Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Telecommunications

Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.

1044 threat reports
Page 85 of 87
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Telecommunications Threat Reports

Showing 1009–1020 / 1044 reports
Cisco SNMP Zero-Day: Active Exploits Target IOS XE Network Devices in 2025
Telecommunications10 months ago

Cisco SNMP Zero-Day: Active Exploits Target IOS XE Network Devices in 2025

In September 2025, Cisco disclosed a critical vulnerability (CVE-2025-20352) affecting its IOS and IOS XE operating systems, actively exploited via the SNMP subsystem. The flaw stems from a stack-based buffer overflow that allows authenticated remote attackers to trigger denial-of-service or potentially achieve root-level remote code execution. Attackers utilized crafted SNMP packets over both IPv4 and IPv6 to compromise devices with SNMP enabled, including popular models like the Meraki MS390 and Catalyst 9300. Cisco confirmed attacks in the wild following credential compromise, urging immediate patching, as no reliable workarounds exist. This incident highlights the ongoing risks associated with ubiquitous network protocols like SNMP and the necessity of rapid response to zero-day exploits within core infrastructure. The rise of attacks targeting network management systems signals both increased attacker sophistication and heightened regulatory scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Unpatched SMS Flaw in OnePlus Phones Leaves User Messages Exposed
Financial Services10 months ago

Unpatched SMS Flaw in OnePlus Phones Leaves User Messages Exposed

In September 2025, a critical, still-unpatched vulnerability (CVE-2025-10184) was publicly disclosed in OnePlus smartphones running OxygenOS 12 through 15. Discovered by Rapid7, the flaw enables any installed app—without explicit permissions or user input—to access and exfiltrate SMS content and metadata on affected devices. This exposure was caused by insecurely exported content providers in the custom Android Telephony package, allowing SQL injection-style inference attacks. Despite multiple disclosure attempts, OnePlus did not respond for over four months; the details, including a proof of concept, were disclosed publicly to accelerate a fix. The case underscores rising risks from insecure mobile customizations and vendor slow response, especially as attackers increasingly exploit flaws in widely deployed consumer devices. With the proliferation of mobile-centric attacks and regulatory scrutiny on data privacy, this breach highlights the urgent need for robust patch management and proactive mobile security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cisco's 2025 SNMP Zero-Day: Credential Compromise Drives Network Device Exploit Surge
Telecommunications10 months ago

Cisco's 2025 SNMP Zero-Day: Credential Compromise Drives Network Device Exploit Surge

In September 2025, Cisco disclosed a high-severity zero-day vulnerability (CVE-2025-20352) affecting IOS and IOS XE network infrastructure devices. The flaw, a stack-based buffer overflow in the SNMP subsystem, allowed remote, authenticated attackers with low privileges to cause denial-of-service and, in some cases, permitted high-privileged attackers to fully compromise devices. Exploitation was detected after local administrator credentials were stolen, enabling threat actors to send malicious SNMP packets over IPv4/IPv6, impacting unpatched devices globally. Immediate patching was recommended as no workarounds existed except tightly restricting SNMP access. This incident underscores the criticality of timely patching and robust identity and network access controls, as attackers increasingly target network infrastructure via both credential compromise and protocol-level vulnerabilities. Industry-wide, it marks an escalating trend of high-impact, infrastructure-level exploits requiring urgent coordinated response.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
RedNovember: 2025 Chinese State Cyber Espionage Campaign Hits Global Governments
Government Administration10 months ago

RedNovember: 2025 Chinese State Cyber Espionage Campaign Hits Global Governments

In mid-2025, a Chinese state-sponsored threat group known as RedNovember (previously tracked as TAG-100) orchestrated a widespread cyber espionage campaign targeting government and private sector organizations across Africa, Asia, North America, South America, and Oceania. The attackers leveraged sophisticated tools including the Pantegana backdoor and Cobalt Strike to establish persistence, perform lateral movement, and exfiltrate sensitive data. Entry vectors included spear-phishing emails and exploitation of known network vulnerabilities, allowing RedNovember to stealthily compromise high-value systems and harvest intelligence for extended periods before discovery. The impact included unauthorized access to confidential government documents and disruption of critical data workloads. This incident underscores the persistent evolution of state-sponsored attack tactics, with RedNovember employing advanced, evasive techniques and custom malware. The growing use of encrypted command-and-control traffic and living-off-the-land strategies sets a concerning precedent, especially for government agencies and regulated enterprises facing a surge in sophisticated espionage operations.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Scattered Spider’s $115M Ransomware Blitz: How Hybrid Attacks Changed Compliance Expectations in 2025
Telecommunications10 months ago

Scattered Spider’s $115M Ransomware Blitz: How Hybrid Attacks Changed Compliance Expectations in 2025

In 2025, U.K. and U.S. law enforcement charged members of the cybercrime group Scattered Spider, including Thalha Jubair and Owen Flowers, with a $115 million ransomware and extortion campaign targeting sectors such as retail, transportation, hospitality, and healthcare. The group, also known as 0ktapus and UNC3944, leveraged advanced social engineering, SIM-swapping, phishing, and remote access tactics to breach hundreds of organizations—including notorious attacks on MGM Resorts, Caesars Entertainment, Transport for London, and major U.K. retailers. Law enforcement tracked cryptocurrency ransoms to the group, seizing millions in illicit funds and identifying extensive operational overlap with LAPSUS$ and other threat collectives. This incident highlights the escalating threat posed by young, identity-driven ransomware affiliates employing blended TTPs, exploiting cloud and hybrid infrastructures, and leveraging insider access. Their success in spanning critical infrastructure and commercial targets underscores the urgent need for multilayered defenses, compliance vigilance, and aggressive regulatory and incident response readiness.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova
Government Administration10 months ago

Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova

In June 2024, researchers revealed that REST Media, an online outlet targeting Moldova’s elections, is actually a front for the Russian disinformation group Rybar. Rybar, already sanctioned by the EU and wanted by the U.S., used REST Media to amplify anti-EU narratives and undermine the Party of Action and Solidarity, leveraging platforms like TikTok, Telegram, and X to achieve millions of views. Technical forensics linked REST Media’s online infrastructure and production workflows directly to Rybar, demonstrating operational overlap and deliberate efforts at obfuscation. The campaign exploited Moldova's fragmented media regulations, using cloaked registration accounts, privacy services, and anonymized hosting, making attribution complex while rapidly expanding its influence ahead of key elections. This incident exemplifies the growing sophistication of state-sponsored information operations, exploiting both technology and weak local controls. As hybrid threats, including coordinated disinformation and cyberattacks, continue to undermine democratic processes across Eastern Europe, organizations and governments face mounting regulatory, reputational, and operational risks from similar campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Arrest of UK Teen Halts Core Scattered Spider Ransomware Operations in 2024
Financial Services10 months ago

Arrest of UK Teen Halts Core Scattered Spider Ransomware Operations in 2024

In June 2024, UK authorities arrested Thalha Jubair, a 19-year-old national identified as a core operator within the Scattered Spider ransomware group. Jubair, linked to at least 120 cyberattacks and $89.5 million in cryptocurrency transactions, was accused of orchestrating sophisticated extortion campaigns against major organizations, including the 2024 attack on the U.S. federal court system and Transport for London. The investigation utilized blockchain analysis and traced ransom payments that funded essential purchases, directly implicating Jubair despite advanced operational security measures such as VPNs and amnesiatic operating systems. This landmark arrest exposes the evolution and persistence of decentralized ransomware groups, highlighting challenges in attribution and apprehension. The incident demonstrates the growing use of identity obfuscation tools and cryptocurrencies among cybercriminals, underscoring the urgent need for robust detection, response, and regulatory frameworks across industries.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
US Secret Service Seizes Massive SIM Server Network Threatening Government Officials
Government Administration10 months ago

US Secret Service Seizes Massive SIM Server Network Threatening Government Officials

In September 2025, the U.S. Secret Service announced it had dismantled a large-scale illicit telecommunications infrastructure across the New York tri-state area, seizing over 300 SIM servers and 100,000 SIM cards. These devices, co-located at multiple sites, were used by unknown malicious actors to facilitate threats against U.S. government officials, particularly near the United Nations. Investigators discovered that this network enabled covert communications and potentially enabled bypasses of monitoring controls, raising national security concerns. The takedown required coordinated federal action to secure the assets, neutralize the risk, and support ongoing intelligence operations. This incident highlights the ongoing evolution and physical sophistication of threat actor infrastructure, especially targeting high-profile government personnel. The scale and automation facilitated by such hardware underline the growing intersection of physical and cyber threats and serve as a wake-up call for risk teams facing advanced, hybrid attack models.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Iranian APT Extends Reach: 2024 Nimbus Manticore Malware Hits Europe
Government Administration10 months ago

Iranian APT Extends Reach: 2024 Nimbus Manticore Malware Hits Europe

In early 2024, a sophisticated Iran-backed threat group known as “Nimbus Manticore” launched targeted cyberattacks against several European organizations using enhanced variants of its custom malware. The attackers leveraged spear-phishing emails embedding malicious attachments as their initial access vector, resulting in the deployment of advanced payloads that enabled persistent access and lateral movement within affected networks. Once inside, the group utilized encrypted communication channels and east-west movement to exfiltrate sensitive data and evade common detection mechanisms. The incident has caused operational disruptions and triggered regulatory notifications in multiple EU member states. This breach illustrates a strategic expansion of Iran-linked APT operations beyond their traditional region, pointing to escalating risks for European enterprises. The exposed techniques underscore the necessity for advanced detection, robust internal segmentation, and regulatory alignment as attackers increasingly shift tactics to bypass perimeter controls.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
SANS Honeypot 2024: SYN Flood Distraction Amplifies Network Reconnaissance Threat
Information Technology/IT10 months ago

SANS Honeypot 2024: SYN Flood Distraction Amplifies Network Reconnaissance Threat

Between March 31 and April 20, 2024, the SANS Internet Storm Center's honeypot experienced a persistent barrage of over 2.3 million TCP SYN packets in three distinct waves, mimicking a distributed denial of service (DDoS) campaign. Traffic originated from thousands of hosts—mostly within Bangladeshi and Iraqi ISPs—leveraging spoofed and potentially compromised IPs to generate low-rate, highly patterned SYN floods targeting port 443. Despite the scale, the attack's volume and packet rates were insufficient to disrupt modern services and instead appeared to serve as a diversionary tactic. This incident highlights emerging trends in network reconnaissance and distraction techniques, where attackers intentionally generate noisy traffic to mislead analysts and mask parallel or future activities. As SYN flood patterns evolve and attackers increasingly use crafted packets and IP spoofing, traditional DDoS detection and response strategies must adapt to avoid misallocation of resources or missing stealthier threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Secret Service Disrupts Extensive NYC Telecom Threat Targeting UN Assembly
Telecommunications10 months ago

Secret Service Disrupts Extensive NYC Telecom Threat Targeting UN Assembly

In September 2025, the U.S. Secret Service disrupted a sophisticated illicit telecom infrastructure in the New York City area, uncovering more than 300 servers and over 100,000 SIM cards located near the United Nations General Assembly. The operation identified a network enabling encrypted, anonymous communications allegedly used by foreign actors, criminals, and potentially threat groups to coordinate activities and transmit assassination threats. Investigators warned that the scale of the system posed significant risk, including the theoretical ability to disable cellular networks and disrupt critical communications during high-security events. This incident highlights rising risks of criminal and nation-state actors leveraging physical telecom infrastructure to subvert detection, illustrating how sophisticated SIM farms and server farms can facilitate large-scale anonymity and attacks. The operation underscores heightened scrutiny on telecom supply chain security during high-profile events and the need for robust infrastructure monitoring.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
AT&T 2023: How Salt Typhoon Changed the APT Playbook
Telecommunications10 months ago

AT&T 2023: How Salt Typhoon Changed the APT Playbook

In 2023, the telecommunications giant AT&T was targeted by the advanced persistent threat group Salt Typhoon, which launched a sophisticated campaign exploiting unconventional vulnerabilities. Unlike conventional attacks, Salt Typhoon focused on endpoints lacking robust detection and response (EDR), hunted for network blind spots with minimal logging, and engaged in 'living off the land' attacks—leveraging legitimate administrative tools to evade detection and persist inside networks. This multi-pronged methodology enabled deep network infiltration before discovery, ultimately jeopardizing sensitive data and service availability across AT&T’s infrastructure. Following the breach, the company reported the threat group was successfully evicted from its systems. This incident has set a precedent, with numerous threat actors now adopting Salt Typhoon’s tactics to bypass traditional security controls. The breach highlights an urgent need for organizations to enhance monitoring, bolster endpoint visibility across all platforms, and adapt defenses for evolving attacker methodologies in critical infrastructure sectors.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports