Telecommunications: PEERSTITCH Malware Compromises 500+ Firewalls… (+4 more)

Breaches

Data Breach Exposes 1.8 Million Bangladeshi Records on Dark Web

A report by CyberStation revealed that over 1.8 million user records and 17,362 login credentials linked to Bangladesh have been discovered on the dark web. The findings were presented at the Bangladesh Cyber Resilience Briefing 2026, attended by representatives from various sectors. The assessment covered 767 domains across 15 sectors, with government services showing the highest number of exposed records. CyberStation indicated that these figures are conservative estimates, suggesting the actual exposure may be larger. The report emphasizes the urgent need for organizations to understand and mitigate the risks associated with exposed personal information. The event also included discussions on coordinated actions to prevent data misuse.

Breach · 8 sources · score 58

Cyber Hygiene and Resilience Amid Rising Attacks in the UK

In 2026, the UK faces increasing cyber threats, with notable breaches affecting organizations like Beacon CRM and Manchester Airport Group. The National Cyber Security Centre (NCSC) emphasizes a whole-of-state approach to cyber resilience, urging both public and private sectors to collaborate. Cyber hygiene is critical, focusing on risk assessment, incident response, and minimizing damage during breaches. The rise of AI in cyber attacks complicates defenses, making continuous vigilance essential. Phishing remains a significant threat, with over half of businesses experiencing attacks this year. The Cyber Essentials standard is promoted as a foundational measure for organizations, particularly SMEs, to bolster their defenses. Recent reports indicate that only 27% of organizations conduct incident simulations with partners, highlighting a gap in preparedness.

Breach · 2 sources · score 58

AI Governance Gaps Lead to Increased Cyber Risks

Recent studies reveal that organizations are struggling to manage the risks associated with the rapid adoption of AI technologies. A significant number of enterprises, particularly in Europe and the Middle East, report that AI-related incidents are escalating to board-level discussions, yet governance frameworks are lagging. IBM's research indicates that 68% of breached organizations lacked formal AI governance policies, with 92% of those experiencing breaches lacking proper access controls. Small and midsize businesses (SMBs) are also facing challenges, with many discovering unapproved shadow AI usage. The rise of AI is not only benefiting organizations but also cybercriminals, who are leveraging AI to enhance their attack methods. As AI tools become more autonomous, the need for robust governance and accountability frameworks is becoming critical.

Breach · 4 sources · score 51

Threat actors and malware

PEERSTITCH Malware Compromises 500+ Firewalls via FortiManager Exploits

In September 2024, a multi-stage network intrusion targeted a telecommunications managed service provider, leading to the compromise of over 500 FortiGate firewalls. The attackers exploited CVE-2024-47575, a critical vulnerability in FortiManager, to gain unauthorized access and exfiltrate sensitive configuration data. Following this, they deployed PEERSTITCH, a novel memory-resident ARM64 malware, by exploiting CVE-2025-61624, a path traversal flaw in FortiOS. PEERSTITCH operates stealthily, leaving no persistent binaries and communicating through legitimate process traffic, making it difficult to detect. The attackers maintained long-term access and could intercept network traffic and establish unauthorized VPN sessions. The investigation by Palo Alto Networks' Unit 42 revealed that the compromised configurations included sensitive data such as routing tables and VPN credentials. The incident highlights significant vulnerabilities in Fortinet's management systems and the potential for widespread impact on client networks. Current protective measures include advanced security products from Palo Alto Networks.

APT · 6 sources · score 72 · CVE-2024-26008, CVE-2024-26009, CVE-2024-47575, CVE-2025-61624, UNC5820

Supply Chain Attack on AOMEI Backupper Delivers Backdoor via Update Servers

Between May and July 2026, attackers tampered with AOMEI Backupper's update servers, delivering a backdoor to users who checked for updates during specific time windows. The attack exploited a lack of cryptographic verification in the update process, allowing malicious files to be downloaded and executed with the same privileges as the AOMEI process. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis Lab confirmed that organizations in IT services, telecommunications, and higher education across 11 countries, including the United States and India, were affected. AOMEI has reported fixing its servers, but the backdoor remains on already compromised machines. The attack was opportunistic, targeting any system that checked for updates during the tampering windows. The specific dates of tampering included May 28, July 16, and July 20, 2026, with the potential for more incidents not observed. The backdoor installed Radmin, a remote administration tool, alongside an attacker-built DLL, allowing further exploitation.

Malware · 8 sources · score 64 · Radmin

Get the next one by email

The telecommunications digest is free and arrives on Tuesdays. One click to leave.

Subscribe to the telecommunications digest

A free account turns the digest into a personal watchlist: choose what you want to follow.