jain.com — data centers, connectivity and security, analyzed daily

Tag: network security

  • VIAVI’s 100G Tester Makes Post-Quantum Overhead on AI Traffic a Pre-Launch Number

    VIAVI’s 100G Tester Makes Post-Quantum Overhead on AI Traffic a Pre-Launch Number

    TL;DR · 30-second read

    The Short Version

    A new generation of encryption is coming, built to withstand future quantum computers that could one day crack today’s codes.

    The catch: stronger locks can mean more work for the equipment that handles every connection, including the chatbots and other artificial intelligence services businesses now run.

    VIAVI, a maker of network testing gear, released a pizza-box-sized machine that floods networks with realistic, quantum-safe encrypted traffic, so companies can find out whether the new locks slow things down before customers notice.

    VIAVI Solutions (NASDAQ: VIAV) introduced the CyberFlood CF50 on September 29, 2026, a one-rack-unit (1U) test appliance that generates realistic encrypted application traffic at up to 100 gigabits per second (100G) to test application performance, security controls, AI inference and large language model (LLM) services. VIAVI said the CF50 includes native support for post-quantum cryptography (PQC), delivers TLS performance 1.75 times that of its nearest competitor, and has the industry’s lowest power consumption in its class.

    The CF50 is aimed at network equipment manufacturers, systems integrators and service providers, and sits below the existing CyberFlood CF1000, which VIAVI targets at large enterprises that need the highest performance.

    Executive Summary

    The CF50 is a traffic generator: it impersonates large numbers of users and applications so that engineers can see how firewalls, gateways, load balancers and AI services behave under load before real customers arrive. What distinguishes it, by VIAVI’s account, is that it combines three things in a small box: Layer 4-7 traffic (traffic that looks like real applications rather than raw data packets), security assessment, and AI inference testing, with post-quantum encryption built in.

    That combination matters because two infrastructure transitions are happening at once. Organizations are putting AI inference, the step where a trained model answers requests, into production over encrypted connections, and they are preparing to move those connections to quantum-resistant encryption. Both place new demands on the same security equipment. A tester that can generate both kinds of traffic turns the question of whether post-quantum encryption slows AI services into something a lab can measure rather than something operations teams discover after launch.

    The headline performance claims, 1.75X TLS performance and lowest power consumption, are VIAVI’s own, and the company has not published the competitor, metric or test conditions behind them. The practical value of the launch rests less on those superlatives than on whether PQC and AI inference traffic can be exercised together at realistic scale.

    Post-Quantum Encryption Is a Performance Question, Not Just a Security One

    Post-quantum cryptography replaces the mathematical methods that protect today’s encrypted connections with algorithms designed to resist future quantum computers. The US standards body NIST published its first post-quantum standards in 2024, and the pressure to adopt them comes partly from the risk that adversaries are recording encrypted traffic now in order to decrypt it later. The trade-off is that post-quantum key exchanges use considerably larger keys than the methods they replace, which means more data and more computation each time an encrypted TLS session is set up. TLS is the protocol behind the padlock in a browser and behind most API traffic.

    That cost does not fall evenly. It lands on the devices that terminate or inspect encryption at scale: next-generation firewalls, secure web gateways, load balancers and the Zero Trust architectures (security designs that verify every connection rather than trusting anything inside the network perimeter) that VIAVI’s announcement names. AI inference traffic runs through exactly this equipment. A user query to an LLM-powered service is typically an encrypted request that passes security controls before it reaches the model and after the answer comes back, and inference services are judged heavily on responsiveness. Any added handshake overhead or reduced connection capacity shows up directly as latency or as a need for more security hardware.

    This is where the CF50 changes the workflow. VIAVI says the appliance generates encrypted and mixed application traffic up to 100G with native PQC support, and separately offers AI inference and LLM testing. For the network equipment makers, integrators and service providers VIAVI is targeting, that means the performance impact of switching a firewall or gateway to post-quantum TLS can be measured against realistic application and AI traffic in the lab, before deployment. The overhead becomes a number that goes into sizing and procurement decisions rather than a surprise in production. How fully that promise holds depends on whether both traffic types can run in the same test, which VIAVI’s announcement implies but does not spell out.

    What the 1.75X and Lowest-Power Claims Do and Do Not Establish

    VIAVI states that the CF50’s TLS performance is 1.75 times that of the nearest competitor and that it has the industry’s lowest power consumption. Both claims are plausible marketing for a product in a competitive test-and-measurement category, and both are unverified. The company has not named the competitor or product compared, specified whether the metric is new connections per second, concurrent sessions or encrypted throughput, stated whether the comparison used classical or post-quantum cipher suites, or published a wattage figure.

    Those distinctions matter to buyers. A tester that leads on encrypted throughput may not lead on handshake rate, and handshake rate is where post-quantum overhead concentrates. A power figure matters for labs with constrained rack power, but lowest-in-class means little without knowing the class. The quote from Mauricio Sanchez of Dell’Oro Group supports the general case for realistic pre-deployment testing of AI and encrypted workloads. It does not address the CF50’s specific performance figures, and readers should not treat it as independent validation of them.

    A Smaller Box Widens Who Can Afford This Kind of Testing

    High-scale encrypted traffic testing has traditionally required large chassis systems and specialist operators. The CF50 packs the capability into 1U, a single standard rack slot about 1.75 inches tall, and replaces a Windows desktop client with a web interface. VIAVI also includes automated goal-seeking, which ramps load until a device under test reaches its limit, MITRE ATT&CK frameworks, a public catalog of real-world attacker techniques used to check whether security controls detect them, and repeatable traffic-mix testing.

    The commercial logic is to extend enterprise-scale testing below the tier served by the CF1000 to smaller equipment vendors and integrators. If the portability and price hold up, more of the security and networking supply chain can test post-quantum and AI-traffic performance in-house rather than relying on vendor datasheets. VIAVI has not disclosed pricing, so the cost-effectiveness claim, like the performance claims, awaits specifics.

    Background

    VIAVI Solutions, based in Chandler, Arizona, is a test-and-measurement and optical technology company. Its test products are used to validate data center, communications network and security infrastructure, and it also supplies resilient positioning, navigation and timing systems for military, aerospace, railway and first-responder communications, alongside optical technologies for anti-counterfeiting, consumer electronics and automotive markets.

    CyberFlood is VIAVI’s line of application and security test platforms, which emulate large numbers of users and applications to measure how networks and security devices perform. Before the CF50, the line’s flagship was the CF1000 for large enterprises. The new model arrives as organizations move AI inference into production and begin preparing encrypted connections for the transition to post-quantum cryptography.

    Sources

    Source: VIAVI Announces Smallest, Lightest, Most Efficient Platform for 100G Enterprise-Scale Application, Security and AI Inference Testing, VIAVI Solutions’ September 29, 2026 announcement of the CyberFlood CF50 test appliance.

  • One Script, 15+ Government Tenants: Why Shared Hosting Multiplies Espionage Risk

    One Script, 15+ Government Tenants: Why Shared Hosting Multiplies Espionage Risk

    TL;DR · 30-second read

    The Short Version

    Security researchers at Symantec say a small hacking crew based in China spent months reading the email of government officials across Asia and the Middle East. It also ran a cryptocurrency scam business from the same control screen.

    Its most effective move: instead of breaking into government ministries one at a time, it broke into the single company that hosted all of their email. One planted piece of code reached more than 15 government email systems at once.

    The takeaway is simple. When many organizations rely on one shared provider, one break-in can expose all of them.

    Industrial Cyber reported on August 14 that Symantec’s Threat Hunter Team, working with Carbon Black researchers, has exposed Jewelbug, which Symantec describes as a China-based hackers-for-hire group. According to Symantec, the group ran espionage campaigns against governments, militaries and state telecom operators across the Middle East, Southeast Asia and South Asia. It also ran a cryptocurrency fraud operation aimed at Chinese-speaking victims, and both activities were managed from a single browser-based control panel called XG-Web.

    In under three months, Symantec found, the group logged more than one million implant check-ins and stole over 580,000 browser cookies, thousands of credentials and more than 2,300 email bodies. An implant is a piece of malware that reports back to its operators. Its largest operation compromised a shared web-hosting platform run by a Middle Eastern state telecom provider, which placed malicious code in front of more than 15 government webmail tenants at once.

    Executive Summary

    Symantec’s research is unusually detailed. It is built on visibility into the group’s own control panel and victim database, so it describes more than a list of intended targets. It documents actual compromises: harvested mailboxes of senior officials, intercepted internal network traffic, and implants running on Windows machines, Linux servers and network devices. Jewelbug is also tracked under other names, including Earth Alux, REF7707 and CL-STA-0049.

    For infrastructure operators, the most important finding is architectural rather than about any single piece of malware. Jewelbug did not breach each ministry one by one. It gained write access to a centrally hosted webmail system run by a state telecom and planted one script, and that script fired for every ministry employee who logged in. A second finding points in the same direction. The group’s Linux and router implant, ClientKing, is built to reach servers and network equipment, the layer that carries everyone else’s traffic.

    Symantec also reported that some ClientKing builds were configured to route traffic through the internal corporate proxy of a major U.S. aerospace and industrial manufacturer. That extends the group’s footprint beyond Asia and the Middle East into industrial infrastructure.

    One Write Permission, Fifteen Ministries

    The shared-hosting compromise is the clearest demonstration in Symantec’s report of how multi-tenancy changes the economics of an attack. Multi-tenancy means many customers running on one platform. The Middle Eastern government’s ministries did not each run their own mail servers. They were tenants on a web-hosting platform operated by the state telecommunications provider. Once Jewelbug had write access to the central webmail system, it needed only one malicious script. That script ran each time any ministry staff member logged in or checked their email, across more than 15 government tenants.

    The attack chain that followed was conventional, and that is part of the lesson. The injected code captured session cookies and email addresses. Session cookies are the small tokens that keep a user logged in, and stealing one can let an attacker impersonate that user without a password. Windows users were then shown a fake Adobe Flash update prompt, which installed Antino, the group’s backdoor. Antino added a malicious browser extension that gave operators control of the browser and a route into internal government networks. None of these steps required a novel exploit against each ministry, because the shared platform had already delivered every tenant to the attacker.

    Symantec’s own summary makes the point directly: compromising a shared hosting provider and placing a watering hole on every government tenant turned a single intrusion into access across an entire national webmail estate. A watering hole is a trusted site rigged to infect the people who visit it. The implication for telecoms, hosting providers and data center operators that serve government or regulated customers is that the provider’s control plane is part of every tenant’s attack surface. The control plane is the administrative layer with write access to shared code. Tenant isolation at the data layer does little if one set of credentials can change the code all tenants run.

    The Network Layer Is in Scope

    Most espionage reporting centres on endpoints: laptops, email and browsers. Jewelbug’s toolkit goes further. According to Symantec, ClientKing is a Linux and router implant that can reach servers and network devices, and all of the group’s implants feed one victim database. Routers and Linux servers sit below the level where most endpoint detection tools operate. They often run for years between refreshes, and they see traffic from many downstream users at once.

    That matters for the telecom operators Symantec says were targeted. A foothold on network infrastructure can outlast a cleaned-up laptop and can observe traffic rather than just one user’s files. Symantec noted that the group intercepted internal network traffic, and that the common thread across its espionage targets was government communications and the providers that host them. The researchers said that combination would give an intelligence customer broad, durable access to official correspondence.

    The detail about the U.S. aerospace and industrial manufacturer needs careful reading. Symantec said a couple of ClientKing builds were configured to beacon through that company’s internal corporate proxy. That shows the group’s tooling was set up to operate inside or through that environment. The report as described does not establish the extent of any compromise there.

