What happened to Unitel?

Angola’s largest telecom operator, Unitel, was hit by a cyberattack in the early hours of Tuesday morning. The incident knocked out voice services, mobile data, and internet access for millions of customers across the country.

The company detected the breach shortly after 2 a.m. local time. In a statement, Unitel said response and containment mechanisms were immediately activated, and technical and cybersecurity teams were mobilized. Yet services remained disrupted as of Wednesday, with no clear timeline for full restoration.

What makes this attack particularly striking is the timing. It struck less than 24 hours before Unitel was due to make its stock market debut on Angola’s exchange, BODIVA.

Network data reveals the likely cause

Network measurement data from RIPE NCC, reviewed by Recorded Future News, shows that Unitel’s IP prefixes remained announced to the global internet throughout the incident. That means the routers connecting the company to the rest of the internet stayed online.

Those prefixes would normally disappear if the disruption came from an external source, such as an upstream connectivity cut or a volumetric DDoS attack. Their persistence suggests the cause was instead an incident that disabled core internal systems.

Traffic telemetry from Cloudflare Radar shows Unitel’s traffic collapsing sharply from around the time of detection and remaining well below baseline into Wednesday. The disruption appears specific to Unitel — no other Angolan network operator showed any degradation over the same period.

Impact on businesses and payments

The outage also disrupted point-of-sale payment terminals running on Unitel’s network, according to Angolan business publication Expansão. That means businesses across the country struggled to process card payments, and digital services dependent on internet access were hobbled.

The IPO went ahead anyway

Despite the ongoing outage, Unitel began trading Wednesday on the Angolan securities exchange, known as BODIVA. It became the largest initial public offering in Angola’s capital market history.

The Angolan state, through its asset management institute IGAPE, sold a 15% stake in the company. The offer, which ran from July 6 to July 24, was oversubscribed at a rate of 120.72%, with more than 11,000 investors participating.

Trading proceeded Wednesday, valuing the company at $2.14 billion and raising around $321 million for the government. Neither BODIVA nor Angola’s capital markets regulator had issued any public statement about the cyberattack as of the time of publication.

A test for Angola’s privatization push

The listing is a centerpiece of President João Lourenço’s privatization program, which aims to reduce state dominance in the former Marxist-Leninist economy and attract foreign capital. Unitel became the first non-financial company listed on the Angolan exchange.

Its successful subscription was widely seen as a test of investor appetite for Angolan state assets — and a potential precursor to the listing of larger entities, including national oil company Sonangol.

Unitel came under state control in 2022 after authorities seized shareholdings previously owned by Isabel dos Santos, daughter of former President José Eduardo dos Santos. That move was part of Lourenço’s broader effort to unwind business networks tied to his predecessor’s 38-year administration.

What’s next?

Angolan authorities have not made any statements regarding the timing of the attack or whether it was linked to the IPO. Unitel has not commented on the nature of the breach — whether it was ransomware, a destructive wiper, or something else entirely.

For now, millions of Angolans remain without reliable mobile service, and businesses are feeling the pinch. The fact that the attack hit exactly when it did — hours before a landmark listing — raises questions that authorities will need to answer.

This isn’t the first time a major telecom has faced such a crisis. Telecom cyberattacks have become increasingly common in emerging markets, where state-owned operators often run aging infrastructure with limited security budgets. Angola’s next steps will be watched closely by investors and regulators alike.

What Happened?

Progress Software has told some customers that its flagship enterprise file-sharing service, ShareFile, is facing a “credible external security threat.” The warning, issued on July 10, specifically targets Storage Zone Controllers — the component that gives ShareFile clients private data storage.

The company’s email, later posted on its official ShareFile Community forum, confirmed that access to certain accounts had been temporarily disabled as a precaution. There’s no evidence yet of unauthorized access to any customer data, but Progress is urging users to manually shut down the servers hosting their Storage Zone Controllers.

That’s a strong ask. It essentially tells admins to pull the plug on their own infrastructure while the company investigates.

What Is Storage Zone Controller?

For those unfamiliar, Storage Zone Controller is what makes ShareFile different from a run-of-the-mill cloud drive. Instead of storing everything on Progress’s servers, organizations can keep their data in their own data centers or in a cloud environment they control. That’s a big selling point for regulated industries like healthcare and legal services.

But it also means a vulnerability in this component could expose sensitive data at the customer’s location, not just at Progress’s central cloud.

Timeline of the Incident

Here’s what we know so far, based on the company’s statements and user reports:

• July 10: Progress sends emails to affected customers, warning of the threat and disabling access.
• July 10: Company says users will hear an update within 24 hours.
• July 12 (5 p.m. ET): Progress claims all ShareFile customers with Storage Zone Controllers have been notified that cloud access is restored.
• July 13: Reddit users report three days of silence. The status portal still shows the July 10 update as the latest.

That gap between promise and delivery hasn’t sat well with some users. One Reddit thread from July 13 is full of admins asking the same question: what’s actually going on?

Progress, for its part, said in a statement to Infosecurity that Storage Zone Controllers “must remain turned off while we complete our investigation.” So cloud access is back, but the on-premise piece is still frozen.

Is This Connected to MOVEit?

It’s impossible to talk about Progress Software security without mentioning the elephant in the room: MOVEit Transfer. In 2023, a critical vulnerability in that product was exploited in widespread ransomware attacks that hit hundreds of organizations. The fallout was massive, and it put a spotlight on Progress’s security practices.

