Clearsky researchers say Hezbollah's cyber unit Lebanese Cedar hacked 250+ unpatched Atlassian and Oracle servers at telecoms and ISPs in US, UK, Israel, more
Context & Ripple Effects
Lebanon-linked espionage has been on researchers' radar since 2018, when hundreds of gigabytes of internal files surfaced online detailing an operation built around bogus websites and malicious apps to steal passwords and eavesdrop (hundreds of gigabytes of leaked files). Clearsky's new report upgrades that picture: it attributes intrusions into more than 250 unpatched Atlassian and Oracle servers at telecoms and ISPs in the US, UK, Israel and elsewhere to Hezbollah's Lebanese Cedar unit.
The target set matters. Telecoms and ISPs are the same strategic sector Recorded Future later found breached at scale by Salt Typhoon via Cisco routers (five more telcos and ISPs plus universities), suggesting these networks are contested ground for multiple state-linked actors.
First-order effects
- Telecoms and ISPs still running internet-facing Atlassian and Oracle servers must treat them as compromised-or-compromisable, prioritizing patching and intrusion review across the 250+ identified machines in the US, UK, Israel and other countries.
- Lebanese Cedar gains persistent footholds inside communications infrastructure, giving Hezbollah-linked operators potential access to traffic and credentials at carriers rather than just end-user phishing targets.
Second-order effects
- Atlassian and Oracle face pressure to harden their most commonly exposed server products, since the exploit vector here was unpatched software rather than a novel zero-day — the same dynamic Cisco Talos documented when Lazarus rode the Log4j flaw into energy providers' VMware Horizon servers (Lazarus exploited Log4j in VMware Horizon servers).
- Carriers in the affected countries face competitive and regulatory scrutiny over patch hygiene, with unpatched enterprise servers becoming a due-diligence item for governments that depend on those networks.
Third-order effects
- If the pattern holds — Lebanese Cedar, Lazarus, and Salt Typhoon all entering critical networks through known-but-unpatched software — patching cadence stops being an IT metric and becomes a national-security baseline for telecoms, likely drawing regulator-mandated minimum standards for carrier-facing infrastructure.
- State-linked groups appear to be converging on telecoms as shared strategic terrain, which pushes defenders toward ecosystem-level cyber defense where a single carrier's unpatched server exposes traffic and trust chains for many downstream organizations.
The trend: State-linked hacking units are systematically targeting telecoms through unpatched enterprise software, turning vendor patch discipline at carriers into a matter of national security.