The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
Critical Ubiquiti Security Flaws Expose Network Infrastructure to Remote Takeover
In August 2026, Ubiquiti released emergency patches for three critical maximum-severity vulnerabilities (CVE-2026-77537, CVE-2026-77550, CVE-2026-77554) affecting UniFi Protect, UniFi OS, and UniFi Talk applications. These flaws allow unauthenticated remote attackers to compromise devices through improper input validation, CRLF injection for authentication bypass, and command injection vulnerabilities. The vulnerabilities require no user interaction and can be exploited with low complexity attacks, potentially impacting over 100,000 Internet-exposed UniFi OS instances tracked by security researchers. This incident highlights the accelerating trend of network infrastructure becoming prime targets for state-sponsored groups and cybercriminals seeking to establish persistent footholds for espionage and botnet operations, following recent FBI disruptions of Russian GRU botnet activities using compromised Ubiquiti devices.
4 weeks ago
Kill Chain
The Snowflake Breach: Why Service Account Security Can't Wait Until October
In 2024, threat actor Connor Moucka and accomplices exploited valid but compromised Snowflake customer credentials to breach over 165 organizations, stealing billions of records including AT&T's wireless customer data. The attackers used years-old, unrotated passwords without multi-factor authentication to access Snowflake environments. Moucka pleaded guilty in August 2024 to computer fraud, wire fraud, and conspiracy charges. In response, Snowflake implemented a phased authentication rollout through 2026, culminating in the complete deprecation of password-based service accounts by October 2026. This incident highlights the growing threat landscape around identity-based attacks and the critical need for robust non-human identity management as organizations increasingly deploy AI agents and automated systems that require programmatic access to cloud platforms.
4 weeks ago
Kill Chain
FBI Disrupts Chinese QTFY Espionage Network: How Advanced Proxy Infrastructure Threatens Critical Systems
In August 2026, the FBI disrupted a sophisticated Chinese state-sponsored cyber espionage operation run by threat actor QTFY/QT/QTCYBER, which provided reconnaissance, proxy management, and operational routing capabilities for attacks on U.S. critical infrastructure. The group, connected to China's Ministry of State Security and employing former People's Liberation Army members, operated QScan reconnaissance platforms and QTRouter obfuscation networks to target NASA, the Federal Reserve, Departments of Energy and Justice, NIH, and the U.S. Senate. Their infrastructure utilized compromised IoT devices and commercial proxy services to create an evasive Operational Relay Box (ORB) network that blended espionage traffic with legitimate consumer proxy traffic. This incident highlights the evolving sophistication of state-sponsored espionage operations that increasingly leverage commercial proxy infrastructure and compromised IoT devices to evade detection, representing a significant escalation in cyber warfare tactics targeting critical national infrastructure.
4 weeks ago
Kill Chain
Iranian APT Nimbus Manticore Deploys Advanced SSH Tunneling and Backdoor Tools
In August 2026, cybersecurity researchers discovered new infrastructure and previously undocumented malware tools used by Nimbus Manticore, an Iranian state-sponsored hacking group linked to the Islamic Revolutionary Guard Corps (IRGC). The threat actor has expanded their arsenal with a TWOSTROKE-like C++ backdoor and an SSH tunneling utility that masquerades as Windows Terminal Server SDK components. Group-IB's analysis revealed extensive infrastructure spanning Europe and the Middle East, indicating an expanded targeting profile beyond their traditional focus on defense, aerospace, and military organizations in the Middle East and United States. This incident highlights the continued evolution of Iranian APT capabilities and their persistent focus on establishing long-term access to critical infrastructure. As nation-state actors increasingly develop sophisticated toolsets and expand their geographic reach, organizations must prioritize comprehensive network visibility and east-west traffic monitoring to detect lateral movement and command-and-control activities.
4 weeks ago
Kill Chain
First Android Malware Targeting Car Head Units Discovered in MoYu Group Campaign
In August 2026, Kaspersky researchers discovered JarService, the first documented Android malware specifically targeting automotive head units. The malware, attributed to the MoYu Group behind the notorious BadBox botnet, infected DoFun-manufactured car head units by exploiting vulnerabilities in the TWCore firmware update system. The multistage downloader spreads through legitimate update functionality and ultimately deploys click-fraud malware and reverse-proxy modules to recruit infected vehicles into a botnet for ad fraud purposes. While the infected infotainment systems pose no direct physical safety risks to drivers, this represents a significant expansion of botnet operations into connected vehicle infrastructure. This incident highlights the growing threat surface as cybercriminals increasingly target IoT and connected vehicle ecosystems. With automotive systems becoming more interconnected and the rise of software-defined vehicles, securing update mechanisms and embedded systems has become critical for preventing botnet recruitment and protecting connected infrastructure from exploitation.
4 weeks ago
Kill Chain
State Actors and Ransomware Groups Converge on Edge Infrastructure: What the Tenable-SentinelOne Analysis Reveals
A joint analysis by Tenable and SentinelOne of 93 CVE-actor attribution pairs revealed that state-sponsored threat actors and cybercriminals independently converge on the same edge infrastructure vulnerabilities across major vendors including F5, Fortinet, Citrix, and Ivanti. The research found that 54% of F5 customer environments have at least one exposed, actively-exploited CVE, while twelve vulnerabilities showed confirmed multi-nexus attribution spanning China, Russia, DPRK, Iran, and ransomware groups. High-priority CVEs paradoxically take 24 days longer to remediate than standard vulnerabilities, creating extended windows of opportunity for attackers targeting VPN gateways, firewalls, and remote access appliances. This convergence highlights the urgent need for organizations to rethink their approach to edge device security as nation-state actors increasingly share attack surfaces with cybercriminals, making traditional threat-model assumptions obsolete in an era of blended adversary tactics.
4 weeks ago
Kill Chain
How Interpol's Jackal IV Exposed the Hidden Infrastructure Behind Global Cybercrime
Interpol's Operation Jackal IV concluded in August 2026 as a coordinated international law enforcement effort targeting West African cybercrime syndicates across 22 countries. The operation resulted in 58 arrests and identification of 263 additional suspects, focusing particularly on Black Axe and similar transnational organized crime networks responsible for business email compromise, romance scams, and cryptocurrency fraud. Unlike previous operations, Jackal IV emphasized intelligence gathering and infrastructure disruption over arrest numbers, targeting crime-as-a-service networks that provide domains and money laundering support to cybercriminal groups. Authorities seized $3.8 million in assets across Argentina, South Africa, Romania, and Italy, dismantling call center operations and shell company networks. This operation highlights the evolving sophistication of West African cybercrime infrastructure and the increasing reliance on specialized service providers. The emphasis on disrupting criminal support networks rather than individual operators reflects law enforcement's strategic shift toward degrading entire criminal ecosystems that enable large-scale cyber-enabled financial fraud.
4 weeks ago
Kill Chain
How AI Voice Agents Are Revolutionizing Mobile Device Theft: The AnonyMousKIT Case Study
In 2026, cybersecurity researchers from SOCRadar discovered AnonyMousKIT, a sophisticated phishing-as-a-service (PhaaS) platform designed to bypass Apple's Activation Lock on stolen devices. The platform employs AI-powered voice agents that impersonate Apple Support representatives, calling theft victims to extract device passcodes, Apple ID credentials, and live two-factor authentication codes. Operating across five channels including email, SMS, WhatsApp, recorded calls, and AI voice agents, the service targets owners of recently stolen Apple devices with highly convincing lures that reference specific device identifiers and live Find My status. This incident demonstrates the concerning evolution of cybercriminal services, where AI technology is being weaponized to automate social engineering attacks at scale. The rise of AI-powered phishing platforms represents a significant escalation in threat sophistication, making device theft more profitable and highlighting the urgent need for enhanced user awareness and technical countermeasures against voice-based social engineering.
4 weeks ago
Kill Chain
SLEEPWALKER Backdoor: The Invisible Threat That Waits for a Single Packet
In August 2026, security researchers documented SLEEPWALKER, a sophisticated Windows backdoor that remains dormant until activated by a specially crafted network packet. The 59,904-byte DLL impersonates Microsoft's dpapi.dll and side-loads into ESET Management Agent processes, executing commands through its own 23-instruction bytecode language across six transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI. The backdoor makes no outbound connections and leaves minimal forensic traces, consistent with advanced persistent threat operations. This discovery highlights the evolution of stealth backdoors toward packet-triggered activation mechanisms that bypass traditional network monitoring and endpoint detection systems.
4 weeks ago
Kill Chain
Operation Jackal IV Dismantles Global West African Cybercrime Networks
Between November 2025 and June 2026, Operation Jackal IV, a coordinated international law enforcement effort spanning 22 countries, resulted in 58 arrests and identification of 263 suspects linked to West African cybercrime networks, particularly the Black Axe syndicate. The operation targeted sophisticated Crime-as-a-Service networks that facilitated romance scams, cryptocurrency fraud, business email compromise, and sextortion schemes targeting victims globally. Authorities seized $2.67 million, blocked 257 bank accounts, and dismantled infrastructure supporting money laundering operations across Argentina, South Africa, Romania, and Italy. This crackdown highlights the growing sophistication of African organized crime groups who increasingly leverage dark web services and international networks to scale their operations, making cross-border collaboration essential for effective cybercrime prevention.
1 month ago
Kill Chain
Major DDoS Attack Cripples Norway's Government Digital Services
A large-scale distributed denial-of-service (DDoS) attack disrupted Norway's shared government digital infrastructure starting August 25, 2026, at 03:38 CEST. The attack targeted services operated by the Norwegian Digitalization Agency (Digdir) and its provider Vivicta, affecting critical public services including ID-porten electronic IDs, eSignering digital signatures, secure government mail, and inter-agency data exchange. Multiple services experienced complete unavailability for periods, with citizens encountering failed connections, slow responses, and extended login times across tax administration, business communication platforms, and public record access systems. This incident represents the third DDoS attack against Norway's digital government infrastructure in 2026, highlighting the increasing targeting of critical national digital services by threat actors seeking to disrupt public sector operations and citizen access to essential government services.
1 month ago
Kill Chain
AnonyMousKIT Deploys AI Voice Agents in Sophisticated iPhone Passcode Phishing Campaign
AnonyMousKIT, a phishing-as-a-service platform active since early 2024, exploits voice AI agents to extract passcodes from stolen iPhone owners and bypass Apple's Activation Lock security feature. The operation spans 506 domains with 168 storefront brands as resellers, conducting over 200 calls to victims between August 2025 and May 2026. The AI agents impersonate Apple Support representatives, convincing victims to provide device passcodes and Apple ID credentials through sophisticated social engineering tactics, enabling attackers to unlock stolen devices, access iCloud data, and resell hardware at premium prices. This incident represents the alarming evolution of cybercriminal infrastructure, where AI-powered automation enables large-scale social engineering attacks targeting mobile device security. As voice AI becomes more sophisticated and accessible, threat actors are leveraging these technologies to circumvent traditional phishing detection methods and exploit human trust in voice communications.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports