Critical Infrastructure Security
SEC Filing Reveals Telecom Vendor Was Compromised for Nearly a Year
A nation-state threat actor carried out a supply chain attack targeting Ribbon Communications, a leading U.S. provider of telecom and networking infrastructure, and may have maintained access within its systems for nearly a year.
See Also: Tokenization, Authentication, and the Future of Machine-Led Transactions
Ribbon said it became aware of the unauthorized activity in early September after detecting suspicious behavior in its IT network, according to an investor disclosure. The company told regulators that initial access may have occurred as early as December 2024, though the full extent of the compromise is under investigation.
The company also said the unspecified nation-state attackers accessed a limited number of customer files stored outside its main network on two laptops. Ribbon said it has no evidence at this time that the threat actor gained material information or penetrated any operational systems.
Ribbon provides core routing, voice security software and optical networking tools to major telecom carriers and government customers, maintaining some of the most sensitive communications infrastructure nationwide. The company said it has engaged outside cyber forensics teams and is coordinating with law enforcement.
The U.S. telecom sector has been the subject of severe nation-state attacks in recent years as foreign adversaries exploit longstanding gaps in how carriers and their vendors defend core communications infrastructure. Lawmakers and national security officials have recently warned that adversaries are accelerating espionage operations faster than the public and private sector can respond.
National security and cybersecurity analysts told Congress little had been done to mitigate major issues across the sector following the fallout from the Salt Typhoon hack in 2024. Jamil Jaffer, founder and executive director of the National Security Institute, told lawmakers the U.S. had “precious little to show” in response to what has been described as one of the most expansive digital intrusions in American history (see: Experts See Little Progress After Major Chinese Telecom Hack).
“The stark reality is we are not currently positioned to provide for a comprehensive defense of our nation, nor the global telecommunications systems or networks that American companies help operate,” Jaffer told the House Energy and Commerce Committee. “And we do not appear prepared to undertake the actions needed to do so.”
Ribbon said it has strengthened monitoring and is implementing additional network hardening to prevent further unauthorized activity. The company also said it believes it has successfully terminated the threat actor’s access to its environment.
It remains unclear what the nation-state’s motives were or whether the attackers attempted to leverage access to Ribbon’s IT systems to build pathways into downstream carrier networks. The company did not immediately respond to a request for comment.