Loading story…
CrowdStrike reported an intrusion campaign targeting telecommunications and business process outsourcing (BPO) companies, indicating a focused effort against organizations that handle large volumes of communications and customer data. The activity was significant because these sectors often provide attackers with access to sensitive internal systems, subscriber information, and downstream enterprise environments.
The reporting describes a coordinated operation rather than isolated incidents, with attackers pursuing access into multiple companies in the telecom and BPO space. The campaign highlights the continued attractiveness of service providers and outsourced operations as high-value targets for espionage and follow-on compromise, where a single intrusion can expose both the victim organization and its customers.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
CrowdStrike released a public blog post analyzing an intrusion campaign targeting telecommunications and business process outsourcing companies. The reference does not provide additional dated milestones, so the publication itself is the only distinct event extractable from the provided content.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nation-state and **advanced persistent threat (APT)** activity is increasingly extending beyond traditional government and military targets to include private companies and **critical national infrastructure**. The reporting highlights a shift toward long-term intrusions aimed at intelligence collection, strategic influence, economic advantage, and disruption, with private-sector networks, infrastructure providers, and technology firms now treated as operationally valuable targets. Critical services such as energy, water, telecommunications, transport, and healthcare are described as especially exposed because attacks on even a small component can create wider societal and political effects. The coverage also emphasizes that these campaigns often avoid noisy malware or immediate disruption, instead relying on **legitimate credentials**, trusted third-party access, and existing business tools to maintain persistent access across identities, cloud platforms, SaaS environments, and supplier ecosystems. One example cited is the attack on Collins Aerospace's **ARINC cMUSE** airline check-in and boarding software, which disrupted passenger boarding at several European airports and illustrated how compromising a supporting technology provider can produce broad downstream impact. Defenders are urged to move beyond incident-driven response and strengthen continuous visibility, exposure management, and threat-informed monitoring across interconnected enterprise and infrastructure environments.
Jun 29, 2026
CrowdStrike reported that two financially motivated threat groups tied to **The Com** — **Cordial Spider** and **Snarky Spider** — are carrying out rapid data-theft and extortion campaigns against U.S.-based organizations across critical infrastructure and enterprise sectors, including aviation, retail, hospitality, financial services, legal, technology, automotive, and academia. The actors are closely aligned with the **Scattered Spider** playbook and have used voice phishing, text messages, email, and other social-engineering tactics since at least October 2025 to compromise identity platforms, steal credentials, session keys, and tokens, and pivot through victims’ SaaS environments. Ransom demands have reportedly reached seven figures, and some victims have also faced **DDoS** attacks or swatting. The intrusions rely on adversary-in-the-middle phishing pages that mimic legitimate single sign-on and identity-provider portals, enabling access to services such as **SharePoint**, **HubSpot**, and **Google Workspace** while largely bypassing traditional endpoint defenses. After gaining access, the attackers register their own MFA devices or emulators, disable or suppress alerts through inbox rules and email deletion, and move quickly to search for sensitive data and exfiltrate it, in some cases within an hour of initial access. Researchers said the groups differ in tradecraft — including operating hours, phishing infrastructure, leak sites, and MFA-registration methods — while both use commercial VPNs and residential proxy networks such as **Mullvad**, **Oxylabs**, **NetNut**, **9Proxy**, **Infatica**, and **NSOCKS** to blend into normal traffic and evade detection.
Jun 29, 2026
China-linked hacking groups were reported to have penetrated a wide range of targets across the United States and allied regions, including manufacturers, U.S. government email systems, internet providers, and major telecommunications networks. Earlier reporting described broad economic espionage aimed at stealing trade secrets from manufacturing sectors in the U.S., Europe, and Asia, while later disclosures said Chinese operators breached U.S. government email accounts through Microsoft cloud infrastructure and infiltrated American internet providers for surveillance. Subsequent investigations tied the telecom intrusions to the **Salt Typhoon** campaign, which officials said exposed sensitive metadata and provided insight into U.S. surveillance targets. U.S. officials characterized the activity, alongside related operations such as **Volt Typhoon**, as one of the most serious cyber threats to American critical infrastructure in recent years. Reporting said investigators believed the attackers may have retained access to at least eight telecom firms, including **Verizon** and **AT&T**, and that the campaign extended to dozens of telecoms and government agencies. In response, the Biden administration moved to bar the remaining U.S. operations of **China Telecom Americas**, citing national security risks and signaling the first public retaliatory step tied to the telecom compromises, even as debate continued over broader sanctions, technology restrictions, and offensive cyber responses.
Jun 29, 2026