The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
How Attackers Are Abusing DNS for Covert Command and Control in 2024
In October 2024, security researchers highlighted a critical technique enabling Command and Control (C2) communication over DNS channels by encoding arbitrary byte values in DNS queries—even when traversing third-party infrastructures like Cloudflare and Google. Using custom-crafted DNS packets, attackers can bypass traffic inspection and filtering, exploiting DNS to exfiltrate or transfer data using modified BASE64 or expanded ASCII, which can evade many traditional network defenses due to protocol limitations and inconsistent validations among DNS providers. This creates a covert path for malware to communicate without detection by standard security tools. This incident underscores a rising trend where attackers leverage ubiquitous protocols—such as DNS—for covert C2, presenting profound challenges for organizations seeking to secure east-west traffic and detect advanced threats. Awareness is crucial, as advanced C2 techniques are increasingly observed in malware campaigns exploiting gaps in DNS monitoring and anomaly detection.
8 months ago
Kill Chain
First Wap's SS7 Exploit: How Altamides Changed Global Surveillance in 2025
In 2025, surveillance-technology firm First Wap, based in Jakarta, was revealed to have quietly built and operated the 'Altamides' system, a covert platform leveraging SS7 telecom vulnerabilities for global phone tracking. Unlike conventional spyware, Altamides enabled real-time location tracking of mobile devices across regions—from the Vatican to Silicon Valley—without requiring user interaction, installation, or leaving traces on targeted phones. The technology exploited legacy telecom protocols to access cell tower information, bypassing most modern mobile security defenses. As a result, sensitive locations and communications were exposed to persistent surveillance risk, with broad geopolitical and privacy implications. This incident underscores a worrying rise in the commercial proliferation of offensive surveillance tools exploiting underprotected telecom infrastructure. It highlights the urgent need for stronger regulatory action and zero trust defenses, as targeted espionage techniques move further away from traditional malware and towards systemic protocol abuse.
8 months ago
Kill Chain
Smishing Triad’s 2024 US SMS Phishing Campaign: Government Impersonation Goes Mainstream
In early 2024, a threat group known as the 'Smishing Triad' launched a wave of phishing attacks targeting American mobile phone users through fake government-related SMS messages. The group impersonated federal and state agencies, primarily sending texts about unpaid toll fees and penalties to lure recipients into clicking malicious links. These links redirected victims to counterfeit payment portals to steal personal and financial information. The campaign used low-frequency, highly targeted smishing tactics which significantly increased trust and subsequent victim engagement, resulting in a notable uptick in credential theft and financial fraud. This incident is part of a broader trend where cybercriminal organizations leverage sophisticated social engineering and government impersonation at a time of regulatory scrutiny around SMS-based phishing (smishing). Its evolving tactics show how attackers adapt to increase impact, highlighting the urgent need for layered, identity- and zero-trust-driven defenses.
8 months ago
Kill Chain
Global Smishing Triad Campaign: 194,000 Malicious Domains Power Massive Phishing Surge
In 2024, security researchers attributed a global smishing campaign to a threat group known as the Smishing Triad, which registered more than 194,000 malicious domains since January 1. Utilizing infrastructure predominantly registered through Hong Kong-based providers with Chinese nameservers, the actors orchestrated widespread phishing via SMS attacks targeting banking, logistics, and other sectors. Victims received highly targeted text messages that redirected them to credential-harvesting sites, leading to financial fraud and data compromise. The campaign’s scale and global reach underline the adversaries’ operational sophistication and heavy use of automation. This incident reflects a broader surge in phishing tactics leveraging SMS and vast domain infrastructure, bypassing traditional email security. The growing adoption of QR and mobile-first communication further widens the threat surface, putting regulatory and compliance emphasis on new vectors.
8 months ago
Kill Chain
2024 Android Infostealer Attack: How Termux and Telegram Fueled Stealthy Mobile Data Breaches
In October 2024, researchers identified a novel Android infostealer undetected by antivirus engines, leveraging Termux—a legitimate terminal emulator app—to collect sensitive data from mobile devices. The attacker deployed a Python-based stealer designed to extract user contacts, SMS, call logs, location data, and app-specific files, including those for Facebook, WhatsApp, and banking. Exfiltration occurred via Telegram API integration, and a persistent backdoor was installed for continued access. The operation showcased clever abuse of legitimate utilities, with initial device compromise mechanics still unclear, though social engineering leading to the installation of Termux is likely. This incident highlights the evolving landscape in which infostealers now aggressively target mobile platforms as device usage and data stored on them surge. With sophisticated yet undetectable malware exploiting legitimate tools and APIs, organizations and users face heightened risks from threats previously confined mostly to Windows environments.
8 months ago
Kill Chain
Salt Typhoon’s 2024 Attack: Nation-State Espionage Exploits Forgotten Network Devices
In early 2024, a cyber espionage campaign orchestrated by the China-linked Salt Typhoon group targeted forgotten and unpatched network perimeter devices, such as out-of-support routers, VPNs, and firewalls, across both public and private sector organizations in the U.S. and allied nations. Adversaries leveraged advanced "living off the land" tactics, establishing persistent access by exploiting technical debt and overlooked legacy hardware—bypassing hardened endpoint defenses and moving laterally within affected networks. Operational impacts included exposure of sensitive credentials, long-term surveillance risks, and significant challenges in incident detection and response due to the stealthy nature of the attacks. This incident highlights a surge in sophisticated nation-state threats adapting to improved endpoint security by targeting unmanaged infrastructure. The campaign underscores the urgency for organizations to reassess asset inventories, prioritize decommissioning of end-of-life devices, and deploy proactive detection strategies, as similar tactics are increasingly observed across multiple state-sponsored and ransomware actors.
8 months ago
Kill Chain
The 2024 Global Smishing Deluge: China-Based SMS Phishing at Scale
In early 2024, a China-based threat group orchestrated a massive global smishing campaign, flooding mobile devices across multiple continents with fraudulent SMS messages impersonating banks, government agencies, and delivery services. Leveraging a rapidly-evolving attack ecosystem, the actors utilized wide-scale automation and regional tailoring to bypass spam filters and trick users into revealing sensitive credentials or installing malware. The attack’s magnitude caught many organizations off guard, resulting in significant credential theft, unauthorized transactions, and growing operational strain as firms raced to block fast-moving SMS domains and educate affected users. This campaign signals a sharp escalation in the sophistication and reach of smishing attacks, highlighting persistent gaps in mobile security awareness and detection. As similar TTPs gain traction among organized threat groups, critical infrastructure and commercial service providers face increased risks of large-scale credential exposure and downstream fraud.
8 months ago
Kill Chain
F5 2025 Supply-Chain Breach: Nation-State Attackers Target Update Infrastructure
In October 2025, F5 Networks—an industry-leading provider of enterprise networking and security appliances—disclosed a sophisticated supply-chain breach attributed to a nation-state threat actor. Attackers maintained long-term, covert access to F5’s internal environment, ultimately compromising systems responsible for building and distributing software updates for its widely deployed BIG-IP products. The breach allowed unauthorized access to proprietary source code, documentation of unpatched vulnerabilities, and a trove of sensitive customer configuration data, significantly enlarging the risks of downstream exploitation for thousands of major enterprises and critical infrastructure providers globally. This incident underscores the growing threat of highly persistent, technically advanced supply-chain attacks targeting the software build and delivery processes of core technology vendors. The breach reflects recent escalation in nation-state tactics and highlights the continued exposure of global businesses to supply-chain and software update system threats.
8 months ago
Kill Chain
F5 Vulnerability Exposes Visibility Gaps in DHS’s CDM Program
In June 2024, a critical vulnerability affecting F5 devices exposed a major blind spot within the Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program, which is tasked with overseeing federal cybersecurity assets. The Cybersecurity and Infrastructure Security Agency (CISA) was forced to issue an emergency directive after learning that a nation-state actor had exploited F5 edge devices to gain persistent access across multiple civilian federal agencies. The directive revealed that while thousands of F5 systems were in use, there was significant uncertainty about their location due to gaps in federal asset inventory capabilities, particularly for internet-facing edge devices like F5 BIG-IP load balancers. As a result, agencies had to scramble to manually identify and secure affected systems, highlighting the operational impact of incomplete visibility and asset management. The incident underscores the growing risks associated with network edge devices, which have become prime targets for sophisticated attackers exploiting gaps outside traditional IT inventories. As cloud adoption and edge architectures proliferate, ensuring asset visibility and securing non-traditional endpoints have become urgent priorities for government and private sector organizations alike, as attackers increasingly exploit these visibility gaps.
8 months ago
Kill Chain
China-Linked ToolShell SharePoint Attacks Hit Four Continents in 2025
In 2025, a coordinated cyber-espionage campaign attributed to Chinese-state actors targeted organizations across government, academic, telecommunications, and finance sectors by exploiting the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint. Attackers gained initial access through unpatched SharePoint deployments, enabling lateral movement, exfiltration of sensitive data, and persistent covert access. Victims spanned four continents, highlighting the campaign's scale and impact on critical information flows and business operations. The attackers' use of encrypted communications and sophisticated toolsets complicated detection and eradication efforts, leading to material operational and reputational risks for affected entities. This incident underscores a broader trend of supply chain and platform vulnerabilities being weaponized by advanced, nation-state groups. With the rapid disclosure of exploits and a proliferation of similar techniques, patch management and visibility into east-west traffic remain urgent enterprise priorities.
8 months ago
Kill Chain
MuddyWater's 2025 Global Espionage Campaign Targets 100+ Organizations
In late 2025, the Iranian nation-state threat group known as MuddyWater launched a sophisticated espionage campaign targeting over 100 organizations across the Middle East and North Africa (MENA) region. Leveraging a compromised email account as an entry point, the attackers distributed a custom backdoor named Phoenix to high-value government entities, enabling covert infiltration and sustained intelligence gathering. The operation involved methods designed to evade detection and facilitate ongoing access to sensitive data, underscoring the persistent risk posed by nation-state actors. This campaign highlights a continued escalation in advanced cyberespionage activities targeting governmental and critical infrastructure sectors. With threat actors increasingly exploiting social engineering and custom malware, organizations face intensified pressure to strengthen defenses and adhere to evolving security frameworks.
8 months ago
Kill Chain
Chinese APT Group Rapidly Exploits SharePoint Vulnerability in Major 2025 Telecom Breach
In July 2025, Chinese state-affiliated threat actors exploited the recently patched ToolShell vulnerability in Microsoft SharePoint to breach a major telecommunications company in the Middle East. This advanced persistent threat (APT) group swiftly leveraged the disclosed flaw to gain unauthorized access, rapidly launching attacks just weeks after the patch was released. Their campaign extended to government bodies in Africa and South America, as well as academic and technology institutions in the US, highlighting a rapid weaponization of public vulnerabilities. The attackers used sophisticated techniques for lateral movement, data exfiltration, and persistence within the affected networks, likely resulting in compromise of sensitive communications, operational disruption, and potential regulatory exposure for the victims. This incident demonstrates how APT actors quickly adapt to disclosed vulnerabilities and underscores the urgency for organizations to accelerate patching cycles and bolster east-west security controls. The event marks an increasing trend of state-sponsored groups targeting hybrid cloud environments and critical infrastructure via freshly disclosed exploits.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports