Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Telecommunications

Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.

1044 threat reports
Page 79 of 87
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Telecommunications Threat Reports

Showing 937–948 / 1044 reports
Blue Angel Suite Faces 2024 Webctrl.cgi OS Command Injection Attempts
Telecommunications10 months ago

Blue Angel Suite Faces 2024 Webctrl.cgi OS Command Injection Attempts

In October 2024, threat actors attempted to exploit an OS command injection vulnerability targeting the Blue Angel Software Suite's web interface on embedded Linux devices. Attackers issued crafted POST requests to the '/cgi-bin/webctrl.cgi' endpoint, aiming to inject arbitrary shell commands via the 'ipaddress' parameter. These attacks, detected by honeypots, mirror previous vulnerabilities such as CVE-2025-34033, which allows authenticated attackers to execute code as root by manipulating input passed to system commands like 'ping'. The incidents highlight persistent risks across IoT and broadband equipment, potentially providing attackers with full system control. This incident underscores a growing trend in targeting network appliances and IoT infrastructure for initial access and lateral movement. As regulatory attention increases and attackers shift toward exploiting device misconfigurations and weak input validation, robust segmentation and up-to-date patch management are even more critical.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Scattered LAPSUS$ Hunters Target Encrypted Traffic in 2024 Hybrid Cloud Breach
Financial Services10 months ago

Scattered LAPSUS$ Hunters Target Encrypted Traffic in 2024 Hybrid Cloud Breach

In early 2024, the cybercrime group Scattered LAPSUS$ Hunters was observed launching a series of attacks targeting high-performance encrypted traffic between enterprise environments. Leveraging advanced tactics such as packet sniffing and lateral movement across hybrid and multicloud networks, the group exploited weak internal segmentation and gaps in east-west traffic controls. The attackers circumvented some organizations’ use of line-rate encryption by targeting less-protected internal flows and using sophisticated threat detection evasion techniques. Operational impacts included service disruptions, potential data exfiltration, and compromised cloud environments. This incident underscores the evolution of cybercrime actors as they adopt more advanced methods to breach environments assumed to be protected by conventional encryption or traditional network segmentation. The trend highlights growing risks for enterprises relying on hybrid and multicloud infrastructure, and illustrates the urgent need for zero trust approaches and enhanced east-west traffic security.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Stealit Malware Abuses Node.js SEA in 2025 Infostealer Supply Chain Campaign
Computer Games10 months ago

Stealit Malware Abuses Node.js SEA in 2025 Infostealer Supply Chain Campaign

In October 2025, cybersecurity experts uncovered an active malware campaign involving Stealit, an advanced infostealer that exploits Node.js' Single Executable Application (SEA) feature to deliver its malicious payloads. The campaign also utilized the Electron framework and disguised its distribution through popular but trojanized game and VPN installers. Once executed, Stealit exfiltrated sensitive data from victims—such as credentials, browser information, and cryptocurrency wallets—using stealthy techniques while evading detection. The attack led to significant risks of account compromise and potential financial loss, particularly for organizations relying on affected software supply chains. This incident highlights a broader trend of attackers weaponizing modern development frameworks (like Node.js and Electron) to bypass traditional endpoint defenses. The use of legitimate-looking installers and supply chain manipulation signal an evolution in infostealer delivery tactics, making vigilance and advanced network segmentation crucial for organizational resilience.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
RondoDox Botnet 2025: Mass Exploitation Sheds Light on Multi-Vendor Security Gaps
Telecommunications10 months ago

RondoDox Botnet 2025: Mass Exploitation Sheds Light on Multi-Vendor Security Gaps

In October 2025, security researchers uncovered a major campaign involving the RondoDox botnet, which rapidly weaponized over 50 vulnerabilities across more than 30 device vendors. The attack leveraged an "exploit shotgun" approach, targeting a vast range of internet-facing infrastructure including routers, DVRs, NVRs, CCTV systems, and web servers. Threat actors behind RondoDox employed automated scanning and exploitation, compromising vulnerable devices at scale for botnet expansion, distributed denial-of-service (DDoS) attacks, and potential further malicious activity. The operational impact included service degradation, widespread risk of breach propagation, and the exposure of inadequately secured assets across diverse environments. This incident highlights a surging trend in large-scale, opportunistic exploitation—where attackers rapidly integrate newly disclosed vulnerabilities into botnet tools. The scale and automation reflect the growing sophistication of threat actors, amplifying risks for businesses lagging in patch management and segmentation. Regulatory scrutiny is intensifying as such campaigns threaten critical infrastructure and data security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
2025 Mega-Breach: WhatsApp Worm & Oracle 0-Day Power Ransomware Cartel Campaign
Financial Services10 months ago

2025 Mega-Breach: WhatsApp Worm & Oracle 0-Day Power Ransomware Cartel Campaign

In October 2025, a sophisticated international cybercriminal cartel launched a coordinated multi-vector campaign targeting organizations worldwide. The attackers leveraged a newly discovered zero-day vulnerability in Oracle middleware, chaining it with several critical CVEs and a rapidly spreading WhatsApp worm. Lateral movement was facilitated via unprotected east-west traffic and credential theft, allowing rapid compromise of hybrid cloud environments and on-premises resources. The impact included ransomware deployment, data exfiltration, and significant operational disruptions across sectors such as finance, healthcare, and technology. This incident highlights the unsettling trend of threat actors collaboratively exploiting multiple weaknesses—including unpatched systems, misconfigurations, and trusted collaboration tools—to bypass traditional defenses. The convergence of wormable malware, supply chain vulnerabilities, and ransomware-as-a-service underscores the necessity for adaptive security and real-time threat detection.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ICTBroadcast RCE Vulnerability: Hackers Gain Remote Shell Access via Cookie Exploit in 2025
Telecommunications10 months ago

ICTBroadcast RCE Vulnerability: Hackers Gain Remote Shell Access via Cookie Exploit in 2025

In October 2025, a critical remote code execution vulnerability (CVE-2025-2611, CVSS 9.3) in ICTBroadcast's autodialer platform was actively exploited by threat actors. By leveraging improper input validation in the application's session cookie handler, attackers achieved unauthenticated remote shell access to internet-exposed servers. This exploit enabled malicious actors to execute arbitrary system commands, potentially compromising sensitive data and business operations for organizations using ICTBroadcast. The incident required immediate patching and forensic investigation to contain the breach and restore normal operations. This breach highlights the persistent risk posed by zero-day vulnerabilities in widely used communications software, especially as remote access vector attacks surge. It underscores the strategic shift among attackers toward supply chain and software-specific exploits, which remain difficult to rapidly mitigate across diverse deployment environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
F5 Breach 2025: Nation-State Hackers Steal BIG-IP Source Code in Supply-Chain Attack
Financial Services10 months ago

F5 Breach 2025: Nation-State Hackers Steal BIG-IP Source Code in Supply-Chain Attack

In October 2025, F5, a leading U.S. cybersecurity vendor, reported a significant breach attributed to a sophisticated nation-state threat actor. Attackers infiltrated F5's internal systems, gaining persistent access and exfiltrating files containing proprietary BIG-IP source code as well as details on undisclosed vulnerabilities. The breach underscores advanced adversary tactics, likely leveraging supply-chain vectors or unpatched entry points, with the attackers remaining undetected for an extended period. The exposure of source code and sensitive vulnerability information has significant security and operational implications for F5 customers and the wider ecosystem. This incident illustrates an escalating trend of nation-state-backed attacks targeting critical infrastructure vendors and supply chains. The F5 breach spotlights the urgent need for vigilant monitoring, robust threat detection, and transparent vulnerability management as attackers increasingly focus on extracting valuable code and intelligence from IT suppliers.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Chinese APT 'Jewelbug' Compromises Russian IT Provider in Stealthy 2025 Attack
Information Technology/IT10 months ago

Chinese APT 'Jewelbug' Compromises Russian IT Provider in Stealthy 2025 Attack

In early 2025, the Chinese state-linked threat group known as 'Jewelbug' stealthily infiltrated a prominent Russian IT service provider over a five-month period, according to findings from Symantec. The attackers gained initial access in January, likely leveraging supply chain or credential compromise vectors, and subsequently maintained persistent, undetected presence until May. Jewelbug is known for sophisticated tactics, including advanced lateral movement, encrypted traffic, and covert exfiltration. As a result, sensitive data and core IT systems within the provider’s infrastructure were at risk, potentially impacting downstream Russian clients who relied on its managed services. This incident highlights the expanding global reach of advanced persistent threats (APTs), with Jewelbug moving beyond historical targets in Southeast Asia and South America to now conduct espionage in Russia. The breach demonstrates increasing sophistication in supply chain and east-west attack techniques, underscoring urgent need for robust lateral movement prevention, segmentation, and cloud visibility controls.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Operation Zero Disco: APTs Weaponize Cisco SNMP Flaw to Deploy Linux Rootkits
Telecommunications10 months ago

Operation Zero Disco: APTs Weaponize Cisco SNMP Flaw to Deploy Linux Rootkits

In early October 2025, security researchers uncovered Operation Zero Disco, a targeted cyber campaign leveraging a stack overflow vulnerability (CVE-2025-20352) in Cisco IOS and IOS XE software. Advanced persistent threat (APT) actors weaponized this SNMP flaw to access legacy Cisco networking equipment, deploying covert Linux rootkits and securing long-term persistence on compromised devices. The exploitation enabled attackers to bypass standard defenses, facilitate lateral movement, and maintain undetected access to sensitive east-west network traffic, significantly increasing risk for organizations relying on outdated infrastructure. This incident highlights a growing trend of sophisticated actors exploiting unpatched or unsupported networking systems to achieve deep infrastructure compromise. With the resurgence of supply chain and infrastructure-based attacks, persistent network vulnerabilities demand heightened vigilance, rapid patch adoption, and robust segmentation. Industry-wide, there is mounting urgency to secure critical areas exposed by legacy systems and evolving attacker tactics.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Critical Command Injection Flaw Found in TP-Link Omada Gateways (2024)
Information Technology/IT10 months ago

Critical Command Injection Flaw Found in TP-Link Omada Gateways (2024)

In June 2024, TP-Link disclosed a critical security vulnerability (CVE-2024-5035) affecting several Omada gateway models. The flaw is a pre-authentication operating system command injection that could allow remote, unauthenticated attackers to execute arbitrary commands on vulnerable devices, compromising the integrity and availability of network infrastructure. TP-Link quickly released firmware patches, urging customers to update immediately. This exposure heightened the risk of unauthorized access to internal networks, potentially leading to data breaches, lateral movement, or infrastructure disruption for organizations reliant on impacted Omada devices. The incident underscores an ongoing trend of targeting network infrastructure via supply chain or firmware vulnerabilities, which have become increasingly prevalent as attackers seek to exploit core networking hardware. This highlights the need for vigilant patch management and segmentation in defense strategies, as well as resilience against emerging firmware and gateway attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Europol Busts Global SIM Farm Fueling Industrial-Scale Fake Accounts and Cybercrime
Telecommunications10 months ago

Europol Busts Global SIM Farm Fueling Industrial-Scale Fake Accounts and Cybercrime

In October 2025, Europol led Operation SIMCARTEL to dismantle a sophisticated cybercrime-as-a-service (CaaS) organization running an extensive SIM farm network. This criminal service provisioned more than 49 million SIM cards to cybercriminals worldwide, enabling the rapid creation and management of fake online accounts. Threat actors leveraged the infrastructure for phishing campaigns, investment fraud, impersonation, and large-scale social engineering schemes, causing substantial financial and reputational harm to both individuals and businesses. The coordinated law enforcement operation involved 26 property searches, resulted in seven arrests, and the seizure of equipment and digital assets tied to the illicit platform. This incident highlights the growing industrialization of cybercrime, where turnkey services significantly lower the barrier to entry and accelerate threat actor operations. Law enforcement and the security industry face increasing challenges as cybercriminals exploit scalable CaaS platforms, requiring organizations to modernize their defenses and policy enforcement.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
NSA’s Multi-Tool Cyber Assault on Beijing’s National Time Service Center: Lessons for Critical Infrastructure
Government Administration10 months ago

NSA’s Multi-Tool Cyber Assault on Beijing’s National Time Service Center: Lessons for Critical Infrastructure

In October 2025, China's Ministry of State Security (MSS) accused the U.S. National Security Agency (NSA) of orchestrating a sophisticated, multi-stage cyberattack against the National Time Service Center (NTSC) in Beijing. The MSS claims that the NSA deployed at least 42 distinct cyber tools to penetrate critical national infrastructure, leveraging advanced techniques such as encrypted and east-west traffic manipulation, zero trust segmentation circumvention, and covert remote access. The compromise included strategic lateral movement and evasion of detection, reportedly leaving a significant impact on the operational integrity of NTSC, which serves as a reference point for the nation’s official timekeeping and scientific endeavors. This incident marks an escalation in cyber power projection between nation-states and spotlights the increasing use of multi-tool modular attack frameworks by advanced persistent threats (APTs). The breach underscores the urgency for critical infrastructure operators worldwide to reevaluate network segmentation, encrypted communications, and visibility gaps in light of evolving nation-state tactics.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports