Loading story…
Luxembourg officials said malware infected the mobile device management system used by the State Centre for Information Technology (CTIE), affecting thousands of government-owned smartphones and tablets. Digitalisation minister Stéphanie Obertin said the malware was discovered on 26 February and publicly confirmed the next day after investigators found it had been active since late January, remaining undetected for nearly a month.
Authorities said the malware was memory-resident and appears to have compromised the management platform just hours before the service provider updated the system at the end of January. The incident exposed an inventory of state-managed mobile devices and associated user and device data, but officials said it did not access content stored on the phones and tablets such as messages, calendars, or photos; the affected systems have since been updated and secured.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Following the discovery, Luxembourg authorities updated and secured the affected systems to contain the incident. The response came after the compromise of the state mobile device management environment was identified.
Luxembourg publicly confirmed the breach on 27 February after identifying malware on the CTIE mobile device management system. Officials said messages, calendars, and photos stored on devices were not affected.
Authorities discovered the malware on 26 February on the system used to manage smartphones and tablets for the public sector. The incident was found to have exposed the list of state-managed devices and related user and device data.
A memory-resident malware infected the mobile device management system used by Luxembourg's State Centre for Information Technology (CTIE) a few hours before the provider updated that system at the end of January. The compromise affected the platform used to manage thousands of government-owned smartphones and tablets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **European Commission** disclosed it is investigating a breach after detecting traces of an attack against its central **mobile device management (MDM)** infrastructure used to administer staff mobile devices. The Commission said the incident was contained and the system cleaned within **nine hours**, and it has not found evidence that managed mobile devices themselves were compromised; however, attackers may have accessed limited staff personal data such as **names and mobile phone numbers**. The activity appears consistent with a broader set of intrusions affecting European public-sector bodies tied to vulnerabilities in **Ivanti Endpoint Manager Mobile (EPMM)**. Dutch authorities reported that the **Dutch Data Protection Authority** and the **Council for the Judiciary/Justice** experienced nearly identical breaches in which unauthorized parties exploited an Ivanti EPMM software flaw to access employee data, including **names, email addresses, and phone numbers**, suggesting a shared exploitation vector across multiple European institutions’ MDM deployments.
Jun 29, 2026
Check Point Research reported malware observed in the wild using a corporate **mobile device management (MDM)** platform as an attack vector, turning a trusted enterprise administration channel into a delivery mechanism for malicious activity on managed mobile devices. The finding highlighted how attackers could exploit the high level of trust and control granted to MDM systems to push harmful configurations or software through infrastructure normally used for legitimate device enrollment, policy enforcement, and application deployment. The report underscored the risk to organizations that rely on MDM to secure employee smartphones and tablets, because compromise or abuse of that management layer can give attackers broad reach across corporate mobile fleets. By leveraging enterprise management tooling rather than traditional phishing or rogue app distribution alone, the campaign demonstrated that mobile security programs must also protect backend administration systems and monitor MDM activity for signs of unauthorized or malicious use.
Jul 12, 2026
A previously undisclosed flaw in Huawei enterprise router software was reportedly exploited to cause a nationwide telecom outage in Luxembourg, knocking out POST Luxembourg landline, 4G, 5G, and emergency communications for more than three hours. Investigators said specially crafted traffic passing through POST’s infrastructure forced Huawei routers into continuous reboot loops, and POST described the incident as a denial-of-service attack abusing a non-public, undocumented behavior rather than a conventional volumetric DDoS or any previously known vulnerability. Authorities, Huawei, and European incident response partners reportedly coordinated on the case, but no public `CVE` or broad advisory has been issued and no criminal charges have been announced. Investigators found no evidence that POST Luxembourg was specifically targeted and no confirmed signs of wider exploitation, yet reporting indicates no patch was available at the time and it remains unclear whether the flaw has since been fully remediated or whether other telecom operators could still be exposed.
Jun 29, 2026