Techcrunch

Nation-State Hackers Breach Ribbon Communications for Months

First seen 2 Dec 2025, 18:33 UTC • Theregister

•21.9

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Ribbon Communications, a major telecom provider, was breached by suspected nation-state hackers starting in December 2024. The attackers remained undetected for nearly a year, potentially exposing sensitive data from several customers. The company has since notified law enforcement and believes the hackers are no longer in its network.

How this analysis works

Attack Flow

18 entities, 19 inferred relationships (STIX 2.1).

Threat Actor (1)

Salt Typhoon

Technique (4)

Data Breach
DDoS
Phishing
Supply Chain Attack

Organization (9)

AT&T
Department of Defense
Lumen
Microsoft
Ribbon
Ribbon Communications
Verizon
Azure
MOVEit Transfer

Affected Platform (1)

Entra ID

Tool (2)

Aardvark
AzureHound

Vulnerability (1)

MOVEit Transfer flaw

Relationships

Salt Typhoon uses Aardvark
Salt Typhoon uses AzureHound
Salt Typhoon uses Data Breach
Salt Typhoon uses DDoS
Salt Typhoon uses Phishing
Salt Typhoon uses Supply Chain Attack
Salt Typhoon exploits MOVEit Transfer flaw
Aardvark exploits MOVEit Transfer flaw
AzureHound exploits MOVEit Transfer flaw
MOVEit Transfer flaw targets Entra ID
Salt Typhoon targets AT&T
Salt Typhoon targets Department of Defense
Salt Typhoon targets Lumen
Salt Typhoon targets Microsoft
Salt Typhoon related to Ribbon
Salt Typhoon related to Ribbon Communications
Salt Typhoon related to Verizon
Salt Typhoon related to Azure
Salt Typhoon related to MOVEit Transfer

Continue Reading

China-Nexus APT UAT-7290 Targets South Asia Telecoms in Cyber Espionage Campaign Cisco SD-WAN Zero-Day Exploited by Threat Actor Since 2023 Critical Vulnerabilities in SonicWall and Fortinet Devices Exploited in the Wild CISA Warns of Critical Exploits in Langflow, Tomcat, and N-central Flaws Russian FSB Exploits Vulnerable Routers to Target Critical Infrastructure Red Menshen APT Uses BPFdoor for Long-Term Espionage in Telecom Networks

Nation-State Hackers Breach Ribbon Communications for Months

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading