The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
PlushDaemon Leverages Router Update Supply Chain in 2024 Chinese APT Attack
In 2024, a sophisticated Chinese state-sponsored group, tracked as PlushDaemon, exploited a unique supply chain tactic by compromising router firmware to hijack software update processes. These attackers covertly inserted malicious code into router updates, allowing them to intercept and manipulate network communications and deploy persistent malware within organizational networks—most notably targeting Chinese entities. Their approach leveraged trusted update channels, evading traditional detection methods and enabling infiltration with minimal immediate disruption, causing operational risk and potential data exposure on a wide scale. This technique underscores a growing trend of software supply chain attacks, where trusted network or infrastructure elements become the entry point for espionage or cyber sabotage. Organizations face mounting pressure to secure update mechanisms as attackers increasingly target foundational controls rather than endpoint devices.
8 months ago
Kill Chain
NSO Group Faces 2024 Injunction Over WhatsApp Targeting—Legal and Compliance Impacts Revealed
In early 2024, NSO Group—the Israeli surveillance technology vendor behind Pegasus spyware—faced a permanent injunction from a U.S. federal court barring it from targeting WhatsApp with its tools. The injunction, part of a high-profile legal battle stemming from NSO's alleged exploitation of WhatsApp vulnerabilities to surveil users, forces NSO to halt, destroy, or refrain from deploying code that interacts with the messaging platform. NSO's defense highlights the existential threat to their business as they appeal, arguing that this could irreparably harm the company and restrict potential U.S. government usage of Pegasus for authorized investigations. This case underscores ongoing global debates around the regulation of commercial spyware, lawful intercept technologies, and privacy rights. With increased legislative and compliance scrutiny, and rising governmental and private sector concerns about surveillance abuse, the outcome may set significant legal and operational precedents for the global spyware ecosystem.
8 months ago
Kill Chain
Google Uncovers BadAudio Malware in Chinese APT24 Espionage Campaign
In early 2024, Google’s Threat Analysis Group uncovered a sophisticated, years-long cyber espionage campaign orchestrated by the China-linked APT24 threat group. The attackers leveraged a newly discovered malware dubbed BadAudio to infiltrate government agencies, research institutions, and select private organizations. Initial access was obtained via spear-phishing campaigns, progressing to persistent lateral movement within compromised environments. BadAudio’s deployment enabled covert data exfiltration over encrypted channels, evading standard security controls and providing unmatched visibility and persistence for the attackers. The incident highlights the advanced tradecraft and evolving toolsets in use by nation-state threat actors, with business impacts centered on the loss of sensitive data and the undermining of critical organizational trust. The exposure of BadAudio signals a notable escalation in cyber espionage tactics, utilizing bespoke malware and encrypted traffic to circumvent modern defenses. Organizations across sectors are at risk as threat groups adopt similar methods, prompting increased scrutiny from regulators and heightened awareness around securing east-west traffic and anomaly detection.
8 months ago
Kill Chain
ThreatsDay 2025: Multi-Vector Attacks Redefine the Global Breach Landscape
In November 2025, a coordinated wave of multi-vector cyberattacks swept across organizations worldwide, leveraging zero-day exploits, LinkedIn spear-phishing, cryptocurrency theft, and vulnerabilities in IoT devices. Attackers exploited both east-west and egress traffic to evade detection, compromise sensitive data in transit, and establish persistent remote access. Prominent threat groups utilized unencrypted and encrypted traffic, weaponized browser extensions, and abused legitimate remote monitoring tools like AnyDesk. The result was disruption to business operations, regulatory investigations, and an uptick in ransomware and crypto-related financial crimes traced to state-sponsored and criminal actors. This incident underscores the escalating risk posed by attackers who blend diverse TTPs across cloud, hybrid, and enterprise networks. The convergence of espionage motives, cybercrime, and advanced ransomware strains highlights the need for real-time visibility, layered segmentation, and updated anomaly detection strategies.
8 months ago
Kill Chain
China-Backed PlushDaemon APT Leverages Network Devices for Advanced MitM Attacks (2024)
In 2024, ESET researchers uncovered a sustained campaign by the China-linked PlushDaemon APT that targeted edge and network devices in government, telecommunications, and technology sectors, enabling advanced adversary-in-the-middle (AitM) attacks. PlushDaemon deployed a sophisticated network implant capable of intercepting, modifying, and redirecting encrypted and unencrypted traffic, allowing the threat actor to facilitate credential theft and covert surveillance. The operation exploited weak segmentation and insufficient east-west controls, compromising business operations and exposing sensitive communications to persistent espionage. This incident is particularly relevant as APTs increasingly leverage traffic interception at the network device layer, bypassing traditional endpoint security and highlighting urgent gaps in zero trust, segmentation, and encrypted traffic monitoring solutions.
8 months ago
Kill Chain
WhatsApp 'Eternidade' Trojan Self-Propagates Across Brazil
In early 2024, a sophisticated infostealer campaign dubbed 'Eternidade' began targeting Brazilian Portuguese–speaking WhatsApp users. The attackers distributed a trojan combining phishing, credential theft, and worm-like self-propagation via compromised WhatsApp messages. Victims were lured with messages containing malicious links; once infected, devices exposed sensitive banking credentials and personal data to attackers. The malware leveraged localized tactics and social engineering to increase infection rates and circumvent traditional perimeter defenses, leading to widespread compromise across individual users and organizations reliant on WhatsApp for communication. The rapid spread, data loss, and potential for further extortion amplified business and consumer risks. This breach signals the growing sophistication of infostealer operations, especially their ability to exploit trusted communication apps in regionally tailored attacks. The incident raises alarm over encrypted-messaging-based malware and highlights gaps in endpoint and messaging security as threat actors increasingly weaponize social communication platforms.
8 months ago
Kill Chain
Amazon Warns: MuddyWater Cyberattack Bridges Digital and Kinetic Warfare
In June 2024, Amazon Threat Intelligence reported a sophisticated, nation-state cyberattack demonstrating the merging of cyber and kinetic warfare. The Iranian-backed MuddyWater group leveraged compromised CCTV infrastructure in Jerusalem to obtain real-time intelligence, directly enabling more precise missile strikes against physical targets. Attackers provisioned infrastructure and infiltrated CCTV feeds a month in advance, highlighting a deliberate and strategic approach to combining digital reconnaissance with physical attack vectors. Israeli authorities confirmed that this real-time data was used to adjust targeting during the incident, leading to heightened operational impact and escalating concerns for critical infrastructure operators. This incident underscores an alarming trend: cyber-espionage operations now increasingly serve as force multipliers for military actions. The blurred line between cyber and physical domains exemplifies an evolution in threat tactics, with nation-state actors exploiting enterprise networks as entry points for real-world impact. Security leaders must recognize this convergence and adapt defense and intelligence sharing accordingly.
8 months ago
Kill Chain
Mobile Malware Soars in Q3 2025: Key Insights from Kaspersky's Global Report
In Q3 2025, Kaspersky reported a significant surge in mobile malware activity, with 47 million attacks prevented globally targeting Android devices with Trojans, adware, banking malware, and ransomware. Threat actors exploited new variants—including BADBOX and sophisticated Trojans like Triada and Fakemoney—utilizing methods such as pre-installed backdoors and malicious app mods. Mobile banking Trojans (especially Mamont and Coper) and region-targeted malware attacks in Turkey, India, Iran, and Germany impacted financial data security and user privacy, highlighting expanding attacker sophistication and supply chain compromise. This incident is critical as it illustrates the rising prevalence and complexity of mobile threats, coinciding with increased ransomware attacks and evolving delivery channels. The continued targeting of financial apps and global user bases signals an urgent need for organizations to strengthen mobile security, visibility, and compliance with privacy mandates.
