Target Sector: Telecommunications
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Telecommunications.
Key Facts
- 9 documented prosecution and advisory matters targeting Telecommunications.
- Cumulative reported financial losses exceed $1.5 billion.
- 2 of 9 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include Volt Typhoon, APT29, Scattered Spider / UNC5537, Salt Typhoon.
Documented Incidents (9)
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
SolarWinds Orion Supply Chain Intrusion (APT29 / SVR)
Sophisticated software supply chain compromise by the Russian Foreign Intelligence Service (SVR), inserting the SUNBURST backdoor into updates of SolarWinds Orion software and compromising multiple federal agencies.
U.S. v. Baratov et al. (Yahoo 2014 Breach / FSB Officers)
Conspiracy between Russian Federal Security Service (FSB) officers and criminal hackers to breach Yahoo's network, compromising 500 million user accounts to conduct espionage against journalists, government officials, and commercial executives.
U.S. v. Peter Levashov (Kelihos Botnet)
Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.
AT&T Cloud Telecom Call and Text Metadata Exfiltration
Illegal exfiltration of call and text interaction metadata spanning six months for approximately 110 million AT&T wireless customers. Intrusion stemmed from an illicit access point to a third-party Snowflake cloud environment, leading to a 5.7 Bitcoin extortion fee paid through an intermediary to obtain verified video evidence of dataset deletion.
Viasat KA-SAT Satellite Modem Wiper Sabotage (AcidRain)
Russian state-sponsored operators exploited an unpatched Fortinet VPN gateway to access Viasat satellite network management segments, broadcasting malicious AcidRain wiper firmware that permanently bricked tens of thousands of satellite terminals across Ukraine and Europe.
Salt Typhoon U.S. Telecommunications Wiretap Infrastructure Infiltration
Chinese state-sponsored espionage campaign (Salt Typhoon / GhostEmperor / FamousSparrow) compromising core routing and lawful intercept infrastructure of major U.S. broadband and wireless carriers (including AT&T, Verizon, and Lumen), gaining persistent access to CALEA court-ordered wiretap requests and unencrypted call metadata of senior government officials.
3CX DesktopApp Cascading Supply Chain Attack (Lazarus Group)
North Korean state-sponsored threat group Lazarus compromised VoIP communications software provider 3CX, injecting malware into digitally signed Windows and macOS builds of 3CXDesktopApp downloaded by over 600,000 corporate customers, in the first documented case of one software supply chain compromise directly enabling a second downstream supply chain breach.
FTC v. Global Tel*Link Corp. (Correctional S3 Bucket Leak)
Landmark Federal Trade Commission enforcement action against major correctional telecommunications vendor Global Tel*Link (GTL) for reckless data security practices that left an unencrypted Amazon S3 cloud repository containing 650,000 personal and biometric records exposed to the public internet for months.