Telecom Networks Under Siege as Cyberattacks Accelerate Worldwide, CRIL Warns

On January 9, 2026, Cyble Research & Intelligence Labs (CRIL) published its Telecommunications Sector Threat Landscape Report 2025, exposing a sharp rise in sophisticated cyberattacks targeting telecom operators and their extended supply chains worldwide.

According to the report, telecommunications infrastructure has emerged as one of the most sought-after targets for cybercriminal syndicates, ransomware operators, state-backed threat actors, and politically motivated hacktivists. The sector’s critical role in national connectivity, combined with the lucrative resale value of subscriber Personally Identifiable Information (PII), has significantly amplified its appeal to adversaries.

CRIL documented 444 security incidents linked to telecom organizations during 2025, highlighting how compromised subscriber databases and unauthorized network access are increasingly being treated as tradable assets on underground cybercrime marketplaces.

One of the most concerning trends outlined in the report is the rapid escalation of ransomware activity. CRIL notes that ransomware attacks against telecom companies have quadrupled since 2021, with 90 confirmed incidents recorded in 2025 alone. These attacks were attributed to 34 different ransomware groups, though a small cluster of operators dominated the threat landscape. The groups Qilin, Akira, and Play were collectively responsible for nearly 39% of all ransomware attacks observed in the sector.

Beyond ransomware, the report emphasizes a growing focus on data monetization. Threat actors are actively exploiting breaches to harvest high-value subscriber information—including call detail records, billing data, and sensitive identity information—which is then sold or leveraged for secondary attacks.

CRIL researchers also warn of attackers’ increasing speed in exploiting newly disclosed vulnerabilities. Zero-day and n-day flaws in widely deployed perimeter devices and enterprise software from vendors such as Microsoft, Cisco, and Fortinet are being weaponized rapidly, often within days of disclosure, to gain initial access to telecom environments.

Geopolitical tensions have further intensified the threat environment. The report points to a noticeable increase in cyber espionage and hacktivist campaigns aligned with ongoing global conflicts, reinforcing telecom networks as strategic targets for disruption and intelligence gathering.

From a regional perspective, the Americas experienced the highest concentration of attacks, with the United States alone accounting for 47 targeted incidents during the year, underscoring the region’s exposure due to its extensive telecom infrastructure and high subscriber density.

CRIL concludes that telecom providers must urgently strengthen vulnerability management, supply-chain security, and incident response capabilities to counter the evolving and increasingly coordinated threat landscape.

By Aaradhay Sharma