The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
ICTBroadcast RCE Vulnerability: Hackers Gain Remote Shell Access via Cookie Exploit in 2025
In October 2025, a critical remote code execution vulnerability (CVE-2025-2611, CVSS 9.3) in ICTBroadcast's autodialer platform was actively exploited by threat actors. By leveraging improper input validation in the application's session cookie handler, attackers achieved unauthenticated remote shell access to internet-exposed servers. This exploit enabled malicious actors to execute arbitrary system commands, potentially compromising sensitive data and business operations for organizations using ICTBroadcast. The incident required immediate patching and forensic investigation to contain the breach and restore normal operations. This breach highlights the persistent risk posed by zero-day vulnerabilities in widely used communications software, especially as remote access vector attacks surge. It underscores the strategic shift among attackers toward supply chain and software-specific exploits, which remain difficult to rapidly mitigate across diverse deployment environments.
8 months ago
Kill Chain
F5 Breach 2025: Nation-State Hackers Steal BIG-IP Source Code in Supply-Chain Attack
In October 2025, F5, a leading U.S. cybersecurity vendor, reported a significant breach attributed to a sophisticated nation-state threat actor. Attackers infiltrated F5's internal systems, gaining persistent access and exfiltrating files containing proprietary BIG-IP source code as well as details on undisclosed vulnerabilities. The breach underscores advanced adversary tactics, likely leveraging supply-chain vectors or unpatched entry points, with the attackers remaining undetected for an extended period. The exposure of source code and sensitive vulnerability information has significant security and operational implications for F5 customers and the wider ecosystem. This incident illustrates an escalating trend of nation-state-backed attacks targeting critical infrastructure vendors and supply chains. The F5 breach spotlights the urgent need for vigilant monitoring, robust threat detection, and transparent vulnerability management as attackers increasingly focus on extracting valuable code and intelligence from IT suppliers.
8 months ago
Kill Chain
Chinese APT 'Jewelbug' Compromises Russian IT Provider in Stealthy 2025 Attack
In early 2025, the Chinese state-linked threat group known as 'Jewelbug' stealthily infiltrated a prominent Russian IT service provider over a five-month period, according to findings from Symantec. The attackers gained initial access in January, likely leveraging supply chain or credential compromise vectors, and subsequently maintained persistent, undetected presence until May. Jewelbug is known for sophisticated tactics, including advanced lateral movement, encrypted traffic, and covert exfiltration. As a result, sensitive data and core IT systems within the provider’s infrastructure were at risk, potentially impacting downstream Russian clients who relied on its managed services. This incident highlights the expanding global reach of advanced persistent threats (APTs), with Jewelbug moving beyond historical targets in Southeast Asia and South America to now conduct espionage in Russia. The breach demonstrates increasing sophistication in supply chain and east-west attack techniques, underscoring urgent need for robust lateral movement prevention, segmentation, and cloud visibility controls.
8 months ago
Kill Chain
Operation Zero Disco: APTs Weaponize Cisco SNMP Flaw to Deploy Linux Rootkits
In early October 2025, security researchers uncovered Operation Zero Disco, a targeted cyber campaign leveraging a stack overflow vulnerability (CVE-2025-20352) in Cisco IOS and IOS XE software. Advanced persistent threat (APT) actors weaponized this SNMP flaw to access legacy Cisco networking equipment, deploying covert Linux rootkits and securing long-term persistence on compromised devices. The exploitation enabled attackers to bypass standard defenses, facilitate lateral movement, and maintain undetected access to sensitive east-west network traffic, significantly increasing risk for organizations relying on outdated infrastructure. This incident highlights a growing trend of sophisticated actors exploiting unpatched or unsupported networking systems to achieve deep infrastructure compromise. With the resurgence of supply chain and infrastructure-based attacks, persistent network vulnerabilities demand heightened vigilance, rapid patch adoption, and robust segmentation. Industry-wide, there is mounting urgency to secure critical areas exposed by legacy systems and evolving attacker tactics.
