The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova
In June 2024, researchers revealed that REST Media, an online outlet targeting Moldova’s elections, is actually a front for the Russian disinformation group Rybar. Rybar, already sanctioned by the EU and wanted by the U.S., used REST Media to amplify anti-EU narratives and undermine the Party of Action and Solidarity, leveraging platforms like TikTok, Telegram, and X to achieve millions of views. Technical forensics linked REST Media’s online infrastructure and production workflows directly to Rybar, demonstrating operational overlap and deliberate efforts at obfuscation. The campaign exploited Moldova's fragmented media regulations, using cloaked registration accounts, privacy services, and anonymized hosting, making attribution complex while rapidly expanding its influence ahead of key elections. This incident exemplifies the growing sophistication of state-sponsored information operations, exploiting both technology and weak local controls. As hybrid threats, including coordinated disinformation and cyberattacks, continue to undermine democratic processes across Eastern Europe, organizations and governments face mounting regulatory, reputational, and operational risks from similar campaigns.
8 months ago
Kill Chain
Arrest of UK Teen Halts Core Scattered Spider Ransomware Operations in 2024
In June 2024, UK authorities arrested Thalha Jubair, a 19-year-old national identified as a core operator within the Scattered Spider ransomware group. Jubair, linked to at least 120 cyberattacks and $89.5 million in cryptocurrency transactions, was accused of orchestrating sophisticated extortion campaigns against major organizations, including the 2024 attack on the U.S. federal court system and Transport for London. The investigation utilized blockchain analysis and traced ransom payments that funded essential purchases, directly implicating Jubair despite advanced operational security measures such as VPNs and amnesiatic operating systems. This landmark arrest exposes the evolution and persistence of decentralized ransomware groups, highlighting challenges in attribution and apprehension. The incident demonstrates the growing use of identity obfuscation tools and cryptocurrencies among cybercriminals, underscoring the urgent need for robust detection, response, and regulatory frameworks across industries.
8 months ago
Kill Chain
US Secret Service Seizes Massive SIM Server Network Threatening Government Officials
In September 2025, the U.S. Secret Service announced it had dismantled a large-scale illicit telecommunications infrastructure across the New York tri-state area, seizing over 300 SIM servers and 100,000 SIM cards. These devices, co-located at multiple sites, were used by unknown malicious actors to facilitate threats against U.S. government officials, particularly near the United Nations. Investigators discovered that this network enabled covert communications and potentially enabled bypasses of monitoring controls, raising national security concerns. The takedown required coordinated federal action to secure the assets, neutralize the risk, and support ongoing intelligence operations. This incident highlights the ongoing evolution and physical sophistication of threat actor infrastructure, especially targeting high-profile government personnel. The scale and automation facilitated by such hardware underline the growing intersection of physical and cyber threats and serve as a wake-up call for risk teams facing advanced, hybrid attack models.
8 months ago
Kill Chain
Iranian APT Extends Reach: 2024 Nimbus Manticore Malware Hits Europe
In early 2024, a sophisticated Iran-backed threat group known as “Nimbus Manticore” launched targeted cyberattacks against several European organizations using enhanced variants of its custom malware. The attackers leveraged spear-phishing emails embedding malicious attachments as their initial access vector, resulting in the deployment of advanced payloads that enabled persistent access and lateral movement within affected networks. Once inside, the group utilized encrypted communication channels and east-west movement to exfiltrate sensitive data and evade common detection mechanisms. The incident has caused operational disruptions and triggered regulatory notifications in multiple EU member states. This breach illustrates a strategic expansion of Iran-linked APT operations beyond their traditional region, pointing to escalating risks for European enterprises. The exposed techniques underscore the necessity for advanced detection, robust internal segmentation, and regulatory alignment as attackers increasingly shift tactics to bypass perimeter controls.
8 months ago
Kill Chain
SANS Honeypot 2024: SYN Flood Distraction Amplifies Network Reconnaissance Threat
Between March 31 and April 20, 2024, the SANS Internet Storm Center's honeypot experienced a persistent barrage of over 2.3 million TCP SYN packets in three distinct waves, mimicking a distributed denial of service (DDoS) campaign. Traffic originated from thousands of hosts—mostly within Bangladeshi and Iraqi ISPs—leveraging spoofed and potentially compromised IPs to generate low-rate, highly patterned SYN floods targeting port 443. Despite the scale, the attack's volume and packet rates were insufficient to disrupt modern services and instead appeared to serve as a diversionary tactic. This incident highlights emerging trends in network reconnaissance and distraction techniques, where attackers intentionally generate noisy traffic to mislead analysts and mask parallel or future activities. As SYN flood patterns evolve and attackers increasingly use crafted packets and IP spoofing, traditional DDoS detection and response strategies must adapt to avoid misallocation of resources or missing stealthier threats.
8 months ago
Kill Chain
Secret Service Disrupts Extensive NYC Telecom Threat Targeting UN Assembly
In September 2025, the U.S. Secret Service disrupted a sophisticated illicit telecom infrastructure in the New York City area, uncovering more than 300 servers and over 100,000 SIM cards located near the United Nations General Assembly. The operation identified a network enabling encrypted, anonymous communications allegedly used by foreign actors, criminals, and potentially threat groups to coordinate activities and transmit assassination threats. Investigators warned that the scale of the system posed significant risk, including the theoretical ability to disable cellular networks and disrupt critical communications during high-security events. This incident highlights rising risks of criminal and nation-state actors leveraging physical telecom infrastructure to subvert detection, illustrating how sophisticated SIM farms and server farms can facilitate large-scale anonymity and attacks. The operation underscores heightened scrutiny on telecom supply chain security during high-profile events and the need for robust infrastructure monitoring.
8 months ago
Kill Chain
AT&T 2023: How Salt Typhoon Changed the APT Playbook
In 2023, the telecommunications giant AT&T was targeted by the advanced persistent threat group Salt Typhoon, which launched a sophisticated campaign exploiting unconventional vulnerabilities. Unlike conventional attacks, Salt Typhoon focused on endpoints lacking robust detection and response (EDR), hunted for network blind spots with minimal logging, and engaged in 'living off the land' attacks—leveraging legitimate administrative tools to evade detection and persist inside networks. This multi-pronged methodology enabled deep network infiltration before discovery, ultimately jeopardizing sensitive data and service availability across AT&T’s infrastructure. Following the breach, the company reported the threat group was successfully evicted from its systems. This incident has set a precedent, with numerous threat actors now adopting Salt Typhoon’s tactics to bypass traditional security controls. The breach highlights an urgent need for organizations to enhance monitoring, bolster endpoint visibility across all platforms, and adapt defenses for evolving attacker methodologies in critical infrastructure sectors.
8 months ago
Kill Chain
Teen Hackers Arrested for Scattered Spider Cyber Attack on TfL in 2024
In August 2024, Transport for London (TfL) experienced a cyber attack attributed to teen members of the Scattered Spider hacking group, known for leveraging social engineering and identity compromise. Attackers allegedly gained access to internal systems, disrupting service operations and putting critical transport and passenger information at risk. U.K. authorities arrested Thalha Jubair (19) and Owen Flowers (18) in September 2024 for their involvement, underlining the rapid evolution of cybercriminal tactics and the challenge of securing public infrastructure. This incident is a prime example of increasingly sophisticated attacks leveraging compromised credentials and insider tactics, even involving younger threat actors. It highlights both the threat to public services and the urgency for robust Zero Trust controls amid a landscape of rising identity-driven intrusions.
8 months ago
Kill Chain
Russian APTs Gamaredon and Turla Join Forces: Kazuar Backdoor Attack on Ukraine (2025)
In February 2025, cybersecurity researchers observed a coordinated attack on Ukrainian organizations involving collaboration between Russian APT groups Gamaredon and Turla. Utilizing tools such as PteroGraphin and PteroOdd, Gamaredon gained initial access and facilitated the deployment of Turla’s advanced Kazuar backdoor onto a compromised Ukrainian endpoint. This multi-stage intrusion enabled persistent remote access and potential data exfiltration, underscoring a notable escalation in Russian state-sponsored cyber tactics, as adversaries actively combined resources and malware capabilities to maximize operational impact. The attack targeted sensitive Ukrainian infrastructure, heightening concerns over the defense of critical systems. This incident exemplifies the increasing integration and sophistication among nation-state threat actors, specifically through sharing or chaining malware tools for greater effect. The cooperative tactics and advanced persistence mechanisms highlight the evolving threat landscape and emphasize the urgency for enhanced east-west traffic security, zero trust segmentation, and anomaly detection across critical sectors.
8 months ago
Kill Chain
SystemBC-Powered REM Proxy Botnet: 1,500 VPSs Compromised Daily in 2025
In mid-2025, cybersecurity researchers from Lumen's Black Lotus Labs identified a large-scale proxy botnet operation named REM Proxy, powered primarily by the SystemBC malware. Attackers leveraged SystemBC to compromise over 1,500 virtual private servers (VPS) daily, utilizing them to fuel a criminal proxy-as-a-service spanning 80 command-and-control (C2) servers. The network enabled threat actors to anonymize malicious activities and included access to approximately 20,000 vulnerable Mikrotik routers and additional open proxies. This infrastructure facilitated evasion, lateral movement, and widespread malicious activity with significant security implications for targeted and intermediary organizations. This incident underscores the ongoing evolution of proxy botnets and malware-as-a-service ecosystems, which pose critical risks for organizations across various sectors. As the boundaries between cybercrime infrastructure and legitimate cloud assets blur, defenders must place renewed emphasis on advanced threat detection, network segmentation, and zero trust principles to mitigate similar emergent threats.
8 months ago
Kill Chain
UNC1549: Iranian Cyber Espionage Breaches 11 European Telecoms Using LinkedIn Lures
In mid-2025, an Iran-affiliated cyber espionage group tracked as UNC1549 executed a coordinated attack targeting 11 European telecommunications firms. Using LinkedIn job recruitment lures and the custom MINIBIKE malware, the attackers successfully infiltrated 34 devices within these organizations, gaining persistent access to sensitive internal systems. The campaign, discovered by Swiss cybersecurity company PRODAFT, leveraged sophisticated social engineering alongside stealthy lateral movement, indicating considerable operational capability and intent to harvest confidential information potentially valuable for nation-state interests. This incident underscores a rising trend of strategic supply chain and telecom attacks using spear phishing and novel malware, highlighting the importance of strong east-west traffic controls and threat detection. It also reflects growing geopolitical tensions fueling state-sponsored cyber campaigns against critical infrastructure in Europe.
8 months ago
Kill Chain
Charming Kitten’s 2024 Campaign: Telecoms and Satellite Companies Breached by Iranian APT
In early 2024, an Iranian state-linked advanced persistent threat (APT) group known as "Subtle Snail," associated with Charming Kitten, executed a series of highly customized cyberattacks targeting 11 global telecommunications, satellite operators, and aerospace manufacturers. The attackers, leveraging detailed reconnaissance via LinkedIn and other platforms, impersonated recruiters from major aerospace firms to lure high-value IT and engineering personnel into sophisticated spearphishing campaigns. Victims were tricked into downloading a modular backdoor malware dubbed 'MiniBike,' which allowed the group to evade detection through unique variants for each target. The breaches resulted in the theft of sensitive documents, credentials, personally identifiable information, proprietary business data, and call data records, posing significant risks to corporate and national security across regions from the Middle East to North America. This attack highlights sharply increased innovation in APT social engineering tactics and malware obfuscation. It underscores the need for organizations to bolster identity verification, east-west segmentation, and behavioral anomaly detection, especially as state-aligned threat actors refine tools for targeting critical infrastructure and global communications.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports