linked JDY Botnet Intensifies Focus on U.S. Military Networks
In June 2026, cybersecurity researchers identified a significant expansion of the JDY botnet, a network linked to Chinese state-sponsored actors such as Volt Typhoon. The botnet, which has grown from approximately 650 active bots in January 2024 to over 1,500 compromised small office/home office (SOHO) and Internet of Things (IoT) devices, primarily targets U.S. military and associated networks. JDY functions as a distributed scanning and fingerprinting network, rapidly identifying vulnerable infrastructure shortly after public vulnerability disclosures, thereby facilitating swift exploitation by advanced persistent threat (APT) actors. This development underscores the escalating sophistication and persistence of state-sponsored cyber threats, particularly those emanating from China. The rapid operationalization of reconnaissance data by APT groups highlights the critical need for organizations, especially within the defense sector, to enhance their cybersecurity posture, promptly apply patches, and implement robust monitoring to detect and mitigate such threats.
3 months ago
Kill Chain
JDY Botnet's Rapid Expansion: A Wake-Up Call for Cybersecurity
In June 2026, cybersecurity researchers reported a significant expansion of the JDY botnet, a covert network linked to Chinese state-sponsored actors. The botnet has grown from 650 to over 1,500 compromised small office and home office (SOHO) routers and IoT devices. This network is utilized for large-scale reconnaissance, enabling rapid identification and mapping of exposed services within hours of new vulnerability disclosures. The JDY botnet's resilience and adaptability underscore the persistent threat posed by state-sponsored cyber activities targeting critical infrastructure. The rapid expansion of the JDY botnet highlights the increasing sophistication of state-sponsored cyber operations. Organizations must prioritize timely patching of edge devices, enforce strong authentication measures, and monitor for indicators of compromise to mitigate the risks associated with such covert networks.
3 months ago
Kill Chain
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
On June 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. These include CVE-2026-20245, an improper encoding vulnerability in Cisco Catalyst SD-WAN Manager; CVE-2026-11645, an out-of-bounds read and write flaw in Google Chrome's V8 engine; and CVE-2026-7473, an incomplete comparison vulnerability in Arista's Extensible Operating System (EOS). These vulnerabilities could allow attackers to execute arbitrary code or process unauthorized tunnel traffic, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by actively exploited flaws in widely used software and hardware. Organizations are urged to apply the necessary patches or mitigations promptly to safeguard their systems against potential attacks.
3 months ago
Kill Chain
CISA Highlights Active Exploitation of Three New Vulnerabilities
On June 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2026-7473 affecting Arista's Extensible Operating System, CVE-2026-11645 in Google Chromium's V8 engine, and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. These vulnerabilities pose significant risks to federal enterprises, as they are commonly targeted by malicious cyber actors. The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software flaws. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and protect their networks against active threats.
3 months ago
Kill Chain
NSO Group's Continued Targeting of WhatsApp Users Despite Legal Prohibitions
In June 2026, WhatsApp identified and disrupted a spear-phishing campaign linked to the NSO Group, a spyware firm previously barred by a court order from targeting WhatsApp users. The attackers attempted to deceive users into clicking malicious links leading to external websites, aiming to install spyware on their devices. This incident follows a 2019 campaign where NSO exploited a WhatsApp vulnerability to target approximately 1,400 users, leading to a lawsuit and a permanent injunction against NSO. ([techcrunch.com](https://techcrunch.com/2026/06/08/whatsapp-says-it-caught-new-spyware-attacks-linked-to-nso-group-in-violation-of-court-order/?utm_source=openai)) The recurrence of such attacks underscores the persistent threat posed by spyware firms and highlights the challenges in enforcing legal restrictions against them. Organizations must remain vigilant and proactive in defending against sophisticated phishing and spyware campaigns that continue to evolve despite legal deterrents.
3 months ago
Kill Chain
U.S. Military's Covert Use of GPS for Encrypted Key Distribution Unveiled
In June 2026, security researcher Steven Murdoch uncovered that the U.S. military has been utilizing public GPS signals to broadcast encrypted cryptographic keys for nearly two decades. This method effectively transformed GPS satellites into global 'numbers stations,' enabling the Over-the-Air Distribution (OTAD) and Over-the-Air Rekeying (OTAR) systems to remotely update cryptographic keys for military GPS receivers worldwide. The discovery highlights the military's innovative approach to secure key distribution without relying on physical couriers. ([404media.co](https://www.404media.co/the-u-s-military-quietly-turned-gps-into-a-global-numbers-station-evidence-suggests/?utm_source=openai)) This revelation underscores the critical importance of secure key management in military operations and the potential for leveraging existing infrastructure for covert communications. It also raises questions about the transparency of such methods and their implications for both military and civilian users of GPS technology.
3 months ago
Kill Chain
Cisco SD-WAN Zero-Day CVE-2026-20245: A Critical Security Alert
In June 2026, Cisco disclosed CVE-2026-20245, a zero-day vulnerability in its Catalyst SD-WAN Manager, marking the seventh such exploit in their SD-WAN products that year. This flaw allows authenticated attackers with netadmin privileges to execute arbitrary commands as root by uploading a crafted file, potentially leading to unauthorized configuration changes on edge devices. Exploitation requires valid credentials or prior exploitation of vulnerabilities like CVE-2026-20182 or CVE-2026-20127. Cisco has observed limited cases where this vulnerability resulted in configuration changes pushed to edge devices. As of now, no patch or workaround is available, and the company advises upgrading to fixed software released in May 2026 as a protective measure. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/05/cisco-sd-wan-cve-2026-20245-0-day-exploited/?utm_source=openai)) The recurrence of such vulnerabilities underscores the critical need for organizations to maintain rigorous access controls and promptly apply security updates. The exploitation of multiple zero-days within a short period highlights the evolving threat landscape targeting network infrastructure, emphasizing the importance of proactive vulnerability management and continuous monitoring to safeguard against potential breaches.
3 months ago
Kill Chain
Meta Challenges NSO Group Over New WhatsApp Spyware Attacks
In June 2026, Meta identified and disrupted a spear-phishing campaign linked to the Israeli spyware firm NSO Group, targeting WhatsApp users. This activity violated a permanent injunction issued in 2025, which barred NSO from engaging with WhatsApp and its users. The campaign involved deceptive messages designed to lure individuals into clicking malicious links, leading to external websites, and the creation of test accounts and groups within WhatsApp. Meta responded by filing a contempt-of-court complaint against NSO Group for defying the court order. ([cyberscoop.com](https://cyberscoop.com/meta-contempt-complaint-nso-group-spyware/?utm_source=openai)) This incident underscores the persistent threat posed by spyware vendors and the challenges in enforcing legal actions against them. It highlights the need for continuous vigilance and robust security measures to protect users from sophisticated cyber threats.
3 months ago
Kill Chain
Critical UniFi OS Vulnerabilities Enable Remote Code Execution
In May 2026, Ubiquiti's UniFi OS was found to have three critical vulnerabilities—CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910—each with a CVSS score of 10.0. These flaws allow unauthenticated remote attackers to execute arbitrary code with root privileges by chaining improper access control, path traversal, and command injection vulnerabilities. The vulnerabilities affect UniFi OS Server versions 5.0.6 and earlier, potentially compromising network management systems, surveillance cameras, and physical access controls. This incident underscores the escalating risks associated with network management systems as prime targets for cyberattacks. Organizations must prioritize timely patching and robust access controls to mitigate such vulnerabilities, especially given the increasing sophistication of threat actors targeting critical infrastructure.
3 months ago
Kill Chain
Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required
In February 2026, a critical vulnerability identified as CVE-2026-23111 was discovered in the Linux kernel's nf_tables subsystem. This flaw, resulting from an inverted genmask check in the nft_map_catchall_activate() function, allows unprivileged local users to escalate privileges to root. The vulnerability affects systems with user namespaces and nftables enabled, common configurations in many Linux distributions. Exploits leveraging this vulnerability have been publicly released, demonstrating the ease with which attackers can gain root access and potentially break out of containerized environments. The disclosure of CVE-2026-23111 underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel. The rapid development and public release of exploits for such vulnerabilities highlight the need for organizations to promptly apply security patches and review system configurations to mitigate potential risks.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports