Loading story…
A German security researcher showed that abandoned ENUM DNS infrastructure could be re-registered and used to intercept or reroute SIP-based telephone traffic for the country codes of St. Helena, Ascension Island, and the British Indian Ocean Territory. By taking control of the deleted domain enum.org.uk, which was still referenced by one of the authoritative nameservers for those ENUM zones, she gained the ability to answer ENUM lookups for affected numbers and potentially perform a man-in-the-middle attack on call routing.
After initially seeing no activity, the researcher later observed more than 100,000 ENUM queries, largely originating from the United States, including lookups for numbers associated with Diego Garcia and Ascension Island, where U.K. and U.S. military facilities are located. The findings indicate that at least one U.S. telecom provider was still relying on the stale ENUM path, creating a risk that calls involving military personnel and their families could have been exposed; after disclosure efforts stalled, the U.K. NCSC assumed control of the domain and parked it, while the case also highlighted broader decay across legacy country-specific ENUM deployments.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
In March, the UK National Cyber Security Centre took interest in the issue and had the domain transferred away from Lina. The recovered domain is now parked on a blank country page, ending her control over the affected ENUM responses.
Lina tried to report the issue through responsible channels but encountered bureaucratic obstacles. RIPE NCC said it was not the competent authority and referred her to the ITU-T, while British authorities initially did not respond.
In the later post-mortem, the researcher said roughly 400,000 ENUM queries had been accidentally collected over about six months, nearly all tied to Diego Garcia and Ascension Island. The source says many resolver IPs were predominantly American and corresponded to military bases, indicating broader exposure than initially described.
About six months later, Lina observed more than 100,000 ENUM queries for numbers on Diego Garcia and Ascension Island. Most queries came from the United States, indicating that at least one U.S. telecom provider was still attempting to route calls through ENUM for those territories.
After taking control of the domain, Lina monitored the infrastructure and saw no ENUM traffic for St. Helena within one day. This suggested the abandoned setup might be unused, at least initially.
Lina found that enum.org.uk, a deleted nameserver domain for the ENUM zones of St. Helena, Ascension Island, and the British Indian Ocean Territory, was available and re-registered it. This gave her the ability to answer ENUM queries for those territories and created the conditions for call interception or rerouting via attacker-controlled SIP infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberveille.ch
Open sourceheise.de
Open sourcelina.sh
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA and Mandiant reported a global **DNS infrastructure hijacking** campaign in which attackers used compromised DNS-management credentials to alter victim **A**, **MX**, and **NS** records, redirecting web and email traffic to attacker-controlled systems. The activity affected dozens of domains linked to government, telecommunications, and internet infrastructure organizations across the Middle East and North Africa, Europe, and North America, enabling interception, manipulation, and man-in-the-middle access to sensitive communications. Investigators said the campaign operated at scale over an extended period and in some cases allowed the attackers to obtain valid **TLS certificates** for victim domains, letting them decrypt redirected traffic without triggering browser warnings. Mandiant said the infrastructure and access patterns suggest a likely nexus to Iran and alignment with Iranian government interests, while noting the activity may involve multiple operational clusters. CISA urged organizations to reset DNS account passwords, enable **multifactor authentication**, audit public DNS records, and revoke any fraudulent certificates tied to affected domains.
Aug 15, 2026
Citizen Lab reported two covert surveillance campaigns that exploited weaknesses in global mobile signalling infrastructure to track targets’ locations across borders. The operations, labeled **STA1** and **STA2**, abused legacy `SS7` and newer `Diameter` protocols, with one campaign also using **SIMjacker-style zero-click binary SMS** and malicious SIM Toolkit commands to try to turn a handset into a covert beacon. Researchers said the activity marks the first time real-world attack traffic has been directly linked to mobile operator signalling systems, showing attackers impersonating operators, rotating identities across countries, manipulating routing paths, and evading signalling firewalls while exploiting weak authentication and trusted telecom interconnect relationships. The campaigns were observed using operator identifiers and infrastructure tied to networks in Europe, Africa, the Middle East, and Asia, including telecoms cited as transit or entry points such as **019Mobile**, **Tango Networks U.K.**, and **Airtel Jersey**. Citizen Lab said the activity is consistent with commercial surveillance platforms serving government intelligence customers, and one campaign may have links to an Israeli geo-intelligence provider, though no vendor or operator was conclusively attributed. The researchers warned that abuse of leased or intermediary signalling access, combined with long-standing flaws in roaming trust models, has enabled large volumes of hard-to-detect location tracking that may persist for years across 3G, 4G, and 5G-connected environments.
Aug 24, 2026
Researchers exposed a major **OPSEC failure** by **FancyBear**/**APT28** that revealed an active espionage operation, tracked as **Operation Roundish**, targeting government and military organizations across Europe. An exposed **NameCheap VPS** at `203.161.50.145`, previously linked to the group by **CERT-UA**, remained in use for more than 500 days and contained a publicly accessible directory with stolen data and operational artifacts. Hunt.io first documented the campaign from an exposed directory scan, and follow-on analysis found the same infrastructure held **2,800+ exfiltrated emails**, **240+ stolen credential sets** including passwords and **TOTP 2FA secrets**, **140+ malicious email-forwarding rules**, and **11,500+ harvested contact addresses** from victim mailboxes. Further investigation uncovered a second exposed directory on the same server containing **FancyBear’s C2 source code**, additional JavaScript payloads, telemetry logs, and evidence of broader collection activity. The operation affected entities in **Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia**, including addresses associated with **four NATO member states** and NATO-linked targets. Researchers also reported a previously unreported **SquirrelMail XSS payload**, indicating the campaign targeted multiple webmail platforms and used mailbox compromise, silent forwarding, and credential theft to sustain long-term intelligence collection.
Jun 29, 2026