8 months ago
Kill Chain
Critical Command Injection Flaw Found in TP-Link Omada Gateways (2024)
In June 2024, TP-Link disclosed a critical security vulnerability (CVE-2024-5035) affecting several Omada gateway models. The flaw is a pre-authentication operating system command injection that could allow remote, unauthenticated attackers to execute arbitrary commands on vulnerable devices, compromising the integrity and availability of network infrastructure. TP-Link quickly released firmware patches, urging customers to update immediately. This exposure heightened the risk of unauthorized access to internal networks, potentially leading to data breaches, lateral movement, or infrastructure disruption for organizations reliant on impacted Omada devices. The incident underscores an ongoing trend of targeting network infrastructure via supply chain or firmware vulnerabilities, which have become increasingly prevalent as attackers seek to exploit core networking hardware. This highlights the need for vigilant patch management and segmentation in defense strategies, as well as resilience against emerging firmware and gateway attacks.
8 months ago
Kill Chain
Europol Busts Global SIM Farm Fueling Industrial-Scale Fake Accounts and Cybercrime
In October 2025, Europol led Operation SIMCARTEL to dismantle a sophisticated cybercrime-as-a-service (CaaS) organization running an extensive SIM farm network. This criminal service provisioned more than 49 million SIM cards to cybercriminals worldwide, enabling the rapid creation and management of fake online accounts. Threat actors leveraged the infrastructure for phishing campaigns, investment fraud, impersonation, and large-scale social engineering schemes, causing substantial financial and reputational harm to both individuals and businesses. The coordinated law enforcement operation involved 26 property searches, resulted in seven arrests, and the seizure of equipment and digital assets tied to the illicit platform. This incident highlights the growing industrialization of cybercrime, where turnkey services significantly lower the barrier to entry and accelerate threat actor operations. Law enforcement and the security industry face increasing challenges as cybercriminals exploit scalable CaaS platforms, requiring organizations to modernize their defenses and policy enforcement.
8 months ago
Kill Chain
NSA’s Multi-Tool Cyber Assault on Beijing’s National Time Service Center: Lessons for Critical Infrastructure
In October 2025, China's Ministry of State Security (MSS) accused the U.S. National Security Agency (NSA) of orchestrating a sophisticated, multi-stage cyberattack against the National Time Service Center (NTSC) in Beijing. The MSS claims that the NSA deployed at least 42 distinct cyber tools to penetrate critical national infrastructure, leveraging advanced techniques such as encrypted and east-west traffic manipulation, zero trust segmentation circumvention, and covert remote access. The compromise included strategic lateral movement and evasion of detection, reportedly leaving a significant impact on the operational integrity of NTSC, which serves as a reference point for the nation’s official timekeeping and scientific endeavors. This incident marks an escalation in cyber power projection between nation-states and spotlights the increasing use of multi-tool modular attack frameworks by advanced persistent threats (APTs). The breach underscores the urgency for critical infrastructure operators worldwide to reevaluate network segmentation, encrypted communications, and visibility gaps in light of evolving nation-state tactics.
8 months ago
Kill Chain
131 Chrome Extensions Hijack WhatsApp Web: The 2025 Brazilian Spam Campaign
In October 2025, a coordinated cyberattack was uncovered where 131 malicious Chrome browser extensions—clones of a popular WhatsApp Web automation tool—were used to hijack users’ sessions and launch an automated spam campaign targeting Brazilian users. Researchers from security company Socket found that these plugins, sharing an identical codebase and infrastructure, infected over 20,000 users by enticing them to install seemingly legitimate add-ons, enabling attackers to take control of browser sessions, inject spam messages, and exfiltrate private data at scale. The incident underscores the risks associated with browser extension supply chain threats, exposing enterprises and individuals to large-scale account compromise and privacy breaches. This breach is particularly significant as it demonstrates the adaptability and persistence of threat actors in abusing browser supply routes and leveraging rebranded extensions to evade traditional security controls. The campaign’s targeting of WhatsApp Web also signals a shift toward exploiting widely-used communication channels for coordinated spam and fraud, spotlighting the critical need for proactive browser extension vetting and user awareness.
8 months ago
Kill Chain
The F5 2025 Multi-Vector Breach: A Wake-up Call for Hybrid Cloud Defense
In October 2025, F5 Networks experienced a sophisticated multi-vector cyber breach in which attackers gained undetected foothold within its environment for a prolonged period. The adversaries reportedly exploited a combination of Linux rootkits, encrypted traffic evasion, and a new attack method known as Pixnapping to laterally move between internal workloads and exfiltrate sensitive data. Their persistence was enabled by bypassing both east-west and egress security controls, leveraging cloud-native environments and covert remote access tools, before the intrusion was detected. Business operations were disrupted, and F5 initiated incident response and regulatory disclosures. This breach underscores the urgent reality that advanced attackers employ stealthy, multi-stage tactics, exploiting visibility gaps, lateral pathways, and cloud complexity. As such, it highlights the evolving need for proactive threat detection, zero trust segmentation, and continuous monitoring in today’s hybrid enterprise landscapes.
8 months ago
Kill Chain
Salt Typhoon Breaches European Telecom via Citrix Flaw and Snappybee Malware
In July 2025, a major European telecommunications provider suffered a targeted cyber espionage breach attributed to Salt Typhoon (aka Earth Estries), a suspected China-nexus group. Attackers exploited a vulnerability in a Citrix NetScaler Gateway appliance to gain initial access, then deployed the custom Snappybee malware for persistent network infiltration and surveillance. The operation allowed lateral movement across critical systems, putting sensitive customer and infrastructure data at risk. Timely detection by Darktrace helped contain the breach, but the incident highlights the telecom industry's growing exposure to sophisticated APT tactics and advanced malware. This breach exemplifies how state-aligned actors are exploiting enterprise VPN and appliance vulnerabilities for initial access, a recurring trend influencing regulatory scrutiny and CISO priorities. Telecom providers remain high-value targets due to their access to critical national infrastructure and vast troves of sensitive data.
8 months ago
Kill Chain
PolarEdge Botnet Targets Cisco, ASUS, QNAP, Synology Routers in 2025 Operation
In February 2025, security researchers uncovered a sophisticated botnet campaign dubbed PolarEdge, targeting router devices produced by Cisco, ASUS, QNAP, and Synology. The attackers leverage a custom TLS-based ELF implant to compromise home and enterprise routers, enlisting them into an expanding botnet. Initial infection vectors are believed to exploit known and zero-day vulnerabilities in router firmware, granting the threat actors persistent access and control over thousands of devices globally. The current purpose of the PolarEdge botnet remains undetermined, but activity suggests ongoing monitoring, traffic manipulation, and possible lateral movement within affected networks. Organizations with exposed or outdated devices face heightened operational risk, including surveillance, DDoS, and data interception. This incident underscores the growing menace of router-based botnets leveraging encrypted payloads and advanced evasion techniques. With a surge in attacks on network edge hardware and the proliferation of Internet of Things (IoT) devices, organizations must prioritize firmware patching, network segmentation, and comprehensive threat detection to mitigate emerging risks.
8 months ago
Kill Chain
US Court Bars NSO Group from Targeting WhatsApp Users with Spyware
In June 2024, a U.S. federal judge issued a permanent injunction against NSO Group, prohibiting the Israeli spyware developer from targeting WhatsApp users with its surveillance products. The case originated from a 2019 incident in which NSO Group exploited flaws in WhatsApp's messaging platform to compromise user privacy, prompting Meta (WhatsApp's parent company) to launch a protracted legal battle. The court recognized the significant risk posed to Meta's business and user trust, as WhatsApp's core value proposition is secure, end-to-end encrypted communications. The injunction was coupled with a major reduction in damages, from $167.3 million to $4 million, marking a significant legal precedent in the spyware industry. This decision highlights mounting regulatory and legal scrutiny on commercial spyware vendors and underscores the increasing stakes for companies offering encrypted services. The ruling signals judicial awareness of privacy threats from advanced surveillance tools and may embolden similar litigation or policy action worldwide.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports