"having considerable success exploiting publicly known common vulnerabilities and exposures (CVEs) and other avoidable weaknesses within compromised infrastructure [T1190].
Exploitation of zero-day vulnerabilities has not been observed to date."

So you're saying they're script kiddies and they're totally pwning the telecoms sector worldwide?

What about this is "advanced?"

https://www.ic3.gov/CSA/2025/250827.pdf