The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Scattered Lapsus$ Hunters: Hacking Groups Go Dark, But Risks Remain
In early 2024, the notorious Scattered Spider and Lapsus$ cybercriminal groups announced they were disbanding and ending their hacking campaigns, raising hopes of a reprieve from their disruptive cyberattacks. However, security researchers observed ongoing activity linked to these groups, including continued phishing, extortion, and data theft campaigns, suggesting the announcements may have been a smokescreen aimed at evading law enforcement scrutiny. The groups are known for high-profile intrusions into enterprise and technology organizations, frequently exploiting identity-based attacks and lateral movement to access sensitive data and systems, resulting in operational disruptions and significant data breaches. This incident highlights the persistent threat posed by organized cybercriminal groups that leverage identity-centric attack vectors and sophisticated social engineering, underscoring the necessity for robust segmentation, effective threat detection, and advanced access controls on corporate networks. Amid evolving attacker tactics and regulatory demands, organizations must prioritize zero trust strategies to defend against similar threats.
8 months ago
Kill Chain
Dshield Honeypot Exposes IoT Botnet Worm Using Default Credentials in 2024
In September 2024, analysis of a Dshield honeypot deployed on AWS revealed a campaign targeting internet-exposed systems with IoT-focused botnet malware. Attackers attempted to upload shell scripts and architecture-specific binaries using known default credentials and exploited weak or unchanged passwords, particularly on Raspberry Pi and IoT devices. The payloads, often delivered over unencrypted FTP and SSH methods, led to the installation of UNIX_PIMINE.A malware, which achieves persistence, removes competing malware, and connects to IRC-based command-and-control channels, highlighting an active botnet spreading via automated credential stuffing and remote file uploads. This incident underscores a persistent threat: legacy systems and embedded devices with default or weak credentials remain a prime target for botnets. With continued rises in IoT deployments and exposed services, automated malware propagation using basic scripts and known default logins is resurging, driving renewed regulatory scrutiny and best-practice emphasis for credential management and east-west traffic security.
8 months ago
Kill Chain
Apple Warns French Users of Fourth Major Spyware Campaign in 2025
In September 2025, Apple issued alerts to French users after identifying a sophisticated spyware campaign targeting their devices, marking the fourth such warning within the year. According to CERT-FR, the attack exploited vulnerabilities in Apple’s ecosystem—potentially via malicious links or zero-day exploits linked to iCloud accounts—allowing unauthorized surveillance and data exfiltration. The incident highlights persistent targeting of high-profile users in France, including journalists, activists, and officials, by advanced threat actors suspected to have nation-state-level capabilities. Impact includes compromised device privacy, risk of sensitive information leaks, and possible reputational harm to affected organizations. This incident underscores a worrying trend of recurrent, targeted campaigns using advanced spyware in Western Europe. The persistence of these attacks illustrates evolving threat actor sophistication and growing urgency for companies to strengthen device and network-level security, particularly as regulatory and public scrutiny intensifies.
8 months ago
Kill Chain
Samsung’s 2025 Critical Mobile Zero-Day: CVE-2025-21043 Exploited in the Wild
In September 2025, Samsung urgently patched a critical zero-day vulnerability (CVE-2025-21043) impacting its Android devices. The flaw, an out-of-bounds write in the libimagecodec.quram.so library, enabled remote attackers to execute arbitrary code on affected devices. This zero-day had been actively exploited in real-world attacks prior to disclosure and patch release, exposing millions of Galaxy smartphone users to the risk of compromise and potential data theft. Samsung responded by releasing its monthly security updates addressing the vulnerability before widespread exploitation could escalate. This incident underscores the persistent targeting of mobile platforms using advanced zero-day techniques, raising concerns for enterprises reliant on mobile endpoints. As threat actors innovate and focus on mobile ecosystems, rapid patch cycles and vigilant threat monitoring remain essential to protect against evolving exploitation methods.
8 months ago
Kill Chain
Mustang Panda’s SnakeDisk USB Worm Targets Thailand: Advanced APT Breach Breakdown
In September 2025, cybersecurity analysts revealed that the China-aligned APT group Mustang Panda leveraged a novel USB worm dubbed SnakeDisk to target networks with Thailand-based IP addresses. The malware was specifically designed to execute only on devices with these geolocations, enabling highly targeted delivery of the TONESHELL loader and the Yokai backdoor. Attackers gained initial access through infected USB drives, allowing for stealthy lateral movement and installation of persistent remote access tools, posing risks to government, defense, and commercial operations in Thailand. The campaign’s use of an undocumented worm, encrypted command channels, and evasive tactics complicated detection and response efforts for affected organizations. This highly targeted operation demonstrates the continuous evolution of advanced persistent threat techniques, with regional targeting and removable media attacks making a significant comeback. The incident underscores the urgent need for robust east-west traffic controls, endpoint security, and focused detection in the face of increasingly sophisticated nation-state cyber campaigns.
8 months ago
Kill Chain
Chinese Hackers Impersonate US Congressman in Sophisticated 2024 Spear-Phishing Campaign
In early 2024, Chinese state-sponsored hackers allegedly orchestrated spear-phishing attacks by impersonating Michigan Congressman John Moolenaar. The threat actors crafted convincing emails designed to gain the trust of recipients, targeting government and private sector individuals. Using tailored messaging, the adversaries sought to trick victims into engaging with malicious links or attachments, potentially enabling credential theft, malware installation, or further lateral movement within targeted organizations. The incident demonstrates the growing sophistication and persistence of social engineering tactics deployed by advanced persistent threat (APT) groups with strategic intelligence-gathering objectives. This attack reflects a broader rise in politically themed spear-phishing campaigns leveraging impersonation of public officials to increase credibility. Organizations must remain alert as nation-state groups continually evolve their tactics, conducting highly targeted attacks that bypass technical safeguards and prey on human vulnerabilities.
8 months ago
Kill Chain
Apple CarPlay RCE Exploit: Most Cars Remain Vulnerable in 2024
In early 2024, security researchers disclosed a serious remote code execution (RCE) vulnerability affecting Apple CarPlay integrations in numerous vehicles. The exploit enables attackers to send maliciously crafted data via the CarPlay interface, potentially gaining control over in-vehicle systems or accessing sensitive driver data. Despite a fix being available, the diversity of manufacturers and slow fleet-wide software updates have left most vehicles exposed, raising concerns about the integrity and safety of modern vehicular systems. Automakers’ challenges in distributing timely patches have amplified risks for consumers and enterprises relying on smart car features. This incident underscores the growing cybersecurity challenges presented by increasingly connected and software-driven vehicles. With threat actors continually probing automotive systems and regulatory scrutiny on the rise, failure to promptly remediate such vulnerabilities could result in regulatory penalties, reputational damage, or physical safety incidents.
8 months ago
Kill Chain
Q2 2025 Mobile Malware Surge: Mamont and Triada Lead Sophisticated Attacks
In Q2 2025, Kaspersky detected a substantial wave of mobile malware impacting Android and iOS, blocking 10.71 million attacks involving Trojans, adware, and unwanted applications. The campaign was notable for a surge in banking Trojans—primarily the Mamont family—pre-installed backdoors like Triada, and novel threats such as SparkKitty, which targets crypto wallet recovery codes via image theft. Attackers leveraged fake app stores, porn-viewing apps that secretly built DDoS botnets, and deceptive VPNs that intercepted OTP codes through notification hijacking. Regionalized attacks exploited localized malware families to increase efficacy and evade global threat visibility, raising risks for financial and privacy exposure worldwide. This incident highlights a persistent trend of increasingly sophisticated mobile threats focused on financial theft and data exfiltration. The continued evolution of malware TTPs, including use of pre-installed Trojans, modular SDK-based payloads, and cross-platform attack vectors, emphasizes the urgent need for advanced endpoint protection and vigilant detection routines in the mobile security domain.
8 months ago
Kill Chain
How Stark Industries Evaded EU Sanctions: The Persistence of Bulletproof Hosts in 2025
In May 2025, Stark Industries Solutions Ltd.—a notorious bulletproof hosting provider closely linked to Russian cyberattacks and disinformation—was placed under EU financial sanctions, alongside its Moldova-based conduits and owners. Despite these efforts, Stark rapidly rebranded as the[.]hosting, shifted its assets to new legal entities (including Dutch-based WorkTitans BV and Moldova's PQ Hosting Plus S.R.L.), and maintained operational infrastructure with covert support from providers like MIRhosting. Investigations revealed continued operations and asset management by the original threat actors, rendering the sanctions ineffective and allowing persistent delivery of DDoS campaigns, Russian-language proxy services, and malware with minimal disruption. This incident highlights the sophisticated resilience and adaptability of bulletproof hosting operations, as well as the challenges for regulators attempting to curtail nation-state-aligned cyber infrastructure. Similar evasion techniques—including cross-border asset transfers and complex corporate rebranding—are on the rise, escalating pressure on global cybersecurity, law enforcement, and compliance efforts.
8 months ago
Kill Chain
How Salt Typhoon & Volt Typhoon Forced a U.S. Critical Infrastructure Cybersecurity Rethink
Between 2021 and 2023, advanced Chinese threat actors known as Salt Typhoon and Volt Typhoon conducted highly covert cyber intrusions targeting U.S. telecommunications networks and critical infrastructure sectors. These groups utilized advanced tactics such as "living off the land," abusing legitimate administrative tools, and blending into east-west network traffic, making detection and remediation extremely challenging for defenders. Their primary objectives ranged from long-term espionage and persistent access to prepositioning for potential disruptive attacks in the event of geopolitical conflict. The hacks led federal agencies like the FBI and CISA to revise investigative methods, shifting to assume attackers may already be inside the network and forcing collaboration to uncover subtle anomalies rather than clear indicators. This incident is indicative of a broader industry trend: state-backed actors increasingly focus on stealth, cloud environments, and edge devices, targeting managed service providers and exploiting blind spots in monitoring. Their evolving tactics closely align with growing regulatory and CISO concern for stronger east-west visibility, zero trust controls, and continuous threat hunting across hybrid cloud infrastructure.
8 months ago
Kill Chain
Meta's WhatsApp Security Lapses: Insider Risks and Lessons for Compliance in 2025
In April 2025, Meta (parent company of WhatsApp) faced legal action from a former security manager, Attaullah Baig, who alleged that systemic cybersecurity and privacy failures were ignored within WhatsApp. Baig claimed that a Red Team exercise revealed approximately 1,500 engineers had unrestricted access to sensitive user data, with no audit trails, logging, or adequate operational controls, violating regulatory requirements and a 2020 FTC consent order. Baig raised alarms about deficiencies—such as lack of data inventory, improper data access controls, and insufficient security staffing—which he asserts led to retaliatory actions and his eventual dismissal under the pretense of poor performance. This high-profile lawsuit underscores urgent concerns about insider risk, weak internal security policy enforcement, and regulatory noncompliance in large tech platforms. As regulators increase scrutiny and whistleblowers continue to come forward, enterprises must address internal blind spots and strengthen controls to prevent privilege misuse and data exposure.
8 months ago
Kill Chain
45 New Domains Fuel Salt Typhoon's Stealthy APT Campaign (2024)
In mid-2024, security researchers uncovered that the China-based Advanced Persistent Threat group Salt Typhoon (UNC4841) had deployed 45 new domains and previously undiscovered infrastructure to facilitate persistent, stealthy compromises of targeted organizations. Exploiting their advanced tradecraft, Salt Typhoon gained and maintained long-term access undetected, leveraging encrypted traffic and lateral movement techniques. The attacks primarily targeted sectors with sensitive data and critical infrastructure, amplifying operational and reputational risk for the victims. The campaign demonstrates ongoing actor adaptation and the challenges of detecting covert infrastructure expansion. This incident is especially relevant as organizations face a surge in nation-state actor activity leveraging novel infrastructure and sophisticated evasion methods. The discovery highlights the evolving threat landscape, where increased regulatory pressure and cloud adoption make comprehensive visibility and proactive response capabilities more critical than ever.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports