The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Critical Palo Alto PAN-OS Zero-Day CVE-2026-0300 Under Active Exploitation
In early May 2026, Palo Alto Networks disclosed a critical zero-day vulnerability (CVE-2026-0300) in its PAN-OS software, specifically affecting the User-ID Authentication Portal service. This buffer overflow flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this vulnerability has been observed, particularly targeting firewalls with the User-ID Authentication Portal exposed to untrusted networks or the public internet. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The urgency of this situation is heightened by the vulnerability's high CVSS score of 9.3 and the low complexity required for exploitation. With over 5,800 publicly exposed VM-Series firewalls running PAN-OS identified, the potential for widespread impact is significant. Organizations are advised to implement Palo Alto Networks' mitigation strategies immediately and apply patches as soon as they become available.
4 months ago
Kill Chain
xlabs_v1 Botnet: A New Threat Exploiting ADB-Exposed IoT Devices
In May 2026, cybersecurity researchers uncovered a new botnet named xlabs_v1, derived from the Mirai malware, which exploits internet-exposed devices running Android Debug Bridge (ADB) on TCP port 5555. This botnet targets devices such as Android TV boxes, set-top boxes, and smart TVs, enlisting them to perform distributed denial-of-service (DDoS) attacks, particularly against game servers and Minecraft hosts. The malware supports 21 flood variants across TCP, UDP, and raw protocols, including RakNet and OpenVPN-shaped UDP, capable of bypassing consumer-grade DDoS protection. Notably, xlabs_v1 lacks a persistence mechanism, requiring re-infection for each attack, and includes a 'killer' subsystem to eliminate competing malware, ensuring full control over the compromised device's bandwidth. ([thehackernews.com](https://thehackernews.com/2026/05/mirai-based-xlabsv1-botnet-exploits-adb.html?utm_source=openai)) The emergence of xlabs_v1 highlights the ongoing evolution of IoT-targeted malware and the increasing sophistication of DDoS-for-hire services. This incident underscores the critical need for securing IoT devices, particularly those with default-enabled services like ADB, to prevent their exploitation in large-scale cyber attacks.
4 months ago
Kill Chain
Rockstar Games Data Breach: A Case Study in Third-Party Exploitation
In April 2026, Rockstar Games experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers exploited vulnerabilities in Anodot, a monitoring tool integrated with Rockstar's Snowflake cloud infrastructure, to gain unauthorized access. This breach led to the exfiltration of nearly 80 million records, including sensitive internal corporate information. While Rockstar confirmed that no player data or passwords were compromised, the incident underscores the risks associated with third-party integrations and the potential for indirect attack vectors. This breach is part of a broader trend of financially motivated cyber extortion campaigns targeting major organizations. ShinyHunters' tactics, particularly their use of social engineering and exploitation of third-party services, highlight the evolving threat landscape. Organizations must remain vigilant, ensuring robust security measures are in place for both internal systems and external partnerships to mitigate such risks.
4 months ago
Kill Chain
Unveiling Threat Activity Enablers: Key Players in 2025's Cyber Threat Landscape
In 2025, Recorded Future's Insikt Group identified a significant rise in the utilization of Threat Activity Enablers (TAEs)—entities that provide infrastructure and services to support malicious cyber activities. These TAEs, often operating through complex networks of shell companies and lacking stringent Know Your Customer (KYC) policies, have become central to the operations of ransomware groups, botnets, and state-sponsored actors. Notably, German hosting provider aurologic GmbH emerged as a key player, offering services to multiple high-risk networks implicated in various cyber threats. ([recordedfuture.com](https://www.recordedfuture.com/research/malicious-infrastructure-finds-stability-with-aurologic-gmbh?utm_source=openai)) The persistence and adaptability of TAEs pose a substantial challenge to cybersecurity efforts. Their ability to rapidly rebrand and manipulate network resources allows them to evade sanctions and takedowns, ensuring the continuity of malicious operations. This trend underscores the necessity for organizations to enhance their threat intelligence capabilities and adopt proactive measures to identify and mitigate risks associated with such enablers. ([recordedfuture.com](https://www.recordedfuture.com/blog/threat-activity-enablers?utm_source=openai))
4 months ago
Kill Chain
UAE Faces Unprecedented Cyberattacks Amid Regional Tensions
In early 2026, the United Arab Emirates (UAE) experienced a significant surge in cyberattacks, with daily breach attempts escalating from 90,000–200,000 to between 600,000 and 800,000 following the onset of military operations by Israel and the U.S. against Iran. These attacks, attributed to nation-state actors and hacktivist groups, targeted critical infrastructure sectors such as finance, telecommunications, aviation, law enforcement, and energy. The UAE's Cybersecurity Council reported that the national cyber defense system successfully thwarted these organized cyberattacks, which included ransomware, phishing campaigns, and the exploitation of artificial intelligence technologies to develop sophisticated offensive tools. ([gulfnews.com](https://gulfnews.com/uae/government/uae-thwarts-terrorist-cyberattacks-targeting-vital-digital-infrastructure-1.500451219?utm_source=openai)) This escalation underscores the evolving nature of cyber threats in the region, highlighting the increasing integration of advanced technologies into malicious digital activities. The UAE's proactive defense measures and improved cyber visibility have been instrumental in mitigating the impact of these attacks, reflecting a broader trend of heightened cyber resilience among Gulf nations. ([thenationalnews.com](https://www.thenationalnews.com/future/technology/2026/02/18/uae-cybersecurity-fake-news-disinformation/?utm_source=openai))
4 months ago
Kill Chain
CISA's CI Fortify Initiative: Strengthening Critical Infrastructure Resilience
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) launched the 'CI Fortify' initiative to bolster the resilience of U.S. critical infrastructure against state-sponsored cyber threats, particularly from Chinese groups Salt Typhoon and Volt Typhoon. This program focuses on enabling essential services to operate independently for extended periods by isolating operational technology (OT) networks from IT systems and third-party connections during emergencies. ([cyberscoop.com](https://cyberscoop.com/cisa-ci-fortify-critical-infrastructure-isolation-recovery-guidance-during-conflict/?utm_source=openai)) The urgency of this initiative is underscored by recent cyber activities targeting critical sectors such as electricity, water, and telecommunications. These incidents highlight the need for infrastructure operators to develop and implement isolation and recovery plans to maintain service continuity amidst potential cyber disruptions. ([cyberscoop.com](https://cyberscoop.com/cisa-ci-fortify-critical-infrastructure-isolation-recovery-guidance-during-conflict/?utm_source=openai))
4 months ago
Kill Chain
ScarCruft's Supply Chain Attack Delivers BirdCall Malware to Android Users
In May 2026, the North Korean state-sponsored hacking group ScarCruft (APT37) executed a supply chain attack by compromising the sqgame[.]net gaming platform, which serves the Yanbian region in China. The attackers trojanized Android game APKs available on the platform, embedding a new variant of their BirdCall backdoor malware. This Android version of BirdCall is capable of extracting geolocation data, collecting contacts, call logs, SMS messages, device information, and exfiltrating files of interest. Additionally, it can take periodic screenshots and record audio during specific time frames. The campaign appears to target ethnic Koreans in the Yanbian region, a known crossing point for North Korean defectors and refugees. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/scarcruft-hackers-push-birdcall-android-malware-via-game-platform/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors, particularly their expansion into mobile platforms through supply chain compromises. The development of Android-specific malware variants like BirdCall highlights the increasing risk to mobile device users, emphasizing the need for heightened vigilance and robust security measures when downloading applications, especially from third-party sources.
4 months ago
Kill Chain
Student Exploits TETRA Vulnerabilities to Halt Taiwan High-Speed Trains
In April 2026, a 23-year-old university student in Taiwan exploited vulnerabilities in the Taiwan High Speed Rail Corporation's (THSRC) TETRA communication system. Utilizing software-defined radio (SDR) equipment and handheld radios, the student transmitted a forged 'General Alarm' signal, causing four high-speed trains to halt operations for 48 minutes. The attack was facilitated by the static nature of the system's parameters, which had remained unchanged for 19 years, allowing the student to bypass multiple verification layers. Authorities arrested the individual, who now faces charges under Article 184 of the Criminal Law, with potential imprisonment of up to 10 years. This incident underscores the critical need for regular security assessments and updates in communication systems, especially those integral to public safety and infrastructure. The exploitation of longstanding vulnerabilities in the TETRA protocol highlights the urgency for organizations to proactively address potential security gaps to prevent similar disruptions in the future.
4 months ago
Kill Chain
China-Linked UAT-8302 Targets Governments Using Shared APT Malware
Between late 2024 and 2025, the China-nexus advanced persistent threat (APT) group UAT-8302 targeted government entities in South America and southeastern Europe. Post-compromise activities included deploying custom malware families such as NetDraft, CloudSorcerer, and SNOWLIGHT, tools previously associated with other China-aligned threat actors. The group conducted extensive reconnaissance, utilized open-source tools for automated scanning, and established alternative backdoor access using proxy and VPN tools. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-8302/?utm_source=openai)) This incident highlights the increasing collaboration among China-aligned APT groups, sharing tools and tactics to enhance their cyber espionage capabilities. The use of shared malware underscores the need for organizations to adopt comprehensive security measures to detect and mitigate such sophisticated threats. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-8302/?utm_source=openai))
4 months ago
Kill Chain
Telegram Mini Apps Exploited for Crypto Scams and Malware Distribution
In May 2026, cybersecurity researchers uncovered a large-scale fraud operation exploiting Telegram's Mini App feature to conduct cryptocurrency scams, impersonate reputable brands, and distribute Android malware. Dubbed FEMITBOT, the platform utilizes Telegram bots and embedded Mini Apps to create convincing, app-like experiences within the messaging platform. Threat actors impersonated brands such as Apple, Coca-Cola, and NVIDIA, using a shared backend infrastructure to display phishing sites directly within Telegram. Victims were lured into fake dashboards showing fictitious earnings, prompting them to deposit funds or download malicious Android APKs disguised as legitimate applications. This operation highlights the evolving tactics of cybercriminals leveraging trusted platforms to deceive users and distribute malware. The incident underscores the urgent need for heightened vigilance against social engineering attacks and the importance of verifying the authenticity of applications and investment opportunities. As cybercriminals continue to exploit popular platforms for malicious purposes, users must exercise caution and adhere to best practices to safeguard their digital assets and personal information.
4 months ago
Kill Chain
Critical cPanel & WHM Authentication Bypass Vulnerability (CVE-2026-41940) Discovered
In April 2026, a critical authentication bypass vulnerability, CVE-2026-41940, was discovered in cPanel & WHM, affecting versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5. This flaw allows remote, unauthenticated attackers to gain root-level administrative access by injecting arbitrary values into server-side session files, effectively bypassing all credential checks. Exploitation in the wild has been confirmed, with attackers leveraging this vulnerability to compromise entire systems, leading to data theft, malware deployment, or complete server erasure. cPanel has released patches to address this issue, and administrators are urged to update immediately to secure their systems. ([support.cpanel.net](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026?utm_source=openai)) The emergence of this vulnerability underscores the critical importance of timely software updates and robust security practices. With the availability of public proof-of-concept exploits and active exploitation observed, organizations must prioritize patching and monitoring to mitigate the risk of unauthorized access and potential system compromise.
4 months ago
Kill Chain
Huge Networks' Infrastructure Exploited in Massive DDoS Attacks on Brazilian ISPs
In April 2026, Huge Networks, a Brazilian firm specializing in DDoS mitigation, was implicated in orchestrating massive DDoS attacks against Brazilian ISPs. An exposed archive revealed that a threat actor had root access to Huge Networks' infrastructure, utilizing it to build a botnet by exploiting vulnerabilities in TP-Link Archer AX21 routers, specifically CVE-2023-1389. The botnet conducted DNS amplification attacks, significantly impacting targeted ISPs. Huge Networks' CEO attributed the malicious activity to a security breach, suggesting a competitor's involvement to tarnish the company's reputation. This incident underscores the persistent threat posed by botnets leveraging IoT vulnerabilities, even years after patches are released. It highlights the critical need for organizations to secure their infrastructure and monitor for unauthorized access to prevent exploitation in large-scale cyberattacks.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports