Sector · Telecommunications

Telecommunications security analysis.

Technical position pieces on telecommunications incidents — what happened, where it leaves you exposed, and what our network-layer detection can and cannot do about it.

Banking & Financial Services Water & Utilities Transportation Enterprise Security Federal & Defense Critical Infrastructure Financial Services Identity & Secrets Management Manufacturing / OT / ICS Healthcare Retail & E-commerce Higher Education State & Local Government Cloud / MSP / MSSP Insurance

staged_exfiltration

the velocity of failure: network visibility and the kddi breach

Security Magazine reported on a significant data breach involving KDDI Corporation that resulted in the exposure of 12.2 million customer email addresses.

Nov 6, 2026, 1:03 AM

staged_exfiltration

the architecture of visibility: moving beyond the perimeter in telecommunications security

The ransomware group Global Secret Group claimed responsibility for a cyberattack against U.S.-based TDS Telecommunications LLC, alleging they possess 27.4 GB of sensitive data.

Nov 2, 2026, 7:06 PM

Living-off-the-land (LotL)

The collapse of dwell time in telecommunications infrastructure

A China-linked threat group used an AI-powered pentesting tool to compromise over 140 sensitive targets, including telecommunications providers in the United States, within an 11-day period.

Nov 2, 2026, 7:06 PM

ransomware_staging

the velocity of defense: bridging the dwell time gap at verveba telecom

The ransomware group Incransom claimed responsibility for a cyberattack against Verveba Telecom, a telecommunications company based in the United States.

Nov 2, 2026, 11:07 AM

ransom_staging

the velocity of compromise: addressing the tds telecommunications security collapse

TDS Telecommunications LLC, a US-based organization, was targeted by the Global Secret Group in a ransomware attack discovered on October 29, 2026.

Oct 31, 2026, 7:04 PM

ransomware_staging

the terminal collapse of defender velocity: a response to the tds telecommunications breach

The Global Secret Group ransomware gang has targeted TDS Telecommunications LLC, a major U.S. telecommunications provider, in an attack reported on October 30, 2026.

Oct 31, 2026, 11:07 AM

staged_exfiltration

the dwell time paradox: why network-layer visibility is the final defense against staged exfiltration

The ransomware group Scarlettgroup listed Genesys, a major US provider of cloud contact center and customer experience software, on its leak site, claiming to have compromised over 3.8 million email addresses.

Oct 26, 2026, 1:04 AM

staged_exfiltration

Closing the gap on staged exfiltration: observations from the verveba telecom event

The ransomware group Incransom claimed responsibility for an attack on the US-based telecommunications company Verveba Telecom. The attackers alleged they exfiltrated 2TB of data and threatened to release it if ransom demands were not met.

Oct 25, 2026, 1:03 AM

zero_day_post_exploit

beyond the perimeter: shifting the defense of telecommunications infrastructure

Researchers uncovered a multi-stage intrusion against a telecommunications managed service provider that began in September 2024, involving the exploitation of FortiManager and FortiOS vulnerabilities to maintain long-term access and deploy backdoors.

Oct 22, 2026, 7:05 PM

lotl

the dwell time collapse: reclaiming network-layer control in the wake of the fortimanager breach

Palo Alto Networks disclosed that a 25-month intrusion into a telecommunications managed service provider involved the use of the PeerStitch malware and exploitation of FortiManager vulnerabilities.

Oct 22, 2026, 11:06 AM

zero_day_post_exploit

the peerstitch pivot: network-layer visibility in telecommunications defense

A threat actor identified as UNC5820 exploited a Fortinet path traversal vulnerability as a zero-day to deploy a stealthy implant named PeerStitch against a telecommunications organization.

Telecommunications security analysis.

the velocity of failure: network visibility and the kddi breach

the architecture of visibility: moving beyond the perimeter in telecommunications security

The collapse of dwell time in telecommunications infrastructure

the velocity of defense: bridging the dwell time gap at verveba telecom

the velocity of compromise: addressing the tds telecommunications security collapse

the terminal collapse of defender velocity: a response to the tds telecommunications breach

the dwell time paradox: why network-layer visibility is the final defense against staged exfiltration

Closing the gap on staged exfiltration: observations from the verveba telecom event

beyond the perimeter: shifting the defense of telecommunications infrastructure

the dwell time collapse: reclaiming network-layer control in the wake of the fortimanager breach

the peerstitch pivot: network-layer visibility in telecommunications defense

the silent pivot: network-layer detection in the wake of the salt typhoon campaign

the architecture of collapse: reversing the speed disadvantage in telecommunications defense

the Pacific theater: network-layer visibility against China-linked lateral movement

the velocity of compromise: addressing the ransomware staging gap in telecommunications

the speed of impact: neutralizing lateral movement in the aftermath of legacy sharepoint exploitation

the silent window: shifting the defense burden to the network layer

Closing the detection gap: why staged exfiltration demands network-layer precision

the visibility gap: infrastructure risk in the era of BYOD

infrastructure visibility at the layer of impact: responding to the salt typhoon telecommunications breach

the dwell time crisis: identifying lateral movement in core carrier infrastructure

the silent operator: addressing the dwell time collapse in modern telecommunications

the velocity of compromise: addressing network-layer visibility in the interconnect computer cabling services, inc. breach

the anatomy of unauthorized access: how network visibility shortens the attacker's timeline

beyond the perimeter: understanding the eastlink breach and the collapse of dwell time

the architecture of visibility: lessons from the southern california telephone company breach

the velocity of compromise: re-evaluating diagnostic tool security

the hidden perimeter in telecommunications infrastructure

the silent path: why internal movement exposes the endzone claims

the dwell time collapse: rethinking visibility in telecommunications security

the dwell time collapse: rethinking visibility in critical infrastructure

telecommunications infrastructure and the reality of silent lateral movement

Closing the detection gap in critical telecommunications infrastructure

Visibility gaps in critical infrastructure: analyzing the persistence of network-layer threats

the silent pivot: securing critical telecommunications networks against unmanaged infrastructure threats

the reconnaissance window: securing critical telecommunications networks against staging-phase activity

the velocity of defense: intercepting iranian cyber operations in telecommunications infrastructure

the unseen pivot: visibility gaps in critical infrastructure telemetry

the compression of response: neutralizing the telecommunications dwell time crisis

the silent pivot: securing critical telecommunications infrastructure against unmanaged asset exploitation

the persistent shadow: defending critical infrastructure against long-term dwelling actors

the velocity of unauthorized entry: defending telecommunications infrastructure against automated persistence

the operational collapse of perimeter defense in the qtfy telecommunications operation

the silent intercept: analyzing the salt typhoon breach through the network lens

the operational silence of automated systems in the wake of the apt iran activity

the network-layer reality of the colt technology services extortion event

the decade-long oversight: re-evaluating the network-layer collapse in the qtfy operation

the operational silence of the infrastructure-layer threat

the infrastructure-layer reality of the oauth permission abuse threat

the silent collapse of dwell time: insights from the qtfy infrastructure seizure

the infrastructure layer: responding to the citrix netscaler vulnerability expansion

the infrastructure-layer reality of the latest at&t data exfiltration

the infrastructure blind spot: analyzing the qtfy qscan and qtrouter operation

the case for infrastructure-layer visibility: responding to the at&t firstnet data compromise

beyond the perimeter: infrastructure-layer visibility after the colt technology services incident

the case for infrastructure-layer visibility: responding to the brightspeed data exfiltration

the case for infrastructure-layer visibility: responding to the qtfy telecommunications breach

the logic of persistence: monitoring layers 2-4 to counter the qtfy threat

the case for infrastructure-layer visibility: responding to the qtify telecommunications breach

the silent infrastructure: why iot blind spots are the next theater of cyberespionage

the unseen bridge: telecommunications infrastructure as a pathway to industrial control systems

beyond the perimeter: infrastructure-level visibility against the qtify threat

the silent signal: neutralizing qtify's low-and-slow command and control

the silent signal: moving beyond initial access to network-layer detection

the silence at the center of the salt typhoon: why network-layer visibility is the new requirement

beyond the cable cut: the necessity of layer 2–4 network visibility

the velocity of compromise: re-evaluating the coltson-style breach

beyond the perimeter: shifting the focus to network-layer behavioral detection in the wake of qtfy

the architecture of shadow traffic: lessons from the qtfy infrastructure takedown

the silent proxy: why iot infrastructure is the new frontier for telecommunications risk

the architecture of shadow traffic: lessons from the qscan neutralizations

the architecture of silence: addressing the blind spots exposed by salt typhoon

the hidden cost of the invisible infrastructure breach

the architecture of invisibility: what the qtfy takedown reveals about network blind spots

the persistent signal: telecommunications and the rise of unmanaged iot exploitation

the silent operator: exposing espionage in telecommunications infrastructure

Closing the gap between vishing and exfiltration in the unified communications sector

Closing the IoT blind spot: lessons from the QTFY infrastructure seizure

rethinking the telecommunications perimeter: insights from the salt typhoon operation