Telecommunications threat landscape
Carriers, mobile networks and ISPs — access to them is access to everyone downstream, a magnet for state actors.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 23
- Actively-attacked vulnerabilities (CISA KEV)
- 0
- Ransomware victims, last 90 days
- 0
- Ransomware victims, since 2026-06
- 0
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 23.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| UNC3886 | UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pa… | 574 |
| Scattered Spider | Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. T… | 423 |
| MuddyWater | MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at le… | 395 |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion opera… | 365 |
| OilRig | OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government… | 293 |
| Salt Typhoon | Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecom… | 284 |
| Earth Lusca | Earth Lusca is a suspected China-based cyber espionage group that has been active since at least April 2019. Earth Lusca has targeted organizations in Austral… | 239 |
| Aquatic Panda | Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org… | 238 |
| BackdoorDiplomacy | BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. BackdoorDiplomacy has targeted Ministries of Foreign Affairs and… | 217 |
| HEXANE | HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been locat… | 215 |
| APT41 | APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://atta… | 210 |
| APT39 | APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2… | 205 |
| Daggerfly | Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and t… | 166 |
| Ember Bear | Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training… | 164 |
| Aoqin Dragon | Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, edu… | 149 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 35.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Cutting Edge | Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of… | — | — |
| SolarWinds Compromise | The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. [APT29](https://att… | APT29 | — |
| C0027 | C0027 was a financially-motivated campaign linked to Scattered Spider that targeted telecommunications and business process outsourcing (BPO) companies fro… | Scattered Spider | — |
| Versa Director Zero Day Exploitation | Versa Director Zero Day Exploitation was conducted by Volt Typhoon from early June through August 2024 as zero-day exploitation of Versa Director servers c… | Volt Typhoon | — |
| KV Botnet Activity | KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https… | Volt Typhoon | — |
| Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware | This investigation reveals the first public confirmation of zero-click mercenary spyware delivered via targeted advertisements, termed AdFection. Devices at Al Jazeera were infected with Candiru spyware through malicious ads purchased by Is… | — | 2026-10-15 |
| PEERSTITCH, a Stealthy FortiGate Implant | A sophisticated multi-stage network intrusion against a telecommunications organization in September 2024 exploited CVE-2024-47575 on a FortiManager appliance, exfiltrating configurations and cryptographic material for over 500 managed Fort… | — | 2026-10-15 |
| SMTP is the key: BPFDoor and AVERAT hitting the network edge | A sophisticated multi-component campaign targeting telecommunications and network-edge appliances has been discovered, featuring BPFDoor variants and a newly identified implant designated AVERAT. The operation leverages SMTP traffic on port… | — | 2026-10-05 |
| Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia | A Chinese-speaking threat operator deployed an AI orchestration framework called SecFlow to conduct intrusions across Taiwan, Indonesia, China, Vietnam, and Afghanistan. The campaign utilized commercial AI models (Claude, Qwen, DeepSeek) as… | — | 2026-10-03 |
| Warlock Ransomware Attackers Hit Water and Telecom Operators | The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four organizati… | — | 2026-10-02 |
| NeedyMantis: Unpacking a post-compromise malware family used in targeted operations | NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activ… | — | 2026-09-29 |
| Major vulnerability found in ancient TACACS+ networking protocol | Australian security firm Elttam discovered a critical pre-authentication remote code execution vulnerability in TACACS+, a 33-year-old protocol handling authentication on networking equipment. The protocol, released by Cisco in 1993 and now… | — | 2026-09-25 |
| Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit | A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seve… | — | 2026-09-15 |
| PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure | A previously undocumented custom backdoor called PATCHCORD has been identified targeting Afghan telecom providers and South Asian critical infrastructure organizations. The C/C++ implant is delivered through sector-specific lures including… | — | 2026-09-12 |
| NightLedger Backdoor Deployed in Espionage Campaign Targeting the Middle East and Africa | An advanced persistent threat group, Mirage Kitten, is conducting cyber-espionage operations across the Middle East and Africa using three previously undocumented malware families: NightLedger, BridgeHead, and ArcBridge. These tools provide… | — | 2026-08-04 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 318.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2025-14942 | 9.8 | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client a… | |
| CVE-2026-17561 | 9.8 | Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6… | |
| CVE-2026-62252 | 9.8 | Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the passw… | |
| CVE-2026-62253 | 9.8 | Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret de… | |
| CVE-2026-90924 | 9.8 | Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.… | |
| CVE-2026-90926 | 8.8 | Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6.… | |
| CVE-2025-0616 | 8.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Ltd. B2B - Netsis Panel allows SQL Injection. This issue affec… | |
| CVE-2025-13282 | 8.1 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of… | |
| CVE-2026-62251 | 8.1 | Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQ… | |
| CVE-2025-13283 | 7.1 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to th… | |
| CVE-2026-90925 | 7.1 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects … |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Telecommunication / Telecommunications), latest 0 shown.
No ransomware victims currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
watch this sector
Get a daily email when something new touches telecommunications — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.