Bouygues Telecom Hacked – 6.4 Million Customers Data Exposed

In the early hours of August 6, 2025, Bouygues Telecom detected anomalous network traffic that signaled a sophisticated cyber intrusion.

Initial forensic logs revealed that an advanced malware strain had breached perimeter defenses via a spear-phishing campaign targeting administrative credentials.

This campaign exploited a zero-day vulnerability in a lesser-patched VPN gateway, enabling attackers to deploy a custom backdoor and pivot laterally across core systems.

As the breach progressed, customer databases containing personal identifiers and subscription details were exfiltrated, affecting 6.4 million user accounts.

Over the following hours, Bouyguestelecom’s incident response team executed containment protocols, isolating compromised segments and revoking exposed credentials.

The rapid escalation was driven by the malware’s polymorphic loader, which reconfigured its decryption routine on each restart.

Bouyguestelecom analysts noted the loader utilized AES-ECB encryption with dynamically generated keys, thwarting signature-based detection in sandbox environments.

The operator promptly notified the CNIL and engaged judicial authorities, while deploying enhanced monitoring across all endpoints.

Despite the immediate containment measures, the breach’s impact resonates across France’s telecom landscape.

Subscriber confidence has wavered, prompting Bouygues Telecom to offer dedicated support lines and free identity theft protection.

The incident underscores the evolving threat posed by state-sponsored adversaries leveraging blended attack vectors to compromise seemingly robust infrastructures.

Infection Mechanism

Delving deeper into the malware’s infection mechanism reveals a multi-stage dropper that abuses Windows Management Instrumentation (WMI) for stealthy execution. Upon initial file delivery—disguised as a routine security update—the dropper registers a WMI event subscription:

$action = New-Object System.Management.EventQuery `
    -ArgumentList "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Processor'"
Register-WmiEvent -Query $action -SourceIdentifier TaskTrigger -Action {
    Start-Process -FilePath "C:\Windows\Temp\sysupdate.exe" -ArgumentList "/silent"
}

This mechanism ensures the payload runs with SYSTEM privileges whenever the CPU load state changes, allowing the malware to bypass user-mode defenses.

The secondary payload, a DLL implementing a remote command interface, persists by modifying the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, invoking reconnaissance modules that fingerprint host configurations and exfiltrate data through encrypted HTTP tunnels.

Continuous domain generation algorithm (DGA) updates further complicate detection, as each infected host resolves unique command-and-control endpoints.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.