    A Hack-for-Hire Business Model, Visible From the Inside

    Symantec’s central attribution finding is that foreign-government espionage and commodity cryptocurrency fraud ran on the same infrastructure, by the same small team, from one control panel. The researchers call that pairing the signature of a hack-for-hire entity running for-profit crime on the side. They tied the fraud and search-engine-optimisation arm, with high confidence, to the sole legal representative of an SEO company in Changsha, Hunan Province. That attribution rests on identity documents, a business license and a stamped authorization letter. Symantec was explicit that the link between this individual and the espionage operators is not fully established. Its assessment is that the SEO business most likely supplied access, infrastructure and delivery.

    The operational discipline is notable for defenders. The group has built five generations of command-and-control code, the servers and software attackers use to direct their malware. A scheduled job checked its own domains against VirusTotal every 12 hours so operators could rotate away from anything flagged. VirusTotal is a widely used public malware-scanning service. Antino disguised its communications as ordinary Microsoft cloud traffic. Taken together, these choices suggest that blocklists and domain reputation alone will lag this kind of operator. Behavioural monitoring and integrity checks on shared code are better placed to catch it.

    For hosting and telecom operators, the practical questions are about blast radius. Who holds write access to code that every tenant executes? Is that code monitored for unauthorized changes? Are session tokens bound tightly enough that a stolen cookie is of limited use? None of these are exotic controls. The Jewelbug case shows what happens when one of them fails on a platform many customers share.

    Background

    Symantec is one of the longest-established names in enterprise security. Its enterprise business has been part of Broadcom since 2019, and its Threat Hunter Team publishes research on state-linked and criminal hacking groups alongside Carbon Black, another Broadcom-owned security brand. Different vendors often track the same group under different names, which is why Jewelbug also appears in industry reporting as Earth Alux, REF7707 and CL-STA-0049.

    Telecom operators and hosting providers have long been attractive espionage targets because they sit upstream of many customers at once. Governments in many regions consolidate ministry email and web services onto shared platforms, often run by a state telecom, to cut cost and complexity. The Jewelbug case shows the other side of that trade-off: consolidation also concentrates risk. Earlier in 2026, Symantec reported on Seedworm, an Iran-linked group whose campaigns spanned government, airport, manufacturing and financial targets.

    Sources

    Source: Symantec reveals Jewelbug espionage campaign targeting Asian governments, telecoms, critical infrastructure (Industrial Cyber): coverage of Symantec’s findings on a China-based hack-for-hire group running espionage and cryptocurrency fraud from one control panel.

  • US Warns State-Linked Hackers Target Network Gear; NSA Issues Router Hygiene Guidance

    US Warns State-Linked Hackers Target Network Gear; NSA Issues Router Hygiene Guidance

    US government authorities issued a public warning that state-linked threat actors are actively targeting vulnerable networking devices — including routers, switches and other edge gear — and the National Security Agency published accompanying router hygiene guidance, according to a July 13, 2026 Cybersecurity Dive report.

    The advisory is directed at operators of enterprise, small-business and home networks whose exposed devices can be recruited into espionage and pre-positioning campaigns.

    Executive Summary

    The joint messaging elevates a long-running concern into a formal public alert: perimeter networking devices, not just servers and endpoints, are a preferred entry point for state-linked intrusion sets. NSA’s router hygiene guidance is the practical companion — a checklist of configuration and maintenance steps operators are expected to follow.

    For infrastructure buyers, the significance is less about a single new vulnerability and more about the framing. Routers and firewalls that historically sat outside patch cycles and asset inventories are being reclassified, at least rhetorically, as first-class security assets. That has procurement, staffing and lifecycle implications for anyone running network gear at scale.

    The Edge Is the New Front Door

    For years, defenders concentrated on endpoints, identity and cloud workloads while edge devices — the routers, VPN concentrators and firewalls that sit between the internet and the internal network — were treated as appliances. State-linked operators noticed. Compromising an edge device gives an intruder a stable foothold with elevated network visibility, often below the level where endpoint detection tools can see. The current US warning is an acknowledgement that this asymmetry has become material at national scale.

    The economic pull for attackers is straightforward: one exploitable router can grant persistent access to every device behind it, and these devices are rarely rebooted, rarely re-imaged and often run firmware that has not been updated in years. That is a high-yield target for espionage groups that value durability over noise.

    What Router Hygiene Actually Means

    NSA’s guidance in this space typically covers a familiar but under-executed set of controls: keep firmware current, disable unused management services, restrict administrative access to trusted networks, replace default credentials, enable logging, and retire devices that no longer receive vendor patches. None of it is exotic. The gap the advisory is trying to close is operational, not conceptual — most organizations know the checklist and still do not run it end-to-end on their perimeter fleet.

    For smaller operators and home users, the practical implication is blunter: a consumer router that stopped getting firmware updates two years ago is a liability regardless of the brand on the box. The advisory implicitly pushes the market toward vendors that commit to defined support lifecycles, and away from cheap gear with unclear patch pipelines.

    Winners, Losers and Second-Order Effects

    Network vendors with mature secure-boot, signed-firmware and managed-update stories stand to benefit from any tightening of buyer expectations. Managed network and security service providers benefit too, because most organizations lack the staff to run a disciplined router hygiene program across dozens or hundreds of sites. The losers are end-of-life devices still in production and the budgets that have deferred their replacement.

    There are second-order effects worth flagging. Regulators and insurers tend to translate advisories like this into questions on audits and renewal forms; expect edge device patch status and end-of-support inventory to become recurring line items. Enforcement, however, is not automatic — a warning is not a rule, and the source coverage does not indicate any new binding requirement.

    Reading the Advisory Fairly

    It is worth being precise about what the source does and does not establish. The Cybersecurity Dive report describes a US government warning and NSA guidance; it is not, on its own, a technical disclosure of a specific new vulnerability chain, victim list or attribution to a named group. Readers should treat the advisory as a policy signal backed by prior public incidents rather than as a fresh indicator-of-compromise release.

    That framing cuts both ways. Skeptics who dismiss such warnings as vendor-friendly demand generation should note that the underlying pattern — state-linked targeting of network edge devices — has been documented repeatedly in prior US and allied advisories. Equally, industry claims that a given product line is inherently safer than another deserve the same scrutiny the advisory implicitly applies to unpatched fleets.

    Background

    US government agencies including the NSA and CISA have issued a running series of advisories over recent years warning that state-linked threat actors — attributed in prior public reporting to Russian, Chinese and other groups — target edge networking devices for espionage and pre-positioning. These campaigns exploit the fact that routers and firewalls are frequently unpatched, poorly monitored and long-lived compared with servers and endpoints.

    Router hygiene guidance from the NSA sits alongside broader ‘secure by design’ pressure on network vendors to ship devices with safer defaults, transparent patch pipelines and defined support lifecycles. The July 13, 2026 messaging reported by Cybersecurity Dive continues that trajectory rather than opening a new front.

    Source: US authorities warn that state-linked hackers are targeting vulnerable networking devices – Cybersecurity Dive — reporting on a US government advisory and accompanying NSA router hygiene guidance.

  • Eight U.S. Carriers Form C2 ISAC: Telecom Closes Ranks on Cyber Defense

    Eight U.S. Carriers Form C2 ISAC: Telecom Closes Ranks on Cyber Defense

    Eight of the largest U.S. communications companies have formed the C2 ISAC — an Information Sharing and Analysis Center dedicated to cybersecurity collaboration across the telecom sector. The announcement, distributed May 18, 2026 via the AT&T Newsroom, positions the new body as a vehicle for member carriers to exchange threat intelligence and coordinate defenses against attacks on communications infrastructure.

    Executive Summary

    An ISAC is a member-run clearinghouse where companies in one industry share indicators of compromise, attack patterns, and defensive playbooks — a model pioneered by the financial sector’s FS-ISAC in 1999 and since replicated across critical infrastructure. What is notable here is not the model but the participants: eight direct competitors, including AT&T, standing up a purpose-built cybersecurity body for communications rather than relying solely on existing government-coordinated channels.

    The move lands in a sector still absorbing the lessons of the publicly reported Salt Typhoon intrusions, in which a China-linked espionage campaign penetrated multiple major U.S. carriers and was disclosed beginning in late 2024. Whatever the C2 ISAC’s precise mandate turns out to be, its formation is a clear signal that the operators of America’s communications backbone believe collective, industry-led defense is now table stakes — and that the existing sharing arrangements were not enough on their own.

    Why Telecom Is Building Its Own War Room

    Telecom networks are uniquely attractive targets: compromise one carrier and you can potentially observe the communications of millions of customers, including government and enterprise traffic. The Salt Typhoon campaign made that risk concrete, with public reporting indicating intruders reached deep into carrier systems, including infrastructure tied to lawful-intercept functions. Against that backdrop, a formal, carrier-owned threat-sharing body reads as an institutional response — turning ad-hoc cooperation during a crisis into a standing capability.

    The sector was not starting from zero. Communications companies have long participated in government-coordinated sharing through bodies descended from the Communications ISAC and in cross-sector work with the Cybersecurity and Infrastructure Security Agency (CISA). Creating a new, industry-controlled center suggests the founders wanted something those channels did not fully provide — plausibly faster peer-to-peer exchange, tighter operational trust among a small membership, or an agenda set by carriers rather than convened by government. The release headline emphasizes collaboration; the substance will be in how the body differs from what already existed.

    The Economics of Shared Defense

    Cyber threat intelligence has an unusual economic property: sharing it costs the giver little and can save the receiver enormously, because attackers reuse infrastructure and techniques across targets. An indicator of compromise spotted on one carrier’s network — a malicious IP address, a tampered configuration, a phishing kit — is often the early warning that lets seven others block the same campaign. Pooling that signal across eight national-scale networks creates a sensor grid no single company could build alone.

    The catch is that sharing bodies live or die on trust and reciprocity. Members must be willing to disclose incidents that are commercially embarrassing, and to do so fast enough for the intelligence to matter. The U.S. Cybersecurity Information Sharing Act of 2015 provides liability protections designed to encourage exactly this, but ISACs across industries have historically struggled with free-riding — members who consume intelligence without contributing. A small founding group of eight peers, rather than a sprawling open membership, may be a deliberate design choice to keep contribution norms enforceable.

    Ripple Effects Down the Infrastructure Stack

    Carriers do not defend their networks in isolation. Their infrastructure runs through data centers, interconnection points, and cloud platforms, and their security posture directly affects every enterprise that buys transit, transport, or managed services from them. If the C2 ISAC succeeds in shortening the time between one member detecting a campaign and all members blocking it, the benefit flows downstream to customers who never see the machinery — fewer carrier-side compromises means fewer avenues into the businesses that ride those networks.

    There is also a competitive dimension. Security is increasingly a procurement criterion for enterprise and government connectivity contracts, and visible participation in a serious sharing body is a credential. For carriers outside the founding eight — regional operators, rural providers, wireless resellers — the open question is access: whether the C2 ISAC’s intelligence eventually reaches the broader ecosystem, or whether it deepens a capability gap between the largest operators and everyone else. Smaller operators have historically been the softer targets, so the sector-wide payoff depends on how far the sharing extends.

    Background

    ISACs trace to Presidential Decision Directive 63 in 1998, which urged each critical-infrastructure sector to build a hub for sharing threat information; the financial sector’s FS-ISAC, founded in 1999, became the template. The communications sector has participated in government-coordinated sharing for decades, but the disclosures beginning in late 2024 of the Salt Typhoon espionage campaign — which publicly reported accounts say penetrated multiple major U.S. carriers — sharpened scrutiny of whether existing arrangements moved fast enough. The C2 ISAC, announced in May 2026 with AT&T among its eight founding firms, is the sector’s most visible institutional answer to that question so far.

    Source: Eight Leading U.S. Communications Firms Form C2 ISAC to Strengthen Cybersecurity Collaboration — AT&T Newsroom release announcing the formation of a telecom-sector cybersecurity information sharing and analysis center.

  • Eight US Communications Giants Form C2 ISAC for Sector-Wide Cyber Defense

    Eight US Communications Giants Form C2 ISAC for Sector-Wide Cyber Defense

    Eight leading U.S. communications companies, among them Comcast, announced on May 17, 2026 the formation of the C2 ISAC, a new Information Sharing and Analysis Center intended to strengthen cybersecurity collaboration across the communications sector. The body will serve as a venue for member firms to exchange cyber threat intelligence relevant to the networks that carry the nation’s voice, video, and data traffic.

    Executive Summary

    The announcement establishes a dedicated, industry-run clearinghouse for cyber threat information among major U.S. communications providers. An ISAC — an Information Sharing and Analysis Center — is a nonprofit membership organization through which companies in a critical-infrastructure sector pool indicators of compromise, attacker tradecraft, and defensive practices, so that an intrusion detected on one network can inform defenses on all the others.

    The move matters because communications networks sit underneath essentially every other critical sector: finance, healthcare, energy, and government all ride on carrier infrastructure. It also arrives after a period in which U.S. telecommunications networks drew sustained attention from state-sponsored intrusion campaigns, making the case for faster, structured intelligence exchange among carriers considerably less abstract than it once was. That said, the announcement as distributed is brief, and key operational details — the full membership roster, governance, funding, and how C2 ISAC relates to existing communications-sector sharing bodies — are not spelled out in the material we reviewed.

    Why Telecom Threat Sharing Is Having a Moment

    The timing of a new communications-sector ISAC is not hard to read. Over the past two years, publicly disclosed intrusion campaigns attributed to state-sponsored actors — most prominently the Salt Typhoon operation revealed in late 2024 — showed that multiple major U.S. carriers could be compromised by the same adversary, using related techniques, over an extended period. When several competitors are being probed by one well-resourced attacker, the security of each network partly depends on what the others have already seen. Structured sharing converts one company’s painful discovery into every member’s early warning.

    For lay readers: threat intelligence in this context means concrete technical artifacts — malicious IP addresses, malware signatures, the specific sequences of actions attackers take inside a network — plus analysis of who is attacking and why. Shared quickly, it lets a defender look for an intruder before that intruder reaches them.

    Where C2 ISAC Fits in an Existing Ecosystem

    The ISAC model is well established: sector-specific centers have operated since the late 1990s, with the financial sector’s FS-ISAC often cited as the benchmark. The communications sector has historically coordinated through government-adjacent structures, including the long-running Communications ISAC function associated with the National Coordinating Center for Communications. A new, carrier-founded body suggests the major providers want an industry-owned vehicle with its own governance and, presumably, its own operational tempo.

    That raises a fair structural question that applies to any new sharing body, not to these companies specifically: does a new center consolidate effort or fragment it? The value of an ISAC scales with the breadth and candor of participation. If C2 ISAC becomes the primary venue where the largest carriers share at depth, it could raise the bar for the whole sector. If it operates in parallel with existing channels without clear division of labor, members could face duplicated processes and diluted signal. The announcement text we reviewed does not address this relationship.

    The Economics of Cooperating With Competitors

    Communications is a fiercely competitive business, and cybersecurity has sometimes been treated as a differentiator rather than a commons. ISACs work because they carve security out of the competitive arena: members compete on price, coverage, and service, but not on whether each other’s networks get breached. There is also a legal scaffold that makes this workable — the Cybersecurity Information Sharing Act of 2015 established liability protections for companies exchanging cyber threat indicators, addressing the antitrust and disclosure fears that historically chilled cooperation.

    The economics favor the members, too. Duplicating threat-hunting effort eight times over is expensive; pooling it is cheaper and better. For eight firms of this scale, even modest reductions in attacker dwell time — the period an intruder operates undetected — translate into materially lower incident costs and less regulatory exposure. The open question, common to all ISACs, is free-riding: sharing bodies tend to have a few prolific contributors and many quiet consumers. Governance and culture, not press releases, determine which way that goes.

    What Would Count as Success

    A fair test for C2 ISAC, a year in, would look like this: Is machine-speed indicator sharing actually operating, or is exchange limited to periodic meetings? Has membership broadened beyond the founding eight to regional carriers and smaller providers, who are often the softest targets and whose networks interconnect with everyone else’s? And is there evidence — even anonymized — that shared intelligence shortened a real incident? None of this is knowable at launch, and it would be unfair to demand it of a day-one announcement. But those are the measures by which the sector, its enterprise customers, and regulators should eventually judge the effort, and the founders would strengthen their case by committing to report against them.

    Background

    Information Sharing and Analysis Centers date to a 1998 U.S. presidential directive encouraging each critical-infrastructure sector to build a private-sector hub for exchanging threat information; the financial industry’s FS-ISAC, founded in 1999, became the model most others emulate. The communications sector — the carriers, cable operators, and network providers whose infrastructure underlies nearly every other industry — has historically coordinated through the National Coordinating Center for Communications and its associated ISAC function, alongside direct work with federal agencies such as CISA and the FCC.

    Pressure on the sector intensified after late 2024, when the Salt Typhoon espionage campaign revealed deep, sustained compromises across multiple major U.S. telecommunications providers. Those disclosures prompted congressional scrutiny, federal guidance on hardening carrier networks, and renewed debate about whether existing sharing arrangements moved fast enough — the backdrop against which eight major firms have now stood up an industry-owned center of their own.

    Source: Eight Leading U.S. Communications Firms Form C2 ISAC to Strengthen Cybersecurity Collaboration — press release distributed by Comcast Corporation, May 17, 2026, announcing the formation of a new communications-sector threat-sharing body.

  • Cyber Agencies Warn of China-Linked Covert Relay Networks Targeting Infrastructure

    Cyber Agencies Warn of China-Linked Covert Relay Networks Targeting Infrastructure

    According to an Industrial Cyber report dated April 23, 2026, cybersecurity agencies have flagged the use of covert networks by China-linked threat actors to support espionage and offensive cyber operations. The warning centers on relay infrastructure — chains of compromised or rented devices that hide where an attack actually comes from — a technique that has become a signature of state-linked campaigns against critical infrastructure.

    Executive Summary

    The reported advisory adds official weight to a trend that incident responders have been tracking for several years: state-linked operators no longer attack from infrastructure that can be neatly attributed and blocked. Instead, they route operations through covert relay networks — sometimes called operational relay box (ORB) networks — built from compromised small-office routers, Internet-of-Things devices, and leased virtual private servers scattered across many countries and providers.

    Why it matters: when malicious traffic arrives from an ordinary residential router in the defender’s own region, IP-reputation lists and geographic blocking lose much of their value. For operators of data centers, networks, and industrial systems, the warning is effectively a message that detection must shift from “where is this traffic from?” to “what is this traffic doing?” — a harder and more expensive posture to run.

    What a Covert Relay Network Actually Is

    A covert relay network is a mesh of intermediary devices — hacked home and small-business routers, unpatched edge appliances, IoT hardware, and short-lived rented servers — that an operator chains together so that each intrusion appears to originate from an innocuous, frequently rotating address. The technique is not new; anonymization proxies are decades old. What has changed is industrialization: reporting on China-linked activity in recent years describes purpose-built relay infrastructure operated at scale and shared across multiple intrusion sets, which makes attribution slower and takedowns less durable.

    For lay readers, the analogy is a getaway car swapped every few blocks. Blocking the last car seen tells you little about the driver, and there is always another car. That is precisely why agencies escalate from private industry reporting to public advisories: the countermeasure is not a blocklist but a change in defensive doctrine.

    Why Critical Infrastructure Is the Stated Concern

    The pairing of “espionage” and “offensive operations” in the reported warning is significant. Prior joint advisories from U.S. and allied agencies — most prominently the 2024 warnings about the actor tracked as Volt Typhoon — alleged that China state-sponsored operators were pre-positioning inside energy, water, communications, and transportation networks, using living-off-the-land techniques that generate little malware for defenders to find. Covert relay networks are the delivery layer for that style of campaign: quiet access, maintained over long periods, held potentially for disruption rather than immediate theft.

    Beijing has consistently denied state involvement in such campaigns, and attribution in cyberspace is probabilistic rather than courtroom-certain. A fair reading is that the agencies are describing a technique and an assessed linkage; the underlying evidence typically remains classified, which is a genuine limitation for anyone trying to independently verify the claims.

    The Uncomfortable Position of Network and Hosting Providers

    Relay networks are built from other people’s equipment. That places router vendors, hosting companies, and connectivity providers in the middle of the story whether they like it or not. End-of-life routers that no longer receive patches are prime recruitment targets, and legitimately leased virtual servers give relay operators clean, paid-for footholds. Expect continued pressure on vendors to ship secure-by-design defaults and enforce end-of-life transparency, and on providers to strengthen abuse detection and know-your-customer practices for infrastructure rentals.

    For colocation and cloud operators, there is a dual exposure: their customers are targets of these campaigns, and their platforms can be abused as relay nodes. Egress monitoring, rapid abuse response, and hardening of management planes are becoming table stakes rather than differentiators.

    What Defenders Can Realistically Do

    The honest implication of this warning is that source-based filtering is a weakening control. Defenses that still work include behavioral analytics that flag unusual logins and lateral movement regardless of origin, aggressive patching and replacement of end-of-life edge devices, network segmentation between IT and operational technology, and logging retention long enough to support the slow forensic work that relay obfuscation forces. None of this is novel advice — which is itself the point. Agencies issue advisories like this when known best practices remain widely unimplemented, particularly among smaller utilities and industrial operators with thin security budgets.

    Background

    Warnings about China-linked targeting of critical infrastructure have escalated steadily through the mid-2020s. In 2024, U.S. agencies and international partners publicly alleged that the state-sponsored actor tracked as Volt Typhoon had maintained long-term access inside U.S. energy, water, communications, and transportation networks using living-off-the-land techniques, and researchers began documenting large operational relay box (ORB) networks — obfuscation meshes built from compromised routers and rented servers — supporting Chinese cyber operations. Beijing has denied state involvement throughout.

    The reported April 2026 advisory sits in that lineage: rather than announcing a new intrusion, it elevates the enabling infrastructure — covert relay networks — to a named, official concern, signaling that agencies view origin-obfuscation itself as a strategic problem for defenders of critical systems.

    Source: Cybersecurity agencies flag use of covert networks by China-linked actors for espionage, offensive operations — Industrial Cyber’s April 23, 2026 report on an agency warning about relay-network obfuscation in state-linked cyber operations.

  • US and Allies Warn China Hides State Cyberattacks Behind ‘Covert Network’ Botnets

    US and Allies Warn China Hides State Cyberattacks Behind ‘Covert Network’ Botnets

    The United States and allied governments have issued a joint warning that hackers linked to the Chinese state are disguising cyberattacks by routing them through “covert network” botnets — fleets of compromised internet-connected devices that make hostile traffic appear to come from ordinary, innocuous sources. The warning, reported by Cybersecurity Dive on April 22, 2026, represents a coordinated, multi-government attribution effort rather than a single agency’s finding.

    Executive Summary

    A joint advisory from US and allied cybersecurity authorities alleges that China-linked threat actors are using covert botnet infrastructure to obscure the origin of state-directed intrusions. A botnet is a network of hijacked devices — often home and small-office routers, cameras, and other poorly secured edge equipment — that attackers control remotely. Used as relay infrastructure, a botnet lets an attacker’s traffic emerge from residential and business IP addresses in the victim’s own region, rather than from servers traceable to a foreign operator.

    The significance is twofold. First, joint multi-nation attribution advisories are deliberate diplomatic and defensive instruments: governments generally publish them only when the evidentiary picture is strong enough to share and the activity is serious enough to warrant public exposure. Second, the technique described strikes at a core assumption of network defense — that malicious traffic looks foreign or anomalous. When an attack arrives via a compromised router in a nearby suburb, geographic blocking and IP-reputation filtering lose much of their value.

    For operators of data centers, networks, and critical services, the practical message is that perimeter trust based on source address is increasingly unreliable, and that unmanaged edge devices — anyone’s edge devices — are now strategic assets in state conflict.

    Why Botnet Relays Defeat Traditional Defenses

    Most network defense still leans on reputation: block traffic from known-bad IP ranges, flag connections from unexpected countries, trust what looks local. Covert relay botnets invert that model. By proxying attacks through thousands of compromised consumer and small-business devices, an operator makes each intrusion attempt appear to originate from a legitimate residential ISP address — often in the same country, sometimes the same city, as the target. Each device may be used briefly and then rotated, so blocklists chase addresses that are already abandoned.

    The advisory’s framing — a “covert network” — suggests infrastructure built for stealth and persistence rather than the noisy, high-volume botnets historically used for spam or denial-of-service floods. That distinction matters: a quiet relay network is harder to detect precisely because it is not doing anything visibly disruptive most of the time.

    Attribution as Policy: What a Joint Advisory Signals

    Public, multi-government attribution is a comparatively recent tool of statecraft. When several allied agencies sign a single document naming a state actor, they are doing three things at once: sharing technical indicators with defenders, imposing reputational cost on the accused state, and signaling to their own critical-infrastructure sectors that the threat is assessed as serious at the national level. Beijing has consistently denied involvement in state-sponsored intrusion campaigns, and readers should note that public advisories typically summarize conclusions rather than publish the full underlying evidence — a genuine limitation of the format, even when the analysis behind it is extensive.

    The pattern is nonetheless consistent with several years of Western advisories describing China-linked groups that favor stealth, living-off-the-land techniques (using a system’s own legitimate tools rather than detectable malware), and pre-positioning inside critical infrastructure rather than immediate disruption.

    The Edge-Device Problem Nobody Owns

    Covert botnets exist because the internet’s edge is saturated with devices that are unpatched, unmonitored, and often past end-of-support: home routers, IP cameras, network-attached storage, VPN appliances. No single party is accountable for them — consumers don’t patch, many vendors stop shipping updates, and ISPs have limited visibility into customer equipment. That accountability gap is now a national-security externality: every neglected router is potential relay infrastructure for someone else’s intelligence service.

    Expect this advisory to add momentum to policy efforts around device security — secure-by-design commitments, software support lifecycles, and labeling schemes — because the demand side of the covert-network economy can only be constrained by shrinking the supply of hijackable devices.

    What Infrastructure Operators Should Take From This

    For enterprises, carriers, and data-center operators, the actionable lesson is architectural: treat source IP address as weak evidence of anything. Defenses that hold up against relay networks are behavioral and identity-based — anomaly detection on authentication patterns, phishing-resistant multi-factor authentication, network segmentation that limits lateral movement, and logging rich enough to reconstruct an intrusion after the fact. Operators of fleets of edge equipment — including hosting and connectivity providers — also sit on the other side of the problem: their unmanaged or end-of-life gear can become part of the covert network itself, making patch discipline and device retirement a matter of ecosystem hygiene, not just self-protection.

    Background

    Public attribution of state-sponsored cyber operations has become a standard instrument of Western policy over the past decade, with the US and partners such as the UK, Canada, Australia, and New Zealand increasingly issuing joint advisories rather than unilateral statements. Since 2023, a series of such advisories has focused on China-linked groups accused of infiltrating critical infrastructure using stealthy techniques, including botnets built from end-of-life routers used as relay infrastructure. China has denied these allegations throughout.

    The underlying enabler is the enormous installed base of consumer and small-business network devices that receive few or no security updates. Security researchers have long warned that this unmanaged edge constitutes ready-made anonymization infrastructure for any sophisticated actor willing to compromise it at scale.

    Source: China disguises cyberattacks with ‘covert network’ botnets, US and allies warn — Cybersecurity Dive report on a joint US-allied advisory, April 22, 2026.

  • CISA Flags Three More Cisco Flaws as Actively Exploited

    CISA Flags Three More Cisco Flaws as Actively Exploited

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that three additional Cisco networking device vulnerabilities are being actively exploited, according to reporting published on 22 April 2026 by Cybersecurity Dive. The confirmation is the mechanism CISA uses to move a flaw from “theoretically dangerous” to “known to be used by attackers in the wild.”

    The practical effect is immediate for two groups: U.S. federal civilian agencies, which are bound by directive to remediate catalogued vulnerabilities by a set deadline, and the far larger population of enterprise, carrier and data center operators who use the catalog as a de facto triage list. The available source material is a headline-level summary; it does not itself specify which Cisco products, software versions or vulnerability identifiers are involved.

    Executive Summary

    CISA’s confirmation adds three more Cisco networking flaws to the pool of vulnerabilities with observed real-world exploitation. That designation matters because it changes the calculus for defenders. A vulnerability with a high severity score but no evidence of use can often wait for the next maintenance window. A vulnerability that attackers are already using cannot, because every hour of delay is measured against an adversary who has working code today.

    The reason this lands on an infrastructure publication rather than only a security one is placement. Cisco equipment frequently sits at the network edge — the routers, firewalls, VPN concentrators and switches that form the boundary between an organisation’s internal network and the public internet. That is precisely the gear that data centers, colocation providers, carriers and enterprises depend on for connectivity, and precisely the gear that is hardest to take offline for an unscheduled patch.

    It is also worth stating plainly what this announcement is not. A KEV listing is a statement that exploitation has been observed. It is not, on its own, a statement about how widespread that exploitation is, who is behind it, or whether any particular organisation has been affected. Treating the confirmation as an urgent triage signal is correct; treating it as evidence of a mass compromise event goes beyond what has been established.

    Why the Network Edge Keeps Returning to the Emergency List

    Edge network devices have become one of the most attractive targets in enterprise computing, and the reasons are structural rather than accidental. These appliances are internet-facing by design — a VPN concentrator that cannot be reached from the internet cannot terminate remote-worker sessions. They hold credentials, routing tables and traffic in cleartext at the point of decryption. And they sit upstream of nearly everything else, so an attacker who controls the edge does not need to defeat the controls behind it.

    They are also comparatively dark. Most organisations run endpoint detection software on laptops and servers, generating a continuous stream of telemetry that a security team can query. Purpose-built network appliances typically run closed operating systems that do not accept third-party agents. Defenders see syslog output and interface counters, not process trees. An intruder who establishes persistence in the firmware of a firewall can be very difficult to spot with the tools most organisations already own.

    This is why the pattern recurs. The 2023 mass compromise of Cisco IOS XE web management interfaces and the ArcaneDoor campaign against Cisco security appliances disclosed in 2024 were separate events with separate causes, but both illustrated the same underlying economics: a single working exploit against a widely deployed edge platform yields disproportionate access. Nothing in the current disclosure links these three flaws to those earlier campaigns, and it would be wrong to assume a connection. The category of risk, however, is the same one.

    What “Actively Exploited” Actually Establishes

    It is worth applying the same scrutiny to a government advisory that one would apply to a vendor press release. CISA’s catalog has a specific evidentiary bar: reliable evidence that a vulnerability has been exploited in the wild. That bar is meaningful and it is not trivially met. But it is a threshold test, not a measurement. Confirmation that exploitation occurred is compatible with a single narrowly targeted intrusion by a well-resourced state actor and equally compatible with commodity scanning at internet scale. Those two scenarios call for materially different responses.

    The publicly available material here does not distinguish between them. It does not indicate whether the three vulnerabilities are chained together, whether any require prior authentication, whether exploitation grants full device control or something narrower, or whether patched software is already available for all affected versions. Each of those variables changes the urgency and the remediation path substantially. Readers should be cautious of coverage — from any direction — that fills those blanks with inference.

    The defensible reading is procedural. If an organisation runs the affected platforms, the catalog entry is an instruction to verify version, apply the fix or documented mitigation, and check for signs of prior access. That instruction holds regardless of how the underlying campaign is eventually characterised, which is the practical virtue of the catalog as a triage mechanism.

    The Cost of Patching Infrastructure You Cannot Reboot

    The uncomfortable operational truth is that emergency patching of network infrastructure is expensive in ways that patching a fleet of laptops is not. A core router reload is a service interruption. High-availability pairs reduce but do not eliminate the risk, because failover itself can drop stateful sessions and because both members of a pair usually need the same update. In a colocation or carrier environment, those interruptions are governed by service level agreements with financial consequences, and change windows are often contractually constrained to specific overnight hours.

    The result is a genuine tension between two legitimate obligations: availability commitments to customers and security obligations to those same customers. Organisations with mature change management, tested rollback procedures and accurate asset inventories absorb an out-of-cycle patch cycle in days. Organisations without them discover during the incident that they do not know precisely which software versions are running where — and inventory gaps, not patch availability, are usually the binding constraint on response time.

    There is a second-order cost that is easy to underestimate. If a vulnerability permits persistence that survives patching, remediation is not patching but rebuilding: credential rotation, configuration review, and in some cases firmware reimaging or hardware replacement. Whether that applies here is unknown from the available material, but it is the question that determines whether this is a weekend of work or a quarter of it, and it is the first thing an operator should try to establish from the vendor’s own advisory.

    Market Consequences: Concentration Cuts Both Ways

    Cisco remains one of the largest suppliers of enterprise and service provider networking equipment, and that scale is the reason its vulnerabilities become industry events rather than vendor events. Concentration in critical infrastructure produces correlated risk: when a single platform is deeply embedded across banks, hospitals, carriers and government agencies, one exploit chain has systemic reach. This is a property of market structure, not a criticism of any particular engineering organisation — the same dynamic would apply to whichever vendor held the equivalent position.

    Concentration also has a defensive upside that is often ignored in the immediate coverage. A large installed base funds substantial security engineering, attracts sustained researcher attention, and supports a coordinated disclosure and patching apparatus that smaller vendors cannot match. Vulnerabilities found in widely deployed products are more likely to be found at all, and more likely to be fixed quickly once found. The relevant comparison for a buyer is not “a vendor with disclosed flaws versus a vendor without” but “a vendor whose flaws are found and fixed versus one whose flaws are found quietly by someone else.”

    For buyers and investors, the durable signal is therefore not the existence of these three entries but the response characteristics around them: time from discovery to patch, clarity of advisories, availability of compromise-detection guidance, and whether fixes reach older supported releases rather than only the newest. Those metrics differentiate vendors over multiple years. A single catalog addition, in a market where every major network vendor has appeared in the same catalog, does not.

    Background

    CISA established the Known Exploited Vulnerabilities catalog in November 2021 under Binding Operational Directive 22-01, replacing the previous practice of prioritising patches primarily by severity score. The premise was that severity ratings measure potential impact while exploitation evidence measures actual risk, and that defenders with finite maintenance windows should address the flaws attackers are demonstrably using first. Federal civilian agencies must remediate catalogued entries by assigned deadlines; the catalog has since been adopted far more broadly as a prioritisation standard across private industry.

    Cisco has been one of the dominant suppliers of enterprise and service provider networking equipment for decades, with routers, switches, firewalls and VPN platforms embedded across carriers, data centers, financial institutions and government networks. That installed base makes its products both a persistent target for well-resourced adversaries and a focus of intensive security research. The recurring pattern of internet-facing network appliances becoming intrusion vectors is an industry-wide condition rather than a single-vendor one, driven by the fact that this equipment must be reachable to do its job while running closed operating systems that resist conventional monitoring.

    Source: CISA confirms exploitation of 3 more Cisco networking device vulnerabilities — Cybersecurity Dive, 22 April 2026, reporting CISA’s addition of three further Cisco networking flaws to its Known Exploited Vulnerabilities catalog.