Loading story…
Ribbon Communications, a major U.S.-based telecommunications and networking provider, confirmed that its IT network was compromised by threat actors reportedly linked to a Chinese nation-state. The breach, discovered in September 2025 but believed to have originated as early as December 2024, involved unauthorized access to the company's systems. Ribbon Communications initiated an incident response plan, engaged third-party cybersecurity experts, and notified federal law enforcement. The company stated that it has successfully terminated the unauthorized access and is continuing its investigation.
While the investigation is ongoing, Ribbon Communications has not found evidence that the attackers accessed or exfiltrated any material information from its main network. However, several customer files stored on two laptops outside the main network were accessed, and affected customers have been notified. The company anticipates incurring additional costs related to the incident and is working closely with authorities to assess the full impact. No technical details about the intrusion have been disclosed publicly at this time.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-up coverage said the attackers were suspected Chinese state-backed actors, adding attribution detail beyond the initial nation-state characterization. The reporting also highlighted the breach as the latest in a series of attacks affecting telecom organizations.
Ribbon Communications reported that it had been breached in a cyberattack attributed to a nation-state actor. Multiple reports describe the company as a telecom services provider and frame the incident as part of broader targeting of the telecom sector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat experienced a significant security incident involving the unauthorized access and exfiltration of data from its private GitHub repositories. The extortion group known as the Crimson Collective claimed responsibility for the breach, stating they stole approximately 570GB of compressed data, which included over 28,000 internal projects and hundreds of Customer Engagement Reports (CERs). These CERs are consultancy documents that often contain highly sensitive information such as architecture diagrams, configuration details, authentication tokens, database connection strings, and network maps, effectively providing blueprints of customer IT environments. The attackers published file listings and shared samples of the stolen data, which were verified by journalists to contain configuration snippets and references to customer systems. The group asserted that the compromised data spanned from 2020 to 2025 and involved major organizations across banking, telecom, government, airlines, and public-sector sectors, with specific mentions of companies like Citi, Verizon, Siemens, Bosch, JPMC, HSBC, and even the U.S. Senate. The Crimson Collective also claimed to have found authentication tokens and other credentials within the repositories and CERs, which they allegedly used to access downstream customer infrastructure. They stated that they attempted to warn affected customers but were ignored. Red Hat confirmed the security incident related to its consulting business but did not verify the full extent of the attackers' claims or the specific details of the breach. The company emphasized that, at the time, there was no evidence the incident impacted other Red Hat services or products, and they expressed confidence in the integrity of their software supply chain. The breach was first disclosed by the attackers on Telegram, where they posted a full file tree, CER list, and screenshots as proof. The incident has raised concerns about the exposure of sensitive customer data and the potential for further attacks leveraging the stolen credentials and infrastructure details. Red Hat has not publicly disclosed how the attackers gained access or whether they received any extortion demands, though the Crimson Collective claimed to have contacted the company and received only a generic response. The breach highlights the risks associated with storing sensitive customer information and credentials in internal repositories and the potential downstream impact on customers when such data is compromised. Security researchers have warned that the exposed information could be used to target Red Hat's clients with tailored attacks, given the detailed nature of the stolen CERs. The incident underscores the importance of robust access controls, credential management, and rapid incident response in protecting both corporate and customer assets.
Jun 29, 2026
Chinese state-linked hackers, identified as the Jewelbug group, infiltrated a major Russian IT service provider in a sophisticated espionage campaign that spanned from January to May 2025. The breach was uncovered by Symantec researchers, who reported that the attackers gained access to the company’s software build and code repository systems, raising concerns about a potential software supply chain attack targeting the provider’s downstream clients. The targeted company, though unnamed, is described as a significant provider with government-related clients, amplifying the potential impact of the intrusion. Jewelbug, also tracked as Earth Alux, CL-STA-0049, and REF7707 by various security vendors, has a history of targeting government and corporate networks across South America, South and Southeast Asia, and Taiwan, but this marks a rare incursion into Russian infrastructure. The attackers conducted extensive reconnaissance, stole credentials, and maintained persistent access within the network, demonstrating advanced operational capabilities. Notably, the group used Yandex Cloud, a legitimate Russian cloud platform, to exfiltrate data, a tactic likely chosen to evade detection by blending malicious activity with normal network traffic. The use of Yandex Cloud is particularly effective in Russia, as it is a trusted domestic service and unlikely to be blocked or scrutinized by local enterprises. Technical analysis revealed that the attackers leveraged a renamed version of Microsoft Console Debugger (cdb.exe) to run shellcode, bypass application allowlisting, and disable security solutions, further highlighting the sophistication of the operation. The campaign is assessed to be part of a broader espionage effort, with no evidence of financial motivation. Researchers also observed the deployment of advanced malware, including FINALDRAFT (aka Squidoor), capable of infecting both Windows and Linux systems, and noted the possible development of new backdoors during related intrusions. The breach underscores that Russia is not immune to Chinese cyber espionage, despite close diplomatic and economic ties between the two countries. The incident has raised concerns about the security of Russian government and corporate networks, particularly those relying on IT service providers for software distribution and network management. The potential for a supply chain attack means that dozens of Russian companies could have been exposed to further compromise. The Jewelbug group’s operations reflect a growing trend of state-sponsored actors targeting IT service providers to maximize access and impact. The incident also highlights the importance of monitoring legitimate cloud services for signs of abuse in cyber operations. Security experts recommend heightened vigilance and improved monitoring of software build environments and cloud service usage to detect and mitigate similar threats. The breach serves as a reminder that geopolitical alliances do not guarantee immunity from cyber espionage activities. Ongoing analysis is expected to reveal further details about the attackers’ methods and the full scope of the compromise.
Jun 29, 2026
A House committee report found that **China Telecom Americas, China Mobile USA, and China Unicom Americas** remained operationally dependent on parent companies in China or Hong Kong while still maintaining equipment, transmission hardware, points of presence, and active network assets inside the United States. Investigators said those lingering interconnections and private leases persisted despite federal restrictions, raising concerns that routing, service provisioning, and oversight of U.S.-based infrastructure could still be influenced from abroad. The report also linked the carriers to entities that U.S. authorities and researchers have associated with Chinese state-backed cyber activity, including **CloudRadium**, **Integrity Technology Group**, and **i-SOON**. Separate reporting on the 2024 **i-SOON** leak said internal chats, sales materials, and malware documentation appeared genuine and tied the company to previously reported Chinese espionage operations, including overlaps with **Comm100** supply-chain activity, **POISON CARP**, **ShadowPad** infrastructure, and a Linux malware controller called **Treadstone**. Together, the findings sharpen concerns that commercial Chinese telecom and security firms can preserve access and support capabilities that complicate efforts to remove national-security risks from U.S. networks.
Aug 8, 2026