comcast

Comcast has folded its Wi-Fi-based intruder detection feature into Xfinity Shield, a repackaged bundle of physical and cybersecurity offerings. The US telco launched WiFi Motion in 2025. Xfinity Shield also includes cybersecurity protections built into the Xfinity Gateway router. The Wi-Fi sensing technology harnesses the radio waves beamed around a user's home to detect motion and potential intruders. "Using Xfinity Gateway intelligence, WiFi Motion detects changes in the home's radio frequency signal between the Xfinity Gateway and a Wi-Fi connected device, then sends instant notifications to customers through the Xfinity app when unexpected activity is detected," Comcast said. "It provides an added layer of awareness without recording video, capturing images or identifying individuals." The company does not consider this a home security service, merely a feature, because it is not managed by a dedicated security provider. Not every connected device can support the sensing feature. It uses the Xfinity Gateway, Xfinity Wi-Fi extenders, and up to three other compatible devices around the home. Crucially, these devices must be stationary. Think thermostats and home speakers, not smartphones or toothbrushes. Comcast advises users to position the router and extenders so that their signals pass through the areas where they want to detect motion. Open spaces such as hallways work best, and the company urges routine testing to ensure coverage is maintained. A setting in the Xfinity app allows WiFi Motion to ignore small pets. Animals weighing around 18 kg (40 pounds) or less will not trigger alerts when this setting is enabled, and the app warns this may also exclude small children. Customers can also adjust the sensitivity of the motion detection, choosing from low, medium, and high-sensitivity modes. Comcast says the latter works best in single-family, detached homes, whereas those who share walls with neighbors may want to choose the less-sensitive settings to avoid meaningless notifications. The telco also assured customers that WiFi Motion does not track individuals or their precise movements, and cannot identify specific people. It added that it "does not monitor motion and/or notifications generated by the service." The small print, which also accompanied the 2025 launch, suggests the service may not be quite as private as the marketing implies. Comcast states: "Subject to applicable law, Comcast may disclose information generated by your WiFi Motion to third parties without further notice to you in connection with any law enforcement investigation or proceeding, any dispute to which Comcast is a party, or pursuant to a court order or subpoena." Comcast does not specify what information may be disclosed or which "third parties," beyond law enforcement, might receive it. How it works Users can establish "sensing areas" by placing Wi-Fi devices around parts of the home with regular foot traffic. Comcast describes each sensing area as a long oval extending between two connected devices. Sensing areas can be established through walls separating rooms, although in two-storey or multi-storey homes, the telco encourages customers to avoid placing Wi-Fi equipment directly above or below each other. "Motion is detected within the sensing area when movement disrupts the wireless signals that travel between your Xfinity WiFi equipment and selected WiFi-connected devices within the sensing area," said Comcast. "Notifications will be sent only when motion disrupts the wireless signals in the sensing area between the WiFi equipment and your connected devices." Not a novel feature Comcast is the latest, but not the first, to harness Wi-Fi radio waves for motion detection. Companies such as Cognitive Systems and Origin Wireless have been developing other uses for wireless signals. Beyond domestic intruder alerts, the technology can measure occupancy and foot traffic in commercial buildings, helping operators reduce energy consumption and make better use of leased space. Wireless signals can also be used to support caregivers in places like assisted living centers. Wi-Fi transmissions can help track activity patterns and build a greater understanding of patients' fall risks, for example. Boffins began working on an official Wi-Fi sensing standard in 2020. Following a draft published by the IEEE in 2023, the 802.11bf standard was ratified in 2025. Major chipmakers including MediaTek, Qualcomm, and others are now working on embedding the standard into their Wi-Fi 7 chips and beyond. SaaS biz Plume, which provides smart home services to consumers and ISPs, has offered Wi-Fi sensing since 2020, around the time the 802.11bf working group began devising the standard. ®

Comcast is promoting WiFi-based motion detection as a part of its new Xfinity Shield home protection platform, allowing routers and wireless devices to detect people moving through a home without cameras or motion sensors. This feature was announced as part of a new Xfinity Shield product offering on Tuesday, a new application suite that combines cybersecurity, physical home monitoring, and family safety features through Xfinity WiFi and the Xfinity app. Part of this new offering is WiFi Shield, which is included at no additional cost for Xfinity Internet customers with compatible gateways. It combines Xfinity's CyberSecure network protection, Family Settings, and WiFi Motion, with Home Watch, Away Watch, and Dark Watch modes used to control when notifications are generated. Comcast is also launching Shield Select for $15 per month, which adds an indoor camera, door/window sensor, cloud video storage, and 24/7 urgent response functionality. However, while Comcast is now making WiFi Motion a major part of its WiFi Shield security offering, the motion detection feature isn't new. A Reddit post from August 21, 2024, shows an Xfinity customer receiving an email introducing WiFi Motion. This email describes the same functionality as today's announcement, stating that the feature detects disruptions to WiFi signals between the gateway and devices on the network and generates notifications in the Xfinity app. "It works too. It detects motion to the point of raising your hand to change the channel with the remote control. Detects my cat walking across the living room," reads another user using the feature in 2024. WiFi NOW also reported in February that Comcast had offered WiFi Motion "for a long time" and was ramping up its marketing, including advertising it during Olympic hockey broadcasts. Turning WiFi signals into motion sensors WiFi Motion works by turning the radio links between an Xfinity Gateway and stationary WiFi devices into virtual motion sensors. According to support documents, customers select stationary WiFi devices, such as smart speakers or thermostats, positioned around the home. When someone moves through the area between the gateway or extender and one of those devices, their body changes how the WiFi radio signals travel. Comcast says the system detects these changes in the home's radio frequency signals and uses them to determine that movement has occurred. Customers will then receive notifications through the Xfinity app without installing a camera or motion detector. Xfinity says the system does not identify who is moving or determine their exact location, and WiFi Motion is opt-in and disabled by default. "It is designed to detect motion, not identify specific people, and does not track the exact location of movement. Notifications indicate when movement is detected between a connected device and the Xfinity Gateway," explains an Xfinity support document. However, the technology can be sensitive, with Comcast providing different motion sensitivity levels to filter out movement from small pets weighing around 40 pounds or less. The company warns that the system has no visual information and therefore may not always distinguish a small pet from a similarly sized child. Comcast also advises customers in apartments and other buildings with shared walls to lower the sensitivity if movement outside the sensing zone causes unwanted detections. A Comcast patent application provides a glimpse into how this type of system can work. The pending patent, titled "Methods, systems, and apparatuses for presence detection," was filed by Comcast Cable Communications in September 2023 and published in April 2025. It describes using stationary network devices for motion detection and analyzing changes in characteristics such as the wireless signals to determine when an object or person has moved through a space. The patent explains that WiFi signals can travel along multiple paths as they reflect or scatter off walls, people, and other objects. Movement changes those paths and the resulting wireless signal, allowing software to detect that something in the environment has moved. Comcast's patent cites several earlier Cognitive Systems patents related to WiFi motion detection, including technology for detecting motion from repeated wireless transmissions and motion detection in mesh networks. Using WiFi as an invisible motion sensor raises questions about what happens to the data generated when people move around their houses. As first spotted by TechCrunch, Comcast's WiFi Motion documentation says the company may disclose information generated by the feature to third parties "without further notice to you" in connection with a law enforcement investigation or proceeding, a dispute involving Comcast, or pursuant to a court order or subpoena. Comcast separately states that it does not monitor the motion or notifications generated by WiFi Motion. The company's documentation does not explain what WiFi Motion information Comcast retains, how long it keeps it, or what it could provide in response to a legal demand. BleepingComputer contacted Comcast with questions about the generated data and will update the article if we receive any additional information. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Three recently patched Fortinet FortiSandbox vulnerabilities are being targeted in the wild, according to exploit intelligence company Defused. Defused’s honeypots have been seeing attempts to exploit CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089. CVE-2026-39813 and CVE-2026-39808 were both rated ‘critical severity’ and patched in April. The former allows an attacker to bypass authentication, while the latter is an OS command injection flaw that can be exploited to execute arbitrary code or commands. CVE-2026-25089 was patched by Fortinet with its June 2026 Patch Tuesday updates. It allows a remote, unauthenticated attacker to execute arbitrary commands on vulnerable appliances. Exploitation of CVE-2026-39808 was independently observed by KEVIntel on June 12. Both Defused and KEVIntel reported seeing attacks targeting CVE-2026-39813 on June 15. Defused noted that the exploit for CVE-2026-25089 appears to have been created using AI and did not work when first observed by the company. Defused recently also saw exploitation of two Fortinet FortiClient EMS vulnerabilities tracked as CVE-2026-21643 and CVE-2026-35616. Compromised Fortinet firewalls Separately, SOCRadar has detected more than 30,000 compromised Fortinet firewalls that expose corporate networks to hacking. The campaign has been dubbed FortiBleed. According to the security firm, a threat actor has been systematically hacking Fortinet firewalls and VPN gateways, compiling a database of verified credentials that can be used to access them. The compromised systems belong to companies and government organizations across more than 190 countries. Many of the devices are located in India and the United States. “The attackers scan the internet for Fortinet devices, try a curated list of known passwords against each one, and record every successful login,” SOCRadar explained. “Once a device is compromised, they use it as a listening post, monitoring traffic passing through and collecting any additional credentials that flow by. Those freshly collected passwords are then fed back into the scanner to compromise even more devices. The system feeds itself.” The threat actor left its server exposed, enabling researchers to collect data on its infrastructure and targets. “Among the recovered data were credentials for what appears to be a defense industry VPN endpoint, suggesting the group’s ambitions extend beyond purely financial targets,” SOCRadar noted. While the company has yet to attribute the attack to a known threat actor, it believes the hackers are likely Russian speakers. The FortiBleed activity was also analyzed by researcher Bob Diachenko and cybersecurity firm Hudson Rock. Hudson Rock said the campaign appears to impact major companies such as Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, and Oracle. *updated to mention that Diachenko and Hudson Rock are also monitoring the FortiBleed campaign Related: Fortinet, Ivanti Patch Critical Vulnerabilities Related: Fortinet Patches High-Severity Vulnerabilities Related: Fortinet Patches Exploited FortiCloud SSO Authentication Bypass

Comcast Business SecurityEdge Preferred strengthens security for small businesses Comcast Business announced SecurityEdge Preferred, its most advanced network-native cybersecurity solution for small businesses. Because SecurityEdge Preferred is built directly into the Comcast Business network, security can be activated in minutes without deploying additional hardware, managing multiple vendors, or maintaining complex security tools. Rather than adding another layer on top of existing infrastructure, it lives inside the connectivity small businesses already rely on – intercepting threats at the network edge, the moment traffic enters or exits. It is an architectural advantage that network-native security can deliver, and other products cannot. The numbers tell a consistent story. Comcast Business’s own 2025 Cybersecurity Threat Report – drawn from 34.6 billion security events across its network – found the threat environment facing small businesses at its most active and most costly on record. Outside research confirms it: according to Cisco, 43 percent of all cyberattacks now target small businesses, and the Identity Theft Resource Center’s 2024 Consumer and Business Impact Report found that financial losses from breaches have doubled in two years, with damages increasingly topping $500,000. Yet most small businesses have no dedicated security staff, no interest in complex deployments, and no path to the enterprise-grade tools that larger organizations take for granted. SecurityEdge Preferred was designed to change that. “Security shouldn’t require an IT department to work,” said Christian Nascimento, SVP, Connectivity and Digital Customer Solutions, Comcast Business. “SecurityEdge Preferred is part of our broader commitment to simplifying how small businesses access and manage critical technology, bringing connectivity and cybersecurity together in an integrated experience they can depend on.” Simple to activate. Powerful by design. SecurityEdge Preferred monitors both incoming and outgoing traffic in real time, blocking malware, ransomware, phishing attempts, and botnets before they reach connected devices. AI-powered threat intelligence continuously identifies and adapts to emerging attack patterns. Advanced filtering blocks malicious IP addresses and restricts traffic from high-risk geographic regions. Application-level controls prevent unauthorized software from accessing the network. A live dashboard gives business owners real-time visibility into activity and threats, with customizable alerts. The scale of the threat environment small businesses face is not hypothetical. In May 2026, for example, SecurityEdge Preferred blocked threats targeting small businesses at an average rate of more than 230 per second – malware, phishing attempts, botnet communications, and malicious traffic, intercepted at the network edge before reaching connected devices. Activation takes minutes. No additional hardware is required beyond a Comcast Business Internet router, and no IT expertise is needed to get started or manage the solution on an ongoing basis. SecurityEdge Preferred is $40 per month for Comcast Business Internet customers with speeds below 1 Gbps, and $60 per month for Gig+ customers – with no per-seat licenses or annual subscription fees required. It is also available through Comcast Business’s Total Solutions Advantage plans and “Buy More, Save More” program, through which customers can save up to $30 per month when bundling eligible solutions. “Our network is what makes this different,” Nascimento continued. “Security that’s embedded in the infrastructure – rather than layered on top of it – means we can stop threats closer to where they originate, at a scale most small businesses could never achieve on their own. That’s what we built this solution to do.” SecurityEdge Preferred is available now to eligible small businesses across Comcast Business’s national footprint.

Law enforcement agencies in the U.S. and Europe, along with private partners, have disrupted the SocksEscort cybercrime proxy network that relied solely on edge devices compromised via the AVRecon malware for Linux. According to Lumen’s Black Lotus Labs (BLL), which helped the U.S. Department of Justice take down Socksescort, the proxy network had a constant average of 20,000 infected devices every week for the past few years. SocksEscort was first documented by BLL researchers in 2023 and functioned for more than a decade by offering cybercriminals traffic routing services through residential or small business devices. The service advertised access to “clean” IP addresses from major ISPs - such as Comcast, Spectrum, Spectrum Business, Verizon, and Charter - that could pass multiple blocklists. "Since the summer of 2020, SocksEscort has offered to sell access to about 369,000 different IP addresses," the U.S. Department of Justice says in a press release today. "As of February 2026, the SocksEscort application listed approximately 8,000 infected routers to which its customers could buy access, of those, 2,500 were in the United States." The DOJ says that the SocksEscort service was used in the theft of $1 million worth of cryptocurrency from a user in New York, enabled losses of $700,000 from defrauding a Pennsylvania-based manufacturing business, and caused $100,000 in damages in a fraud impacting current and former United States service members with MILITARY STAR cards. In Europe, authorities in Austria, France, and the Netherlands, took down multiple SocksEscort servers under the coordination of Europol. "During the action day, law enforcement agencies successfully took down and seized 34 domains as well as 23 servers located in seven countries," the European agency informs. The US also froze $3.5 million in cryptocurrency. Currently, all infected devices used in the SocksEscort proxy network have been disconnected from the service. According to the Lumen researchers, SocksEscort was powered by the AVRecon malware, which is believed to have been active since at least May 2021 and infected over 70,000 Linux-based small office/home office (SOHO) routers by mid-2023. Lumen researchers disrupted the AVRecon router botnet in 2023 by null-routing the command-and-control (C2) infrastructure across its network, cutting infected devices off from their operators. This severed communications with the botnet’s proxy servers and control nodes, effectively rendering the network inert within Lumen’s infrastructure. However, this disruption had a limited effect, and over time, the operators of Socksescort returned to regular operations, routing communications through 15 command-and-control nodes (C2s). A Lumen spokesperson told BleepingComputer that SocksEscort used only the AVRecon malware to add new nodes. Since the beginning of 2025, the company has seen 280,000 unique victim IP addresses. The researchers believe that the AVRecon malware was used only for growing SocksEscort, as observed victim IPs were not seen in other botnets or services. Also, despite the significant size of the operation, the operators managed to keep the C2 infrastructure undetected. Over half of the infected devices were located in the United States and the United Kingdom, according to the researchers, which is excellent for routing malicious traffic and evading blocklists. Earlier this week, Black Lotus Labs revealed another proxying botnet called KadNap that targets ASUS routers and other edge networking devices primarily. Since August 2025, the botnet has infected 14,000 devices, using a novel but flawed communication and peer discovery mechanism based on the Kademlia Distributed Hash Table (DHT) protocol. Lumen took limited action against that botnet by blocking all network traffic to and from its C2 infrastructure on the Lumen network, preventing infected devices from communicating with the botnet controllers. To minimize the likelihood of router compromise, replace models that have reached end-of-life, apply the latest available firmware updates, change the default administrator password, and disable remote access panels if not needed. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The U.S. Federal Bureau of Investigation (FBI) confirmed on Thursday that it's investigating a breach that affected systems used to manage surveillance and wiretap warrants. While the federal law enforcement agency declined to share more details regarding the incident's scope and overall impact, it said that the incident has already been addressed. "The FBI identified and addressed suspicious activities on FBI networks, and we have leveraged all technical capabilities to respond," the law enforcement agency told BleepingComputer, but declined to provide additional information. On Thursday, CNN, which first reported the incident, cited an anonymous source saying the breach affected FBI systems used to manage wiretapping and foreign intelligence surveillance warrants. While it's unclear at the moment whether this incident is also connected, Chinese hackers part of a state-backed threat group tracked as Salt Typhoon have also compromised U.S. federal government systems used for court-authorized network wiretapping requests in 2024. The incident came to light after Salt Typhoon breached the networks of telecommunications providers in the U.S. (AT&T, Verizon, Lumen, Charter Communications, Consolidated Communications, Comcast, Digital Realty, and Windstream), as well as dozens of other countries. While inside the U.S. telecom firms' networks, the hackers also gained access to the "private communications" of some U.S. government officials. In November 2021, the FBI's email servers were also hacked to distribute spam emails impersonating the bureau that warned recipients about fake cyberattacks. The FBI also revealed in February 2023 that it was investigating malicious cyber activity involving an FBI New York Field Office computer system that was used to investigate child sexual exploitation. Update March 06, 07:39 EST: Added FBI statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: Suspected Scattered Spider members plead not guilty to TfL attack Thalha Jubair and Owen Flowers, the two suspected Scattered Spider members arrested earlier this year in the UK, have pleaded not guilty to the charges accusing them of launching a disruptive cyberattack against Transport for London (TfL). Jubair has also been charged in the US, where he has been accused of hacking into networks, stealing and encrypting victims’ data, and extorting them. HashJack attack targets AI browsers Researchers at Cato Networks have disclosed HashJack, a new indirect prompt injection attack targeting AI browser assistants. HashJack involves malicious prompts being hidden after the ‘#’ symbol in legitimate URLs. AI browser assistants in Comet, Edge, and Chrome execute the commands when they process the URL, potentially leading to phishing, data exfiltration, malware delivery, and misinformation. Impacted browser vendors have been notified and, except for Google (which classified it as a low-severity issue), they have released patches. Leak reveals inner workings of Iranian APT Charming Kitten Internal documents belonging to the Iranian threat group Charming Kitten (APT35) were leaked last month on GitHub, revealing the actor’s inner workings. An analysis conducted by DomainTools showed that the hackers operate as a “regimented, quota-driven cyber operations unit operating inside a bureaucratic military chain of command”. Members are assigned to specific tasks, and supervisors file monthly performance reports that include information such as phishing success rate, exploitation metrics, completed tasks, and hours worked. Scattered Lapsus$ Hunters member Rey identified as teen from Jordan Cybersecurity blogger Brian Krebs claims to have uncovered the real identity of ‘Rey’, a key member of the Scattered Lapsus$ Hunters cybercrime group. Krebs says Rey is 16-year-old Saif Al-Din Khader from Amman, Jordan. The teen reportedly admitted that he is Rey and claimed he is trying to retire from Scattered Lapsus$ Hunters while also collaborating with law enforcement in Europe, but Krebs was unable to verify those claims. TP-Link sues Netgear over false China link claims TP-Link has filed a lawsuit against Netgear in Delaware, accusing it of defamatory claims as part of a smear campaign falsely claiming that TP-Link has ties to the Chinese government. Underlining that it is incorporated and headquartered in California, TP-Link claims that Netgear’s campaign is creating an unfair advantage in the marketplace and that the false assertions violate federal and state laws. Comcast agrees to $1.5 million fine over vendor data breach Telecommunications provider Comcast has agreed (PDF) to pay a $1.5 million fine to settle an FCC investigation into a data breach at one of its third-party services providers. The incident occurred in February 2024 and involved debt collection agency Financial Business and Consumer Solutions (FBCS). Roughly 238,000 Comcast customers were impacted. High-severity Firefox vulnerability Aisle has published technical details on CVE-2025-13016, a high-severity vulnerability in Firefox’s WebAssembly engine that could lead to remote code execution. The vulnerable code was added to the browser in April 2025 alongside its own regression test, but remained unnoticed until October. It was patched in Firefox 145. “The vulnerable code passed code review, included a test specifically designed to exercise the same code path, and shipped in multiple Firefox releases,” Aisle notes. Gainsight says only a handful of customers affected by Salesforce attack The investigation into the attack that disrupted Gainsight-Salesforce integrations last week continues, but Gainsight continues to downplay the impact from the incident. After the company said last week that only three organizations were impacted by the data breach, its CEO said on Tuesday that only “a handful of customers” had their data compromised. Google, on the other hand, told the media that roughly 200 Salesforce instances might have been affected. ShadowV2 IoT botnet active during AWS outage ShadowV2, a Mirai-based botnet ensnaring vulnerable IoT devices, mainly routers, was seen active at the end of October, during a massive AWS outage that affected organizations in multiple countries worldwide. “So far, the malware appears to have only been active during the time of the large-scale AWS outage. We believe this activity was likely a test run conducted in preparation for future attacks,” Fortinet says. In September, Darktrace revealed that ShadowV2 was targeting Docker daemons running on internet-accessible AWS cloud instances. Bloody Wolf APT expands operations across Central Asia The Bloody Wolf APT is impersonating government agencies, mainly ministries of justice, in fresh attacks against entities in a broader set of countries in Central Asia, Group-IB reports. Relying on spear-phishing, the hacking group was seen deploying the STRRAT malware and the legitimate remote administration tool NetSupport. Historically, it has been targeting entities in Kazakhstan and Russia, but recently expanded to Kyrgyzstan and Uzbekistan. Related: In Other News: ATM Jackpotting, WhatsApp-NSO Lawsuit Continues, CISA Hiring Related: In Other News: Deepwatch Layoffs, macOS Vulnerability, Amazon AI Bug Bounty

Comcast will pay a $1.5 million fine to settle a Federal Communications Commission investigation into a February 2024 vendor data breach that exposed the personal information of nearly 275,000 customers. The breach occurred in February 2024, when attackers hacked into the systems of Financial Business and Consumer Solutions (FBCS), a debt collector Comcast had stopped using two years earlier. The FCBS data breach was initially believed to have affected 1.9 million people in total, but the tally was raised to 3.2 million in June and, finally, to 4.2 million in July. FBCS, which filed for bankruptcy before revealing a data breach in August 2024, notified Comcast on July 15 (five months after the attack) that customer data had been compromised, affecting 273,703 Comcast customers. Previously, it had assured Comcast in March that the breach did not affect any of its customers. The threat actors stole personal and financial information between February 14 and February 26, including the names, addresses, Social Security numbers, dates of birth, and Comcast account numbers of affected current and former customers. Affected customers had used Comcast's Xfinity-branded internet, television, streaming, VoIP, and home security services. The telecommunications giant must also appoint a compliance officer, conduct risk assessments of vendors handling customer data every two years, file compliance reports with the FCC every six months over the next three years, and report any material violations within 30 days of discovery. However, Comcast said in a statement to Reuters that it "was not responsible for and has not conceded any wrongdoing in connection with this incident," noting that its network wasn't breached and that FBCS was contractually required to comply with security requirements. A Comcast spokesperson was not immediately available for comment when contacted by BleepingComputer. Comcast is an American mass media, telecommunications, and entertainment multinational company, and the fourth-largest telecom firm in the world by revenue, after AT&T, Verizon, and China Mobile. It also has over 182,000 employees, hundreds of millions of customers worldwide, and reported revenues of $123.7 billion in 2024. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Ribbon Communications, a provider of telecommunications services to the U.S. government and telecom companies worldwide, revealed that nation-state hackers breached its IT network as early as December 2024. Ribbon provides networking solutions and secure cloud communications services to telecommunications companies and critical infrastructure organizations worldwide. The company has over 3,100 employees in 68 global offices, and its list of customers includes the City of Los Angeles, the Los Angeles Public Library, the University of Texas at Austin, government customers (such as the U.S. Department of Defense), and telecom providers like Verizon, CenturyLink, BT, Deutsche Telekom, Softbank, and TalkTalk. As disclosed in a filing with the U.S. Securities and Exchange Commission (SEC) on October 23, Ribbon detected the breach in September 2025; however, evidence discovered so far indicates that the attackers first gained access to its systems in December 2024. "In early September 2025, the Company became aware that unauthorized persons, reportedly associated with a nation-state actor, had gained access to the Company's IT network," Ribbon said. "While the investigation is ongoing, the Company believes that it has been successful in terminating the unauthorized access by the threat actor. The Company has preliminarily determined that initial access by the threat actor may have occurred as early as December 2024, with final determinations dependent on completion of the ongoing investigation." Ribbon is now working with third-party cybersecurity experts and federal law enforcement to investigate the breach and said that it has yet to find evidence that the threat attackers accessed or stole "any material information." However, the company found that the attackers had gained access to files belonging to several customers, stored on two laptops outside of Ribbon's main network. Although Ribbon expects to incur additional costs in the fourth quarter of 2025 related to the breach investigation and its network strengthening efforts, it does not currently anticipate these costs to be material. While Ribbon has yet to attribute the cyberattack to a specific threat actor or hacking group, the breach bears resemblance to a series of widespread telecom breaches from last year that were linked to China's Salt Typhoon cyber-espionage group. At the time, CISA and the FBI confirmed that the Chinese state hackers had breached multiple telecom providers (including AT&T, Verizon, Lumen, Consolidated Communications, Charter Communications, and Windstream), as well as other telecom firms in dozens of different countries. Comcast and Digital Realty were also flagged in June as potentially compromised by the Salt Typhoon hacking group, with satellite communications company Viasat revealing weeks later that it had also been hacked as part of the same campaign. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Week in review: Hackers extorting Salesforce, CentreStack 0-day exploited Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: How to get better results from bug bounty programs without wasting money The wrong bug bounty strategy can flood your team with low-value reports. The right one can surface critical vulnerabilities that would otherwise slip through. A new academic study based on Google’s Vulnerability Rewards Program (VRP) offers rare data on how to tell the difference. Rethinking AI security architectures beyond Earth If you think managing cloud security is complex, try doing it across hundreds of satellites orbiting the planet. Each one is a moving endpoint that must stay secure while communicating through long, delay-prone links. A new study explores how AI could automate security for space systems and whether the best approach is to centralize control or spread it out. Behind the screens: Building security customers appreciate In this Help Net Security interview, Jess Vachon, CISO at PRA Group, discusses the company’s multi-layered defense against fraud and its commitment to protecting customer trust. Vachon explains how PRA Group balances identity verification with a seamless customer experience. From theory to training: Lessons in making NICE usable SMBs may not have big budgets, but they are on the receiving end of many cyberattacks. A new study from Cleveland State University looked at how these companies could train staff without getting lost in the thousands of skills and tasks in the NICE Cybersecurity Workforce Framework. The result is a stripped-down, scenario-based curriculum that may hold lessons for security leaders in much larger enterprises. Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882) The Cl0p extortion gang exploited multiple Oracle E-Business Suite (EBS) vulnerabilities, including one zero-day flaw (CVE-2025-61882), “to steal large amounts of data from several victim[s] in August 2025,” Charles Carmakal, CTO at Mandiant – Google Cloud, stated on Sunday. Hackers launch data leak site to extort 39 victims, or Salesforce Scattered Lapsus$ Hunters launched a data leak site over the weekend, aiming to pressure organizations whose Salesforce databases they have plundered into paying to prevent the stolen data from being released. Leaked Oracle EBS exploit scripts expected to drive new wave of attacks (CVE-2025-61882) Resecurity and watchTowr researchers have analyzed the leaked scripts used by attackers to exploit CVE-2025-61882 on internet-facing Oracle ESB instances. Whether the attackers were Cl0p or LAPSUS$, both, or even additional threat actors is still unknown, as the scripts have been leaked on Telegram. Redis patches critical “RediShell” RCE vulnerability, update ASAP! (CVE-2025-49844) Redis, the company behind the widely used in-memory data structure store of the same name, has released patches for a critical vulnerability (CVE-2025-49844) that may allow attackers full access to the underlying host system. North Korean hackers stole over $2 billion in cryptocurrency this year North Korean hackers have stolen more than $2 billion in cryptocurrency in 2025, according to blockchain analytics firm Elliptic, and the year isn’t over yet. Researchers uncover ClickFix-themed phishing kit Palo Alto Networks researchers have discovered and analyzed “IUAM ClickFix Generator”, a phishing kit that allows less skilled attackers to infect unsuspecting users with malware by using the increasingly popular ClickFix social engineering technique. Attackers compromised ALL SonicWall firewall configuration backup files The attackers who brute-forced their way into SonicWall’s firewall cloud backup service accessed configuration backup files of all customers who have used the service, SonicWall stated on Wednesday, following the conclusion of a Mandiant-supported investigation into the incident. Legit tools, illicit uses: Velociraptor, Nezha turned against victims Threat actors are using an increasing variety of commercial and open-source products to carry out their attacks: according to researchers, Velociraptor and Nezha are the latest additions to their attack toolbox. Attackers are exploiting Gladinet CentreStack, Triofox vulnerability with no patch (CVE-2025-11371) CVE-2025-11371, a unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and Triofox file-sharing and remote access platforms, is being exploited by attackers in the wild. Securing agentic AI with intent-based permissions For decades, action-based permissions have performed the role of the seatbelts of enterprise security, essential guardrails that define what users or systems can do. But with the rise of agentic AI and autonomous software agents that operate independently and make decisions at scale, IAM now needs intent-based permissions that understand not only what an AI agent is doing, but why. October 2025 Patch Tuesday forecast: The end of a decade with Microsoft A lot of classic software is reaching end-of-life (EOL) this month. Windows 10, Office 2016 and Exchange Server 2016 have survived after nearly a decade of service. Not far behind, after six years in existence, comes the end of Office 2019 and Exchange Server 2019. Turning the human factor into your strongest cybersecurity defense In this Help Net Security video, Jacob Martens, Field CISO at Upwind Security, explores one of cybersecurity’s most enduring challenges: the human factor behind breaches. Despite advances in technology, most attacks still begin with people, not code. He explains how tactics like phishing and social engineering continue to succeed by exploiting human emotions such as urgency, fear, and even friendliness. Meet ARGUS, the robot built to catch hackers and physical intruders Hospitals, airports, and campuses are no longer dealing with separate security problems. Someone can slip past a checkpoint while another actor launches a network scan, and together those actions create a bigger risk than either one alone. Most surveillance tools and patrol robots are built to catch one or the other. A new study introduces ARGUS, a mobile system that watches the digital and physical environment at the same time and ties its findings together. How to succeed at cybersecurity job interviews Imagine this: you’ve made it through the résumé screen, your skills look solid on paper, and now it’s interview day. The next hour will decide whether you move forward or go back to the job boards. What separates the candidates who land offers from those who don’t is preparation and knowing what to expect when the questions start coming. The architecture of lies: Bot farms are running the disinformation war Bot farms have moved into the center of information warfare, using automated accounts to manipulate public opinion, influence elections, and weaken trust in institutions. New system aims to keep people connected when networks fail When disaster strikes, communication often fails. Cell towers can go offline, internet connections can disappear, and people are left without a way to share information or ask for help. A new research project looks at how to keep people talking even when regular networks are gone. Developing economies are falling behind in the fight against cybercrime Cybercrime is a global problem, but not every country is equally equipped to fight it. In many developing economies, cybersecurity is still seen as a luxury, something nice to have when budgets allow. That means little investment in tools, training, or talent. Researchers develop AI system to detect scam websites in search results Scam websites tied to online shopping, pet sales, and other e-commerce schemes continue to cause millions in losses each year. Security tools can accurately detect fraudulent sites once they are found, but identifying new ones remains difficult. Proxmox Mail Gateway: Open-source email security solution reaches version 9.0 First released in 2005, the open-source Proxmox Mail Gateway has become a widely adopted mail proxy, positioned between the firewall and the internal mail server to stop threats before they reach users. The platform delivers anti-spam and antivirus filtering to help organizations counter email-borne risks such as malware, Trojans, and phishing campaigns. DefectDojo: Open-source DevSecOps platform DefectDojo is an open-source tool for DevSecOps, application security posture management (ASPM), and vulnerability management. It helps teams manage security testing, track and remove duplicate findings, handle remediation, and generate reports. Nagios: Open-source monitoring solution Nagios is an open-source monitoring solution, now included as part of the robust Nagios Core Services Platform (CSP). It delivers end-to-end visibility across the entire IT infrastructure, covering everything from websites and DNS to servers, routers, switches, workstations, and critical services. It helps organizations proactively detect issues, minimize downtime, and ensure the reliability of their systems. Phishing is old, but AI just gave it new life The volume of cyberattacks has reached staggering levels, with new tactics that blur the line between legitimate and malicious activity. A new threat report from Comcast, based on 34.6 billion cybersecurity events analyzed over the past year, shows what adversaries are doing and what this means for enterprise leaders. Old authentication habits die hard Many organizations still rely on weak authentication methods while workers’ personal habits create additional risks, according to Yubico. Cybersecurity’s next test: AI, quantum, and geopolitics Geopolitics, emerging technology, and skills shortages are reshaping cybersecurity priorities across industries, according to a new PwC report. The findings show a mix of rising awareness, persistent weaknesses, and uneven preparation for the next wave of threats. Six metrics policymakers need to track cyber resilience Most countries are still making national cyber policy decisions without reliable numbers. Regulations often focus on incident reporting after damage is done, but they fail to give governments a forward-looking picture of resilience. A new report from Zurich Insurance Group argues that this gap leaves economies exposed and slows the ability to respond to systemic threats. Outdated encryption leaves crypto wide open The cryptocurrency sector faces an existential threat on two fronts: none of the 2,138 web applications and 146 mobile apps tested by ImmuniWeb support post-quantum encryption, and more than 7.8 million user records are already circulating on the dark web. Your SOC is tired, AI isn’t Security teams have discussed AI in the SOC for years, but solid evidence of its impact has been limited. A recent benchmark study by Dropzone puts measurable evidence behind the idea, showing that AI agents can help analysts work faster and with greater accuracy during alert investigations, without major changes to existing workflows. Cybersecurity jobs available right now: October 7, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. eBook: Defending Identity Security the Moment It’s Threatened Credential-based attacks happen in seconds. Learn how to block weak or stolen passwords instantly, safeguard accounts in real time, and reduce helpdesk headaches with automated defense. New infosec products of the week: October 10, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Object First, OPSWAT, Radiflow, and Semperis.

The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T, Comcast and Verizon, new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is complicating efforts to limit collateral damage from the botnet’s attacks, which shattered previous records this week with a brief traffic flood that clocked in at nearly 30 trillion bits of data per second. Since its debut more than a year ago, the Aisuru botnet has steadily outcompeted virtually all other IoT-based botnets in the wild, with recent attacks siphoning Internet bandwidth from an estimated 300,000 compromised hosts worldwide. The hacked systems that get subsumed into the botnet are mostly consumer-grade routers, security cameras, digital video recorders and other devices operating with insecure and outdated firmware, and/or factory-default settings. Aisuru’s owners are continuously scanning the Internet for these vulnerable devices and enslaving them for use in distributed denial-of-service (DDoS) attacks that can overwhelm targeted servers with crippling amounts of junk traffic. As Aisuru’s size has mushroomed, so has its punch. In May 2025, KrebsOnSecurity was hit with a near-record 6.35 terabits per second (Tbps) attack from Aisuru, which was then the largest assault that Google’s DDoS protection service Project Shield had ever mitigated. Days later, Aisuru shattered that record with a data blast in excess of 11 Tbps. By late September, Aisuru was publicly flexing DDoS capabilities topping 22 Tbps. Then on October 6, its operators heaved a whopping 29.6 terabits of junk data packets each second at a targeted host. Hardly anyone noticed because it appears to have been a brief test or demonstration of Aisuru’s capabilities: The traffic flood lasted less only a few seconds and was pointed at an Internet server that was specifically designed to measure large-scale DDoS attacks. Aisuru’s overlords aren’t just showing off. Their botnet is being blamed for a series of increasingly massive and disruptive attacks. Although recent assaults from Aisuru have targeted mostly ISPs that serve online gaming communities like Minecraft, those digital sieges often result in widespread collateral Internet disruption. For the past several weeks, ISPs hosting some of the Internet’s top gaming destinations have been hit with a relentless volley of gargantuan attacks that experts say are well beyond the DDoS mitigation capabilities of most organizations connected to the Internet today. Steven Ferguson is principal security engineer at Global Secure Layer (GSL), an ISP in Brisbane, Australia. GSL hosts TCPShield, which offers free or low-cost DDoS protection to more than 50,000 Minecraft servers worldwide. Ferguson told KrebsOnSecurity that on October 8, TCPShield was walloped with a blitz from Aisuru that flooded its network with more than 15 terabits of junk data per second. Ferguson said that after the attack subsided, TCPShield was told by its upstream provider OVH that they were no longer welcome as a customer. “This was causing serious congestion on their Miami external ports for several weeks, shown publicly via their weather map,” he said, explaining that TCPShield is now solely protected by GSL. Traces from the recent spate of crippling Aisuru attacks on gaming servers can be still seen at the website blockgametracker.gg, which indexes the uptime and downtime of the top Minecraft hosts. In the following example from a series of data deluges on the evening of September 28, we can see an Aisuru botnet campaign briefly knocked TCPShield offline. Paging through the same uptime graphs for other network operators listed shows almost all of them suffered brief but repeated outages around the same time. Here is the same uptime tracking for Minecraft servers on the network provider Cosmic (AS30456), and it shows multiple large dips that correspond to game server outages caused by Aisuru. BOTNETS R US Ferguson said he’s been tracking Aisuru for about three months, and recently he noticed the botnet’s composition shifted heavily toward infected systems at ISPs in the United States. Ferguson shared logs from an attack on October 8 that indexed traffic by the total volume sent through each network provider, and the logs showed that 11 of the top 20 traffic sources were U.S. based ISPs. AT&T customers were by far the biggest U.S. contributors to that attack, followed by botted systems on Charter Communications, Comcast, T-Mobile and Verizon, Ferguson found. He said the volume of data packets per second coming from infected IoT hosts on these ISPs is often so high that it has started to affect the quality of service that ISPs are able to provide to adjacent (non-botted) customers. “The impact extends beyond victim networks,” Ferguson said. “For instance we have seen 500 gigabits of traffic via Comcast’s network alone. This amount of egress leaving their network, especially being so US-East concentrated, will result in congestion towards other services or content trying to be reached while an attack is ongoing.” Roland Dobbins is principal engineer at Netscout. Dobbins said Ferguson is spot on, noting that while most ISPs have effective mitigations in place to handle large incoming DDoS attacks, many are far less prepared to manage the inevitable service degradation caused by large numbers of their customers suddenly using some or all available bandwidth to attack others. “The outbound and cross-bound DDoS attacks can be just as disruptive as the inbound stuff,” Dobbin said. “We’re now in a situation where ISPs are routinely seeing terabit-per-second plus outbound attacks from their networks that can cause operational problems.” “The crying need for effective and universal outbound DDoS attack suppression is something that is really being highlighted by these recent attacks,” Dobbins continued. “A lot of network operators are learning that lesson now, and there’s going to be a period ahead where there’s some scrambling and potential disruption going on.” KrebsOnSecurity sought comment from the ISPs named in Ferguson’s report. Charter Communications pointed to a recent blog post on protecting its network, stating that Charter actively monitors for both inbound and outbound attacks, and that it takes proactive action wherever possible. “In addition to our own extensive network security, we also aim to reduce the risk of customer connected devices contributing to attacks through our Advanced WiFi solution that includes Security Shield, and we make Security Suite available to our Internet customers,” Charter wrote in an emailed response to questions. “With the ever-growing number of devices connecting to networks, we encourage customers to purchase trusted devices with secure development and manufacturing practices, use anti-virus and security tools on their connected devices, and regularly download security patches.” A spokesperson for Comcast responded, “Currently our network is not experiencing impacts and we are able to handle the traffic.” 9 YEARS OF MIRAI Aisuru is built on the bones of malicious code that was leaked in 2016 by the original creators of the Mirai IoT botnet. Like Aisuru, Mirai quickly outcompeted all other DDoS botnets in its heyday, and obliterated previous DDoS attack records with a 620 gigabit-per-second siege that sidelined this website for nearly four days in 2016. The Mirai botmasters likewise used their crime machine to attack mostly Minecraft servers, but with the goal of forcing Minecraft server owners to purchase a DDoS protection service that they controlled. In addition, they rented out slices of the Mirai botnet to paying customers, some of whom used it to mask the sources of other types of cybercrime, such as click fraud. Dobbins said Aisuru’s owners also appear to be renting out their botnet as a distributed proxy network that cybercriminal customers anywhere in the world can use to anonymize their malicious traffic and make it appear to be coming from regular residential users in the U.S. “The people who operate this botnet are also selling (it as) residential proxies,” he said. “And that’s being used to reflect application layer attacks through the proxies on the bots as well.” The Aisuru botnet harkens back to its predecessor Mirai in another intriguing way. One of its owners is using the Telegram handle “9gigsofram,” which corresponds to the nickname used by the co-owner of a Minecraft server protection service called Proxypipe that was heavily targeted in 2016 by the original Mirai botmasters. Robert Coelho co-ran Proxypipe back then along with his business partner Erik “9gigsofram” Buckingham, and has spent the past nine years fine-tuning various DDoS mitigation companies that cater to Minecraft server operators and other gaming enthusiasts. Coelho said he has no idea why one of Aisuru’s botmasters chose Buckingham’s nickname, but added that it might say something about how long this person has been involved in the DDoS-for-hire industry. “The Aisuru attacks on the gaming networks these past seven day have been absolutely huge, and you can see tons of providers going down multiple times a day,” Coelho said. Coelho said the 15 Tbps attack this week against TCPShield was likely only a portion of the total attack volume hurled by Aisuru at the time, because much of it would have been shoved through networks that simply couldn’t process that volume of traffic all at once. Such outsized attacks, he said, are becoming increasingly difficult and expensive to mitigate. “It’s definitely at the point now where you need to be spending at least a million dollars a month just to have the network capacity to be able to deal with these attacks,” he said. RAPID SPREAD Aisuru has long been rumored to use multiple zero-day vulnerabilities in IoT devices to aid its rapid growth over the past year. XLab, the Chinese security company that was the first to profile Aisuru’s rise in 2024, warned last month that one of the Aisuru botmasters had compromised the firmware distribution website for Totolink, a maker of low-cost routers and other networking gear. “Multiple sources indicate the group allegedly compromised a router firmware update server in April and distributed malicious scripts to expand the botnet,” XLab wrote on September 15. “The node count is currently reported to be around 300,000.” Aisuru’s operators received an unexpected boost to their crime machine in August when the U.S. Department Justice charged the alleged proprietor of Rapper Bot, a DDoS-for-hire botnet that competed directly with Aisuru for control over the global pool of vulnerable IoT systems. Once Rapper Bot was dismantled, Aisuru’s curators moved quickly to commandeer vulnerable IoT devices that were suddenly set adrift by the government’s takedown, Dobbins said. “Folks were arrested and Rapper Bot control servers were seized and that’s great, but unfortunately the botnet’s attack assets were then pieced out by the remaining botnets,” he said. “The problem is, even if those infected IoT devices are rebooted and cleaned up, they will still get re-compromised by something else generally within minutes of being plugged back in.” BOTMASTERS AT LARGE XLab’s September blog post cited multiple unnamed sources saying Aisuru is operated by three cybercriminals: “Snow,” who’s responsible for botnet development; “Tom,” tasked with finding new vulnerabilities; and “Forky,” responsible for botnet sales. KrebsOnSecurity interviewed Forky in our May 2025 story about the record 6.3 Tbps attack from Aisuru. That story identified Forky as a 21-year-old man from Sao Paulo, Brazil who has been extremely active in the DDoS-for-hire scene since at least 2022. The FBI has seized Forky’s DDoS-for-hire domains several times over the years. Like the original Mirai botmasters, Forky also operates a DDoS mitigation service called Botshield. Forky declined to discuss the makeup of his ISP’s clientele, or to clarify whether Botshield was more of a hosting provider or a DDoS mitigation firm. However, Forky has posted on Telegram about Botshield successfully mitigating large DDoS attacks launched against other DDoS-for-hire services. In our previous interview, Forky acknowledged being involved in the development and marketing of Aisuru, but denied participating in attacks launched by the botnet. Reached for comment earlier this month, Forky continued to maintain his innocence, claiming that he also is still trying to figure out who the current Aisuru botnet operators are in real life (Forky said the same thing in our May interview). But after a week of promising juicy details, Forky came up empty-handed once again. Suspecting that Forky was merely being coy, I asked him how someone so connected to the DDoS-for-hire world could still be mystified on this point, and suggested that his inability or unwillingness to blame anyone else for Aisuru would not exactly help his case. At this, Forky verbally bristled at being pressed for more details, and abruptly terminated our interview. “I’m not here to be threatened with ignorance because you are stressed,” Forky replied. “They’re blaming me for those new attacks. Pretty much the whole world (is) due to your blog.”

Phishing is old, but AI just gave it new life The volume of cyberattacks has reached staggering levels, with new tactics that blur the line between legitimate and malicious activity. A new threat report from Comcast, based on 34.6 billion cybersecurity events analyzed over the past year, shows what adversaries are doing and what this means for enterprise leaders. Scale and sophistication increase together Attackers are no longer choosing between quick, noisy campaigns and careful, targeted ones. They are doing both at once. Automated scans and phishing runs create constant background pressure, while more skilled operators test defenses and move laterally inside networks. This mix of volume and stealth makes life difficult for defenders. Security teams must filter out huge amounts of activity without losing sight of the quiet signals that point to an intrusion. The challenge is spotting the attacks designed to blend in and linger. AI as risk multiplier and defensive tool Threat actors are using generative models to create convincing phishing lures and malware, lowering the barrier to entry for less skilled criminals. At the same time, organizations adopting AI tools internally face new exposure points. Shadow AI, or employee use of unsanctioned AI tools, expands the attack surface and raises questions about how to secure non-human identities such as service accounts and autonomous agents. On the defensive side, AI is critical for scaling anomaly detection and speeding response. Yet automation is not enough on its own. Skilled professionals are required to interpret signals, investigate anomalies, and guide strategic action. The report stresses that resilience depends on the right mix of automation and human expertise. Human fatigue and resource constraints Even with advanced tools in place, people remain central to how well defenses hold up. End users are often the entry point, since a single click on a malicious link can bypass multiple layers of security. Security teams also face limits in how much they can process. Constant alerts, repetitive tasks, and noisy signals increase the risk of threats slipping through. These pressures make it harder to respond when incidents occur. To reduce that risk, organizations need to give teams smarter ways to separate signal from noise and invest in processes that keep focus on the threats that matter most. Building a culture of awareness across the enterprise is just as important as technology in closing these gaps. Proxy abuse masks adversaries Attackers are routing malicious traffic through compromised home and business devices, creating large pools of “residential proxies.” These tactics make malicious traffic appear legitimate and allow adversaries to bypass geographic filters or blocklists. This means IP-based trust signals are eroding and leadership must shift focus to behavioral analysis and zero-trust approaches. Beyond technical risk, there is also reputational exposure if compromised devices within an enterprise are co-opted to relay malicious traffic. The business case for layered resilience Cybersecurity is now part of business resilience. Breaches disrupt operations, revenue, and reputation, so organizations need layered defenses that bring prevention, detection, and response together. Preventive measures like patching, MFA, and secure gateways remain important, yet no perimeter is perfect. Adaptive defenses that include AI-enabled detection, threat hunting, and strong governance of both human and machine identities are required to contain intrusions. “Threats are growing in scale, stealthiness, and sophistication. But this is also a transformative time for cyber defense, with advances in AI, automation, and industry collaboration opening new opportunities to innovate,” said Noopur Davis, EVP, CISO and Product Privacy Officer, Comcast.

Orange, a French telecommunications company and one of the world's largest telecom operators, revealed that it detected a breached system on its network on Friday. The compromised system was discovered and isolated from the rest of the network by Orange Cyberdefense, the company's cybersecurity business unit, on July 25. This has led to some operational disruptions, primarily affecting French customers, which are expected to be gradually resolved by Wednesday morning, July 30. "On Friday, July 25, the Orange Group detected a cyberattack on one of its information systems. Immediately alerted, with the support of Orange Cyberdefense, the teams mobilized fully to isolate the potentially affected services and limit the impact," the telecom giant said. "However, these isolation operations resulted in the disruption of certain services and management platforms for some of our business customers and for a few consumer services, mainly in France." Since detecting this cyberattack, the company has alerted the relevant authorities and filed a complaint. Also, its investigation team has yet to find evidence that any data was stolen during the breach. "At this stage of the investigation, there is no evidence to suggest that any customer or Orange data has been extracted. We remain vigilant in this regard," the company added. While Orange has not attributed the cyberattack to a specific hacking group or threat actor, the incident bears resemblance to a series of widespread breaches of telecom providers in the United States and worldwide that have been linked to China's Salt Typhoon cyber-espionage group. The FBI and CISA confirmed in October that the Chinese Salt Typhoon state hackers had breached multiple telecom providers (including AT&T, Verizon, Lumen, Charter Communications, Consolidated Communications, and Windstream), as well as other telecom companies in dozens of other countries. Last month, Comcast and Digital Realty were also tagged as potentially compromised by Salt Typhoon, with satellite communications company Viasat revealing weeks later that it had also been breached as part of the same attacks. In February, Orange's Romanian branch was hit by another cyberattack, with the company confirming the breach of a non-critical application after a threat actor using the alias 'Rey' claimed to have stolen thousands of internal documents containing employee data, user records, source code, invoices, contracts, and 380,000 email addresses. Orange provides consumer communication services and business services to 294 million customers across Europe, Africa, and the Middle East, including 256 million mobile and 22 million fixed broadband customers. Orange also provides IT and telecommunications services to multinational companies under the brand Orange Business, has 125,800 employees worldwide, and reported revenues of €40.3 billion in 2024. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report