Telecommunications: Volt Typhoon's Silent Train Network Targets US… (+7 more)

Ransomware

Warlock Ransomware Group Targets Global Infrastructure via SharePoint Exploits

The China-linked Warlock ransomware group, tracked as Storm-2603, has targeted at least four organizations in Europe, Africa, and Latin America, including a water utility and a telecommunications provider. The attackers exploited vulnerabilities in on-premises Microsoft SharePoint to gain initial access. Over a nine-day period, they mapped the domain and established covert remote access before disabling security software on 40 hosts in just two hours. The ransomware was deployed shortly after the security tools were disabled. This incident highlights a critical vulnerability in security budgets, as adversaries can easily disable detection tools. Security experts recommend that organizations implement independent security controls to mitigate risks. The ongoing threat emphasizes the need for robust patching and endpoint detection measures.

APT · 2 sources · score 77 · Storm-2603, Warlock

Breaches

South Korean Banks Face Data Breaches and AI Hacking Threats

A series of cyberattacks targeting South Korea's financial sector has compromised the personal data of approximately 68,000 customers across major banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The breaches, which reportedly utilized AI tools, have raised concerns about potential voice phishing scams exploiting the leaked information. The Financial Supervisory Service identified 28 IP addresses linked to the attacks, with indications that the hackers may have used multiple IPs to obscure their origins. While banks have promised compensation for losses, proving the direct link between the breaches and any subsequent fraud may be challenging. The government has called for a comprehensive overhaul of cybersecurity measures to prevent further incidents. Additionally, other sectors, including churches and a power company, have reported breaches, indicating a broader threat landscape. Authorities have issued consumer alerts and advised caution regarding suspicious communications.

Malware · 20 sources · score 68 · WormGPT

China-Linked Hackers Breach Regional Organization in Fiji

The US Embassy reported that hackers linked to China compromised a regional organization in Suva, Fiji, between July and August 2026. The breach allowed the hackers to maintain access to the organization's network for several days. The US Embassy warned that governments and telecommunications networks in the Pacific are also at risk. Fiji's Minister for Policing and Communications, Ioane Naivalurua, is reviewing the situation and has urged organizations to enhance their cybersecurity measures. The Chinese government denied the allegations, calling them politically motivated. The US Embassy has provided technical recommendations to Fiji's government to strengthen cybersecurity. The incident highlights ongoing concerns about state-sponsored cyber threats in the Pacific region.

Breach · 8 sources · score 63

Telecom Sector Faces Rising Cybersecurity Threats

The FCC's Public Safety and Homeland Security Bureau has issued a notice emphasizing the critical vulnerabilities in telecommunications infrastructure, which is increasingly targeted by cybercriminals and foreign state actors. The bureau highlighted that unauthorized access can lead to data loss and service disruptions, particularly affecting small providers crucial for rural connectivity. The notice recommends implementing best practices, including developing a cybersecurity risk management plan and adopting a zero trust strategy. The report also notes that criminal groups are likely to pose immediate threats, while state actors may seek long-term strategic advantages. Providers are urged to report incidents to federal authorities promptly. The notice follows workshops held in May 2026, where cybersecurity best practices were discussed.

Breach · 3 sources · score 57

Threat actors and malware

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure

The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access sensitive systems undetected. The identified zero-days include CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-20127, and CVE-2026-16812, affecting critical platforms like Cisco's SD-WAN and N-able N-central. Hundreds of victims across telecommunications, government, defense, and critical infrastructure sectors have been reported, particularly in California, Texas, and Hawaii. The operational tactics include post-operation cleanup to erase all traces of the attack, making detection challenging. The campaign is ongoing, with confirmed. Researchers from Lumen Technologies' Black Lotus Labs have been tracking this activity since late 2023.

APT · 13 sources · score 81 · CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-16812, CVE-2026-20127

Singapore Enhances Cyber-Defense After UNC3886 Attacks

In response to a cyber espionage campaign by the state-linked group UNC3886, Singapore is bolstering its cyber-defense strategy. The attacks, which targeted the nation's major telecommunications providers and critical information infrastructure, were first disclosed in July 2025. Authorities have developed AI tools to secure around 2,000 government systems, shifting focus from perimeter defense to active threat hunting. The Cyber Security Agency of Singapore (CSA) emphasizes the need to detect intruders already within networks, as UNC3886 employs sophisticated techniques, including zero-day exploits. The new AI tools automate penetration testing and source code scanning to identify vulnerabilities. The campaign has prompted a multi-agency response, known as Operation Cyber Guardian, to contain the threat and enhance security measures across various sectors. Current efforts are still in the evaluation stage, with plans to expand AI tool deployment across critical infrastructure sectors.

APT · 20 sources · score 78 · UNC3886, Operation Cyber Guardian

Also worth knowing

Russia's Fishing Trawlers Target UK's Undersea Cable Network

An investigation by The Telegraph revealed that Russian fishing trawlers have been used to spy on Britain's critical undersea cables, with over 500 incidents recorded where these vessels loitered above or followed cable routes. The analysis, spanning four and a half years, identified 17 trawlers that operated at low speeds near vital telecommunications cables connecting the UK with Europe and the US. This activity raises concerns about potential sabotage that could disrupt essential services such as banking, healthcare, and communications. NATO has confirmed awareness of these operations, noting that some of the vessels have not caught any fish, suggesting espionage activities. The UK government is preparing to introduce tougher penalties for damaging these cables, including lengthy prison terms. The Royal Navy has been criticized for its underinvestment, which may leave the UK vulnerable to such threats.

Other Threats · 16 sources · score 66

Timely Cyber Incident Reporting Critical for Infrastructure Security

Cyberattacks on critical infrastructure sectors such as healthcare, banking, and energy pose significant threats to national security and public safety. Recent regulatory changes in the U.S. and EU require organizations to report cyber incidents within strict timeframes, with the U.S. Computer Emergency Response Team mandating reporting within six hours for certain incidents. Delayed reporting can lead to increased risks, including operational losses and regulatory penalties. Organizations must establish clear incident response procedures and maintain accurate records to comply with these regulations. The evolving regulatory landscape emphasizes the need for timely reporting to enhance cybersecurity resilience and incident response capabilities.

Critical Infrastructure · 2 sources · score 55

Get the next one by email

The telecommunications digest is free and arrives on Tuesdays. One click to leave.

Subscribe to the telecommunications digest

A free account turns the digest into a personal watchlist: choose what you want to follow.