Every published record in the TelcoSec archive — search by keyword, filter by security pillar or traffic plane.
Francois and Joseph Blanc hijacked the French optical telegraph network by bribing operators to insert deliberate backspace/error codes into stock market transmissions. The scheme ran for roughly two years before being exposed in 1836, making it the first documented attack combining an insider, a covert channel, and a financial network.
Samuel Morse transmitted the first message ("What hath God wrought") over the Baltimore–Washington line on May 24, 1844, exposing physical wiretapping along unencrypted DC lines almost immediately.
John & Jacob Brett laid the first subsea cable across the English Channel between Dover and Calais, connecting the British and French telegraph networks on August 28, 1850.
On 17 May 1865, after a conference running from 1 March, twenty European states signed the first International Telegraph Convention in Paris and created the International Telegraph Union — the body that became today's ITU.
After the 1858 cable died within weeks and the 1865 attempt snapped mid-ocean, SS Great Eastern left Valentia on 13 July 1866 and spliced the cable ashore at Heart's Content, Newfoundland, on 27 July 1866 — the first durable transatlantic link. The lost 1865 cable was grappled up and completed that September.
Alexander Graham Bell was granted US Patent 174,465 for the telephone, introducing analog voice circuits that immediately opened new attack surfaces for inductive and galvanic eavesdropping.
Undertaker Almon Strowger patented the first automated stepping switch after suspecting manual telephone operators were diverting his business calls to a competing undertaker.
Illusionist and wireless pioneer Nevil Maskelyne intercepted and injected sarcastic Morse code insulting Guglielmo Marconi during a live demonstration at the Royal Institution in London, proving that open radio channels lacked origin authentication.
After RMS Titanic sank in April 1912, Congress amended the Wireless Ship Act on 23 July 1912 (two operators, continuous watch, auxiliary power) and passed the Radio Act on 13 August 1912, requiring federal licences for all US radio stations.
Within hours of Britain's declaration of war (11 p.m., 4 August 1914), the GPO cable ship CS Alert grappled and cut Germany's telegraph cables in the English Channel, forcing German traffic onto radio and neutral routes that Britain could intercept. Many accounts wrongly credit CS Telconia.
The British GPO cable ship CS Alert severed Germany's direct transatlantic subsea cables at the outbreak of WWI, forcing German diplomatic messages onto neutral cables transiting British landing stations where Room 40 intercepted the Zimmermann Telegram.
On 23 February 1918, German engineer Arthur Scherbius filed a patent for a rotor cipher machine that became the Enigma, marketed from 1923 by Chiffriermaschinen AG to businesses for enciphering written and telegraphic messages before transmission.
Signed by President Roosevelt on 19 June 1934, the Communications Act abolished the Federal Radio Commission and created the Federal Communications Commission, uniting regulation of interstate telephone, telegraph and radio under one agency.
US Patent 2,292,387, filed on 10 June 1941 and granted on 11 August 1942, described a radio guidance link for torpedoes that hopped between carrier frequencies in step at transmitter and receiver to resist jamming. The US Navy did not adopt it during the war.
Bell Labs and Alan Turing developed SIGSALY (Project X), the world's first digital voice encryption terminal, securing high-level Allied communications between Washington and London during WWII.
Shannon's paper in the Bell System Technical Journal (vol. 28, no. 4, October 1949, pp. 656–715) put cryptography on a mathematical footing. It was a declassified version of his confidential 1945 Bell Labs report "A Mathematical Theory of Cryptography".
TAT-1 (Transatlantic No. 1) was inaugurated between Oban, Scotland and Clarenville, Newfoundland, providing 36 simultaneous telephone circuits and replacing erratic HF radiotelephone links.
Seven-year-old blind boy Joe Engressia discovered that whistling an exact 2600 Hz pitch into a receiver reset AT&T toll trunk lines, founding the phone-phreaking movement.
Launched on 10 July 1962 (a privately funded AT&T satellite launched by NASA), Telstar 1 relayed the first public live transatlantic television on 23 July 1962. Radiation from the US Starfish Prime high-altitude nuclear test, detonated the day before launch, contributed to its command system failing in November 1962.
John Draper ("Captain Crunch"), Steve Wozniak, Steve Jobs and others built Blue Boxes that emitted 2600 Hz plus MF digit tones to make free global calls, industrializing the SF signaling flaw.
In a decision adopted on 26 June 1968 (13 F.C.C.2d 420), the FCC held that AT&T's tariff ban on customer-supplied equipment was unreasonable and unlawful, allowing devices like Thomas Carter's Carterfone to connect to the telephone network.
Ron Rosenbaum published 'Secrets of the Little Blue Box' in Esquire, exposing the technical mechanics of 2600 Hz phone phreaking, Captain Crunch, and homebrew Blue Box construction to a global audience.
US Navy & NSA divers wrapped a 6-ton inductive recording pod around a submerged Soviet military cable in the Sea of Okhotsk, capturing traffic for nearly a decade.
On 29 October 1975, NSA Director Lew Allen publicly confirmed to the Church Committee that, from 1945 to May 1975, the major US international telegraph carriers secretly passed copies of international telegrams to the NSA without warrants (SHAMROCK). Watch lists including US citizens were run against this traffic (MINARET).
AT&T deployed Common Channel Interoffice Signaling (CCIS) across its toll network, separating call control signaling into a dedicated data network and neutralizing acoustic blue box toll fraud.
Phreakers engineered specialized Red Boxes simulating payphone coin drop frequencies (1700 Hz + 2200 Hz) and Silver Boxes with modified DTMF keypads to seize military Autovon priority override circuits.
Judge Harold Greene ordered the breakup of AT&T's monopoly into 7 Regional Bell Operating Companies (Baby Bells), creating multi-operator interconnects and new signaling boundaries.
Ameritech launched the first commercial 1G AMPS cellular network in Chicago, but cleartext transmission of ESN and MIN identifiers quickly led to widespread over-the-air cellular cloning.
In January 1984, Eric Corley (writing as "Emmanuel Goldstein") and David Ruderman began publishing 2600: The Hacker Quarterly. The title refers to the 2600 Hz trunk-seizure tone, and the first issue appeared in the same month AT&T was broken up. Phrack followed on 17 November 1985, published on the St. Louis "Metal Shop" BBS.
John R. MacDougall overpowered HBO's satellite broadcast feed with a 2,000-watt transmitter to protest unscrambling subscription fees, exposing commercial satellite uplink vulnerabilities.
Astronomer Clifford Stoll traced a 75-cent accounting error at Lawrence Berkeley Lab to a hacker in Hannover, Germany using international X.25 network gateways to spy for the Soviet KGB.
An unknown pirate broadcaster overpowered the terrestrial microwave Studio-Transmitter Links (STL) of WGN-TV and PBS station WTTW in Chicago, broadcasting distorted Max Headroom audio and video into thousands of homes.
CCITT standardized the SS7 protocol suite in 1988 across mobile and fixed networks, built on implicit operator trust with no authentication — the root cause of every later signaling attack.
On 12 August 1988, Duncan Campbell's New Statesman article "Somebody's Listening" (headlined inside as "They've got it taped") was the first press report to name ECHELON. It described an NSA-run global system, identified as Project P415, to monitor civilian communications, drawing on disclosures by Lockheed engineer Margaret Newsham about RAF Menwith Hill.
TAT-8 became the first transoceanic fiber-optic cable in service, scaling transatlantic telecommunications capacity to 40,000 circuits and revolutionizing global data connectivity.
A single line of buggy C code in a 4ESS switch patch caused a cascading SS7 recovery storm on January 15, 1990, dropping roughly 60 million calls over nine hours.
In 1990 US federal agents moved against the phreaking underground: Legion of Doom member Robert Riggs ("The Prophet") and Phrack editor Craig Neidorf ("Knight Lightning") were indicted over a stolen BellSouth E911 document, while the separate, Arizona-based Secret Service Operation Sundevil raided BBS operators in about a dozen cities on 7–9 May 1990.
The European Telecommunications Standards Institute (ETSI) deployed 2G GSM, introducing digital subscriber identity modules (SIM cards) and the A5/1 stream cipher for over-the-air voice privacy.
On 16 April 1993 the White House announced the NSA-designed Clipper Chip, a voice-encryption chip whose keys would be escrowed with the government; it was adopted as FIPS 185 in February 1994, and in 1994 AT&T Bell Labs researcher Matt Blaze showed the escrow mechanism could be bypassed.
The Communications Assistance for Law Enforcement Act (CALEA) forced US telecom carriers to design their networks so that lawful interception could be performed on demand — embedding a permanent surveillance capability into the core of every switch.
Tsutomu Shimomura and the FBI tracked and arrested Kevin Mitnick in Raleigh, North Carolina using direction-finding antennas and cellular switchboard real-time ESN/MIN location triggers.
Underground syndicates commercialized "Clone King" EPROM modification kits, allowing widespread cellular subscription fraud and free international calls across North American carriers.
David Wagner and Ian Goldberg (UC Berkeley ISAAC Group) completely cracked the GSM COMP128-1 algorithm, allowing extraction of SIM master keys (Ki) and physical cloning of SIM cards.
After TFreak (Dan Moschuk) released smurf.c in October 1997, attackers spoofed ICMP Echo Requests to the directed-broadcast addresses of misconfigured networks, turning every responding host into an amplifier and flooding victims' uplinks — prompting CERT/CC Advisory CA-1998-01 in January 1998.
3GPP Release 99 standardized 3G UMTS, introducing bidirectional mutual authentication (3G AKA) to defeat rogue base stations (IMSI catchers) and replacing A5/1 with the KASUMI block cipher.
Elad Barkan, Eli Biham and Nathan Keller of the Technion presented "Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication" at CRYPTO 2003, recovering the A5/2 session key in less than a second on a PC from a few dozen milliseconds of encrypted over-the-air traffic.
In June 2004 F-Secure analysed Cabir, a proof-of-concept worm linked to the 29A virus-writing group and the first known worm for mobile phones, which spread between Symbian Series 60 handsets over Bluetooth; in March 2005 CommWarrior added self-propagation over operator MMS.
Rogue software patches in Vodafone Greece's Ericsson AXE-10 switches activated dormant Lawful Interception capability to wiretap the Greek Prime Minister and 100+ senior officials during the 2004 Athens Olympics period.
In February 2005, Paris Hilton's Sidekick address book, notes and photos — synchronized to Danger's servers and reachable through T-Mobile's customer website — were posted online after attackers took over her account. A Massachusetts teenager, later identified as Cameron LaCroix, pleaded guilty in September 2005.
In 2006 retired AT&T technician Mark Klein filed a sworn declaration and internal documents in EFF's Hepting v. AT&T lawsuit (filed 31 January 2006) describing a secret NSA-controlled room, 641A, at AT&T's San Francisco facility that received a copy of AT&T's internet backbone traffic.
On 26 December 2006 a magnitude ~7 doublet earthquake off Hengchun, southern Taiwan, triggered submarine landslides and turbidity currents that broke nine submarine cables in the Luzon Strait, badly impairing internet and voice links for China, Hong Kong, Taiwan, Singapore, Japan and the Philippines.
On 8 July 2008, Dan Kaminsky and DNS vendors released coordinated patches for a fundamental DNS cache-poisoning flaw (CVE-2008-1447, CERT VU#800113) affecting ISP resolvers worldwide; full details followed at Black Hat USA in August 2008.
On 24 February 2008, while implementing a domestic block on YouTube ordered by Pakistani authorities, Pakistan Telecom (AS17557) announced 208.65.153.0/24; upstream PCCW Global (AS3491) propagated it and most of the internet sent YouTube traffic to Pakistan for roughly two hours.
On 10 August 2008 at DEF CON 16, Alex Pilosov and Anton "Tony" Kapela showed in "Stealing The Internet: An Internet-Scale Man In The Middle Attack" that a BGP prefix hijack could be turned into a stealthy interception: they diverted traffic bound for the conference network to a system in New York and delivered it back to Las Vegas.
Ship anchor drags severed multiple major undersea optical cables simultaneously near Alexandria, knocking out 70% of Egypt's internet and 60% of India's international telecom capacity within minutes.
At the 25th Chaos Communication Congress in Berlin on 27 December 2008, Tobias Engel showed that anyone with SS7 access, or a cheap commercial HLR-lookup service, could locate a mobile subscriber to roughly city level without the owner's knowledge.
On 29 December 2008 at 25C3, Erik Tews, Ralf-Philipp Weinmann and Andreas Schuler of the deDECTed.org project showed that the secret security of DECT, the standard behind most cordless phones and many baby monitors and payment terminals, could be broken with cheap hardware.
Karsten Nohl and the Chaos Computer Club published a 2-terabyte rainbow-table set at 26C3 enabling real-time over-the-air decryption of A5/1-protected 2G GSM calls and SMS with inexpensive hardware.
On 8 April 2010 China Telecom's AS23724 originated about 37,000 prefixes it did not own for roughly 15–18 minutes, briefly drawing some traffic for US government, military and commercial networks through China; whether it was an accident or deliberate remains disputed.
At 27C3 (December 2010), Harald Welte and Steve Markgraf presented OsmocomBB, a free GSM baseband stack for cheap Calypso phones, while Karsten Nohl and Sylvain Munaut used such phones to capture and decrypt GSM calls with about $15 of consumer hardware.
Through 2009–2010, automated scanners swept the internet for SIP on UDP port 5060 and brute-forced extension credentials on exposed Asterisk and FreePBX systems; the SANS Internet Storm Center flagged the surge in July 2010, and in February 2011 the Sality botnet ran an internet-wide "sipscan" from about 3 million hosts. Compromised PBXs were used to pump calls to high-cost international and premium-rate numbers.
An intruder breached Dutch certificate authority DigiNotar in 2011 and issued 531 fraudulent certificates for 344 domains, including *.google.com, which was then used in a man-in-the-middle attack on roughly 300,000 users — more than 99% of them in Iran — according to Fox-IT's "Operation Black Tulip" investigation.
At 22:34 UTC on 27 January 2011 (00:34 on 28 January in Cairo) Egypt's ISPs withdrew nearly all their BGP routes, and on 28 January the government ordered Vodafone, Mobinil and Etisalat to suspend mobile services in specified areas; internet routes returned on 2 February.
On 4 July 2011 the Guardian reported that a private investigator working for the News of the World had accessed the voicemail of murdered schoolgirl Milly Dowler; the paper closed on 10 July and the government set up the Leveson Inquiry, which reported in November 2012.
In September 2011 the Wall Street Journal reported that the FBI had located fraud suspect Daniel Rigmaiden with a "StingRay" cell-site simulator, and his court challenge became the first U.S. case to test the device; EPIC's 2012 FOIA suit then forced release of FBI StingRay records (2012–2013), and ACLU public-records work (2014–2015) showed widespread, often warrantless state and local use.
At IEEE Security & Privacy 2012, Driessen, Hund, Willems, Paar and Holz (Ruhr-University Bochum) published the first public analysis of the secret ciphers protecting GMR-1 and GMR-2 satellite phone calls and showed both were weak.
The US House Permanent Select Committee on Intelligence published a bipartisan investigative report concluding that Huawei and ZTE equipment posed systemic national security risks to critical telecom backbones.
Snowden disclosures revealed GCHQ's TEMPORA and NSA's MUSCULAR programs, which installed passive optical beam splitters on transatlantic fiber cables and inter-datacenter backhauls.
British intelligence agency GCHQ compromised Belgian telecom provider Belgacom (Proximus) using Quantum Insert packet injection to intercept European Union and NATO mobile data roaming sessions.
Positive Technologies' 2014 report "Vulnerabilities of Mobile Internet (GPRS)", publicized in February 2015, showed that GPRS Tunnelling Protocol (GTP) nodes reachable from the internet and the GRX roaming network let attackers brute-force subscriber identities, hijack or block mobile data sessions and obtain subscriber data — building on P1 Security's 2011 "Attacking GRX" research. A 2020 Positive Technologies assessment found every one of 28 tested operators still exploitable via GTP.
Symantec and Kaspersky exposed Regin, an extraordinarily sophisticated nation-state malware platform specifically engineered to infiltrate GSM cellular base station controllers and telecom routing cores.
Tobias Engel and SRLabs demonstrated at 31C3 that SS7 design flaws allow global subscriber location tracking, call interception, and SMS 2FA theft using legally obtainable access to the signaling network.
On 17 December 2015 Juniper disclosed "unauthorized code" in ScreenOS: an administrative authentication backdoor (CVE-2015-7755) and a change enabling passive decryption of VPN traffic (CVE-2015-7756).
At Hackito Ergo Sum in Paris (October 2015), P1 Security researchers Laurent Ghigonis and Philippe Langlois showed a remotely exploitable flaw in an LTE Diameter Routing Agent, one of the first public demonstrations that 4G Diameter signaling inherited SS7-style interconnect trust problems; Nokia Bell Labs (2016) and Positive Technologies (2018) then published Diameter location-tracking and denial-of-service attacks over IPX interconnects.
On 9 September 2015 Kaspersky Lab reported that the Russian-speaking Turla APT had, since as early as 2007, hidden its command-and-control servers behind IP addresses of legitimate satellite internet subscribers, mostly of DVB-S providers in the Middle East and Africa.
Joshua Drake of Zimperium zLabs disclosed in July 2015 a set of critical memory-corruption flaws in Android's Stagefright media library — CVE-2015-1538 plus the related CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829 and CVE-2015-3864 — that let an attacker run code on an estimated 950 million phones via a single silently received MMS video.
On 19 February 2015 The Intercept, citing Snowden documents, reported that a joint NSA–GCHQ team had penetrated Gemalto, the world's largest SIM maker, to steal the Ki keys used to secure mobile communications; Gemalto said a 2010–2011 operation "probably happened" but denied massive key theft.
Daniel Roesler's 2015 proof-of-concept showed that the WebRTC JavaScript APIs in Chrome and Firefox let any web page collect a user's private LAN addresses and real public IP — even behind an active VPN. The behaviour had already been tracked by Mozilla as Bugzilla 959893 ("WebRTC Internal IP Address Leakage"); it was treated as a privacy design issue and received no CVE.
On 17 April 2016, CBS 60 Minutes aired "Hacking Your Phone," in which Karsten Nohl's SRLabs team in Berlin, knowing only the number of an iPhone lent to Rep. Ted Lieu (with his consent), tracked the device and recorded his calls via SS7.
On 21 October 2016, waves of DDoS traffic from the Mirai botnet hit Dyn's Managed DNS platform, making Twitter, Reddit, GitHub, Netflix, PayPal and other Dyn customers unreachable for many users in North America and Europe.
Cybercriminals abused SS7 roaming interfaces to intercept bank-issued SMS one-time passcodes (OTPs), draining accounts of customers at O2 Germany and Metro Bank UK.
On 24 April 2018, attackers announced Amazon Route 53 address space from eNet (AS10297), a hosting provider in Columbus, Ohio, hijacking DNS for MyEtherWallet.com for about two hours and stealing roughly $150,000 in Ether.
At ACM CCS 2018 (Toronto, October 2018), Basin, Dreier, Hirschi, Radomirović, Sasse and Stettler presented the first comprehensive formal model of 3GPP 5G AKA and showed several critical security goals are not met without assumptions missing from the standard.
Cybereason revealed Operation Soft Cell, a massive multi-year cyber espionage campaign by suspected nation-state actors that completely compromised multiple telecommunications providers to exfiltrate raw subscriber Call Detail Records.
In June 2018, researchers from Ruhr University Bochum and NYU Abu Dhabi (Rupprecht, Kohls, Holz, Pöpper) disclosed that LTE user-plane traffic is encrypted but not integrity-protected, allowing a nearby man-in-the-middle relay to redirect a victim's DNS traffic.
In May 2019 U.S. prosecutors in Michigan charged six members of the hacking group "The Community" and three former mobile-carrier employees (two at AT&T stores, one at Verizon) over SIM swaps used to steal more than $2.4 million in cryptocurrency, documenting insider bribery as a SIM-swap channel. The pattern persisted: the FCC adopted SIM-swap and port-out rules in November 2023, and in November 2025 the Manhattan DA indicted a ring that included four AT&T and T-Mobile store employees.
The GSM Association launched its formal Coordinated Vulnerability Disclosure (CVD) program and Hall of Fame, establishing standard operating procedures for researchers to responsibly report 2G–5G protocol and core vulnerabilities.
CrowdStrike revealed that the LightBasin (UNC1945) APT had compromised 13+ global telecom operators since at least 2016 using custom GTP and SS7 tooling to masquerade as roaming infrastructure.
AdaptiveMobile Security disclosed Simjacker, an exploit abusing legacy S@T Browser technology on SIM cards across 30+ countries to track subscriber location without user awareness.
On 30 August 2019 the "Chuckling Squad" took over Jack Dorsey's @jack account and posted offensive tweets; Twitter blamed "a security oversight by the mobile provider" that let attackers control the phone number tied to the account.
An attacker only had to ring a WhatsApp call. NSO Group's Pegasus implant was delivered to ~1,400 targets through a buffer overflow in the VoIP call stack — the victim never had to answer, and the missed-call log was the only trace.
With the Release 16 freeze on 3 July 2020, 3GPP completed its Enablers for Network Automation (eNA) work, defining the 5G Core Network Data Analytics Function (NWDAF) in TS 23.288 — including abnormal UE behaviour analytics that operators can feed into policy and security decisions.
5G Standalone (Release 16, 2020) replaced SS7/Diameter trust assumptions with HTTP/2 service-based APIs over TLS, OAuth 2.0 token authentication, and cryptographically concealed subscriber identities (SUCI).
On 31 March 2020 the FCC adopted its First Caller ID Authentication Report and Order (FCC 20-42), implementing the December 2019 TRACED Act by requiring voice providers to deploy STIR/SHAKEN in the IP portions of their networks by 30 June 2021.
On 1 April 2020 at about 19:28 UTC, Russian operator Rostelecom (AS12389) announced roughly 8,800 prefixes belonging to about 200 networks, including Akamai, Cloudflare, Amazon AWS, Hetzner and DigitalOcean, for about an hour.
On 4 October 2021, Facebook, Instagram, WhatsApp and Messenger went offline worldwide for about six hours after a maintenance command disconnected Facebook's backbone and its DNS servers withdrew their BGP routes.
In August 2021 T-Mobile US confirmed a breach, later sized at about 76.6 million current, former and prospective customers, exposing names, dates of birth, Social Security numbers and driver's licence data; John Binns, a US citizen living in Turkey, claimed responsibility.
A global consortium of journalists revealed that NSO Group's Pegasus spyware had targeted 50,000+ phone numbers across 50 countries, utilizing zero-click SMS/iMessage parser vulnerabilities.
On 16–17 April 2021, Vodafone Idea Ltd's AS55410 suddenly originated more than 30,000 prefixes it did not own — against roughly 824 normally — including address space of Google, Microsoft, Akamai, Cloudflare and Fastly, producing a 13x surge of inbound traffic into its Indian network.
The 15 January 2022 eruption of the Hunga Tonga–Hunga Ha'apai submarine volcano broke the Tonga Cable to Fiji, the kingdom's only international fiber link, largely cutting Tonga off from outside communication for about five weeks.
Between 17 and 20 September 2022 an attacker extracted customer records from Australian carrier Optus via an Internet-facing API; Optus said up to 9.8 million records were affected, while the ACMA later cited over 9.5 million current and former customers.
On 8 July 2022, a configuration change in Rogers Communications' IP core caused a nationwide outage lasting more than a day for over 12 million wireless and wireline customers, disrupting 911 calls, Interac debit payments and some government services.
Minutes before Russia's invasion on 24 February 2022, a wiper attack against Viasat's KA-SAT ground infrastructure took roughly 45,000 modems offline across Ukraine and Central Europe — the first major cyber-physical attack on a civilian satellite network during wartime.
On 7–8 October 2023 the Balticconnector gas pipeline between Finland and Estonia, a Finland–Estonia telecom cable and the Sweden–Estonia EE-S1 cable were damaged in the Gulf of Finland and off Hiiumaa; Finland's National Bureau of Investigation recovered a ship's anchor beside the pipeline and linked the damage to the Hong Kong-flagged container ship Newnew Polar Bear.
On 12 December 2023 a destructive cyberattack disabled mobile and home-internet service for roughly 24 million Kyivstar subscribers for days; Ukraine's SBU attributed it to Russian military intelligence's Sandworm group.
In July 2023 Dutch firm Midnight Blue published TETRA:BURST, five vulnerabilities in the secret cryptography of TETRA radio used by police, militaries and critical infrastructure, including a TEA1 property that reduces its 80-bit key to 32 bits of effective entropy.
Two submarine communications cables connecting Taiwan to the Matsu Islands were severed by Chinese fishing and cargo vessels within six days, disconnecting 14,000 residents from broadband internet.
On 24 May 2023 Microsoft and a joint NSA/CISA/FBI and Five Eyes advisory (AA23-144A) exposed Volt Typhoon, a China state-sponsored actor targeting communications and other critical infrastructure in Guam and the United States since mid-2021.
Days before the New Hampshire primary, a cloned AI voice of President Biden urged Democrats not to vote. The FCC responded within weeks by ruling that AI-generated voices are "artificial" under the Telephone Consumer Protection Act — making AI voice robocalls illegal outright.
In a 12 July 2024 SEC 8-K, AT&T disclosed that attackers copied call and text records of nearly all its wireless customers (about 109–110 million) from May–October 2022 and 2 January 2023, taken from its workspace on a third-party cloud platform later identified as Snowflake.
Two major submarine optical fiber cables connecting Finland to Germany and Lithuania to Sweden were physically severed in the Baltic Sea by an anchor dragged by the Chinese bulk carrier Yi Peng 3.
On 19 November 2024, alongside Adam Meyers' testimony to the US Senate Judiciary Committee, CrowdStrike named LIMINAL PANDA, an actor targeting telecom providers in South Asia and Africa since at least 2020, and reassigned some activity previously attributed to LightBasin to it.
A multinational firm's Hong Kong branch lost $25.6 million (HK$200M) after an employee was deceived into authorizing wire transfers during a video conference where every other participant was an AI-synthesized real-time deepfake.
On 17 and 18 September 2024, thousands of pagers and then handheld radios used by Hezbollah members exploded across Lebanon and parts of Syria, killing dozens, including children, and injuring thousands; Israel's prime minister later confirmed approving the operation.
A dragging anchor from the struck cargo ship Rubymar severed three major submarine cables in the Bab-el-Mandeb Strait, disrupting 25% of data traffic between Asia, the Middle East, and Europe.
Attackers executed an unauthorized SIM swap against the phone number tied to the US SEC official X account, broadcasting a fraudulent Bitcoin ETF approval that caused hundreds of millions in market swings.
Chinese APT group Salt Typhoon breached the core networks of major US telecom providers — AT&T, Verizon, Lumen and others — reaching CALEA lawful-intercept systems and sustained metadata and audio collection across at least nine carriers.
In May 2024, WPP chief executive Mark Read disclosed that fraudsters had used a voice clone and YouTube footage of him in a Microsoft Teams meeting, set up via a WhatsApp account bearing his photo, to try to get an agency leader to set up a new business and hand over money and personal details; the attempt failed. On 8 May 2024 the FBI San Francisco field office warned of escalating AI-enabled phishing and voice/video cloning scams.
NIS2 (Directive (EU) 2022/2555) had to be transposed by 17 October 2024, bringing public electronic communications networks and services, IXPs, DNS and other digital-infrastructure providers under mandatory risk-management and incident-reporting duties. After letters of formal notice to 23 Member States in November 2024, the Commission sent reasoned opinions to 19 on 7 May 2025; in July 2026 it referred Ireland, Spain, France and the Netherlands to the EU Court of Justice.
SpaceX Starlink and T-Mobile rolled out commercial Direct-to-Cell satellite service, deploying LEO satellites equipped with onboard 3GPP eNodeB cellular base stations connecting standard unmodified LTE/5G smartphones from space.
In May 2025, after a photo showed national security adviser Mike Waltz using TeleMessage's modified Signal app, 404 Media reported a hacker had accessed archived messages from its servers; owner Smarsh suspended all TeleMessage services on 5 May.
3GPP SA3 is preparing to migrate 5G and future 6G security to post-quantum cryptography. After the Release 19 cryptographic inventory (TR 33.938), the Release 20 study TR 33.703 evaluates options built on NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), published in August 2024, and a Release 20 normative work item, Post-quantum Cryptography Migration Phase 1, is under way. No PQC scheme has yet been standardized for SUCI.