Now, some forum participants are speculating that this ShareFile incident could be related to a recently disclosed vulnerability or even a new zero-day. Progress hasn’t confirmed any of that. In fact, the company says it has “not identified any active threat.”

That’s a reassuring line, but it’s also worth remembering that the MOVEit breach initially looked contained too. The company’s history makes it hard to give it the benefit of the doubt.

What Should ShareFile Customers Do?

If you’re running a Storage Zone Controller, here’s the practical advice:

1. Keep it off. Progress has explicitly said controllers must remain powered down until further notice. Don’t rush to reboot.
2. Monitor the status portal. The official ShareFile status page is the best source for updates, even if it’s been quiet lately.
3. Check your logs. Once access is restored, review access logs for any suspicious activity during the window.
4. Talk to your account rep. If you’re a paying customer, you should be getting direct communication. If you’re not, ask why.

It’s also a good moment to review your overall enterprise file sharing security posture. Incidents like this are a reminder that even trusted vendors can be a weak link.

The Bigger Picture

Progress Software has had a rough couple of years on the security front. The MOVEit breach was a black mark that the company has been trying to live down, and now this. It’s not a good look for a vendor that positions itself as a trusted name in secure file transfer.

For CISOs and IT admins, the lesson is familiar but worth repeating: third-party risk is real. If you’re using a service like ShareFile to store sensitive data, you need a contingency plan. That means backups, alternative communication channels, and a clear understanding of what your vendor will do when things go sideways.

Progress says it has launched internal and external security investigations. No timeline has been given for when the full picture will emerge. Until then, the advice is simple: keep those controllers off, and keep an eye on your inbox.

We’ll update this story as more details become available.

For months, two of the world’s most sophisticated cyber espionage operations were quietly working the same beat: the digital backbone of Pakistan’s police forces. One linked to Beijing. The other to New Delhi. Both after the same sensitive data.

New research from SentinelOne‘s SentinelLabs, published July 9, reveals that suspected China- and India-nexus actors ran parallel intrusion campaigns against several Pakistani law enforcement bodies between February 2024 and April 2026. The primary target: Balochistan Police, the province’s main force.

This is a story about espionage, sure. But it’s also a story about what happens when rival nations see the same vulnerable target and decide it’s worth the risk.

What the Attackers Got Access To

The compromised assets weren’t just email accounts or routine administrative systems. These were servers hosting the kind of data that makes intelligence analysts salivate:

• Biometric records and fingerprint databases
• Criminal case files
• Tenant and landlord registrations tied to national identity data
• Police personnel and payroll records
• Stolen vehicle records
• Hotel check-ins linked to identity information
• Citizen complaints, including misconduct reports

One China-nexus actor reportedly planted implants in a portal used by both officers and citizens. The scale is staggering — and the implications for privacy and national security are profound.

Four Clusters, Two Adversaries

SentinelLabs grouped the command and control (C2) activity into four distinct clusters. The technical fingerprints tell a clear story of attribution.

PlugX, ShadowPad and Cobalt Strike — all well-known tools in the Chinese cyber arsenal — point to China-nexus operators. A separate Remcos cluster was tied to a suspected India-nexus actor that Recorded Future tracks as TAG-179, a group that overlaps with what others call Bitter.

Two rivals. Opposite motives. Same battlefield.

Why China Wanted the Data

For China, the likely driver was the safety of its nationals. The China-Pakistan Economic Corridor (CPEC) has poured billions into the region, and Chinese workers have faced repeated deadly attacks there. Some of those attacks were claimed by the Balochistan Liberation Army (BLA), a separatist group that has made targeting Chinese interests a centerpiece of its strategy.

Police data would allow China to assess that threat independently — without relying on Pakistani assurances. It’s a classic intelligence move: verify what your ally tells you, using their own records.

India’s Angle: The Rivalry Next Door

India’s motive is less about protecting citizens and more about the enduring rivalry with Pakistan, in which Balochistan is a recurring flashpoint.

Islamabad has long accused New Delhi of backing the Baloch insurgency — an accusation India denies. The police force holds the record of how Pakistan polices the province. For Indian intelligence, that’s a goldmine of operational insight.

The convergence of these two campaigns isn’t a coincidence. It’s a reflection of how Balochistan has become a geopolitical chessboard where information is the most valuable currency.

The Citizen Portal That Turned Against Its Users

The standout finding was the compromise of the force’s Complaint Management System (CMS), a portal used by both officers and citizens to track complaints. Two variants of an implant named cms_plugin.exe were uploaded in late 2024.

One variant, written in Rust, is a stager that on execution displayed a reassuring message: “Update Complete! Please refresh the page.” It mimicked a routine portal update. Users had no reason to suspect anything was wrong.

The other variant, built in .NET, posed as a component of Chinese vendor Qihoo 360‘s security software. It loaded an AsyncRAT client, giving the attackers remote control over infected machines. Shared code and simplified Chinese strings pointed to a Chinese-speaking developer.

A Structural Risk in Digital Policing

The convergence of these campaigns reflects a deeper problem. Systems that centralize records and services also concentrate intelligence value. Police infrastructure has become intelligence terrain for any capable adversary.

This isn’t just a Pakistani problem. Every country that digitizes law enforcement data creates a similar honeypot. The question is whether the security posture matches the sensitivity of the data.

For Balochistan Police, the answer appears to be no. And when two rival nations both figured that out, the result was a silent war fought over servers and databases — with citizens’ most personal data caught in the crossfire.