US Identifies Hacking Firm Behind Salt Typhoon Telecom Hacks

The U.S. federal government said Friday it’s traced the source of Chinese hacker intrusions into telecommunications networks to a government contractor located in hacking hotbed Sichuan.

See Also: Enabling Government for Modernized IT

Major American telecoms and the government are fending off Chinese state penetration of communications networks attributed to a state actor tracked as Salt Typhoon. The Department of Treasury said cybersecurity firm Sichuan Juxinhe Network Technology has direct involvement with the group.

Treasury imposed sanctions on the firm, one of many that make up a burgeoning hack-for-hire market that’s taken root in the interior province of Sichuan, especially in its capital city of Chengdu. Telecom giants AT&T and Verizon Communications in late December reported they’ve permanently removed the foreign intrusion.

Treasury additionally sanctioned Chinese national Yin Kecheng for his involvement in hacking into the federal department’s own computing environment, including into the bureau responsible for enforcing sanctions and the office that reviews foreign investments for national security threats (see: Report: Chinese Hackers Breached CFIUS).

Treasury said Yin is based in Shanghai and is affiliated with the Ministry of State Security, China’s civilian intelligence agency.

The Treasury announcement is one of a slew of similar actions against Chinese threat actors, including sanctions imposed on Jan. 3 against Beijing-based Integrity Technology Group, accused of supporting the Chinese state hacking group tracked as Flax Typhoon. Another Chinese hacking contractor, Sichuan Silence Information Technology, came under U.S. sanctions in December, a blacklisting paired with an indictment against a Chinese national who say developed a zero day exploit of Sophos firewalls while employed at Sichuan Silence (see: US Indicts, Sanctions Alleged Chinese Sophos Firewall Hacker).

The outgoing Biden administration in an executive order signed Thursday signaled intent to yield sanctions more aggressively by expanding Treasury authority to sanction anyone complicit in hacking. The executive order allows Treasury to sanction any person who “directly or indirectly” enabled hacking. It also opens the door for sanctions against anyone who directly or indirectly knowingly uses hacked information for financial gain (see: Biden Boosts Sanctions Powers to Target Cyber Underground).

Whether the Trump administration, due to begin on Monday at noon, will use the new authorities is yet unknown.