8 months ago
Kill Chain
Operation WrtHug: Tens of Thousands of ASUS Routers Hijacked in Global Botnet Surge
In late 2025, tens of thousands of end-of-life ASUS routers worldwide were hijacked in a large-scale operation dubbed "WrtHug." The attackers exploited six unpatched vulnerabilities in outdated ASUS WRT firmware, targeting devices primarily in Taiwan, the U.S., and Russia, among others. After gaining unauthorized access, WrtHug actors enrolled these routers into a global botnet, leveraging them for coordinated command-and-control traffic and potentially for further attacks. The campaign highlighted the sustained risk posed by unsupported network equipment in both consumer and business environments. This incident underscores an ongoing surge in attacks targeting aging and end-of-life IoT devices, as cybercriminals capitalize on lapses in patching and lifecycle management. Organizations globally are under renewed pressure to inventory, segment, and securely retire vulnerable network infrastructure as such botnet tactics intensify.
8 months ago
Kill Chain
WhatsApp Hijack: Eternidade Stealer Campaign Hits Brazilian Users via Python Worm
In November 2025, cybersecurity researchers identified a sophisticated campaign targeting Brazilian users via WhatsApp, where attackers leveraged a Python-based worm combined with social engineering tactics. Victims were tricked into installing a worm that hijacked WhatsApp sessions and propagated itself to contacts, while delivering a Delphi-based banking trojan known as Eternidade Stealer. The campaign exploited IMAP to dynamically resolve command-and-control infrastructure, enabling threat actors to orchestrate info-stealing and credential harvesting at scale and with resilience to takedown attempts. The incident had significant implications for financial fraud and impacted numerous personal and business WhatsApp accounts across Brazil. This campaign is emblematic of a wider surge in malware leveraging messaging platforms for lateral movement and rapid propagation. The popularity of WhatsApp, combined with increasingly modular infostealers and TTP reuse by criminal groups, highlights the urgent need for proactive controls and visibility across both east-west and outbound communication paths.
8 months ago
Kill Chain
Microsoft Thwarts Record-Breaking 15.72 Tbps DDoS Attack Orchestrated by AISURU Botnet
In November 2025, Microsoft successfully detected and mitigated an unprecedented Distributed Denial-of-Service (DDoS) attack that peaked at 15.72 Tbps, targeting a cloud endpoint in Australia. The attack, orchestrated by the AISURU botnet leveraging TurboMirai-class malware, generated nearly 3.64 billion packets per second. Advanced protections within Microsoft's Azure platform automatically neutralized the threat before it could affect customer availability or data. Microsoft attributed the attack to highly automated botnets leveraging compromised IoT devices and observed a rapid, multi-vector assault designed to test cloud resilience and incident response. This record-breaking event highlights the escalating scale and sophistication of DDoS activity targeting foundational cloud infrastructure. As attackers exploit larger IoT botnets and novel malware strains, defenders face mounting pressure to evolve detection and mitigation at cloud-scale. Organizations must increasingly invest in robust DDoS protection and continuously monitor for emerging threats.
8 months ago
Kill Chain
Eurofiber France Data Breach 2024: Ticket System Compromise Exposes Customer Records
In June 2024, Eurofiber France disclosed a significant data breach after its ticket management system was compromised by threat actors who exploited a vulnerability. The attackers gained unauthorized access to the ticketing platform, proceeding to exfiltrate customer data before attempting to sell it on an underground forum. The breach exposed personal and business information, prompting notification to affected clients and regulatory authorities, and forced Eurofiber to review and enhance its internal security measures. This incident highlights the persistent targeting of essential infrastructure vendors via vulnerable business applications, such as ticketing systems. It reflects the growing risks of data exfiltration and underground marketplaces, prompting renewed scrutiny on third-party software security and compliance requirements.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports