9 Telcos Have Been Breached by Beijing-Backed ‘Salt Typhoon,’ White House Says
U.S. telecommunications giants AT&T and Verizon Communications say they have permanently ejected Chinese cyber espionage hackers from their networks.
See Also: How to Take the Complexity Out of Cybersecurity
The attacks, which may have begun months ago, have been attributed to hackers tied to Beijing’s foreign intelligence service. Researchers track the hacking group, which has been active since at least 2019, using the codename “Salt Typhoon.”
Dallas-based AT&T told Information Security Media Group that “we detect no activity by nation-state actors in our networks at this time.”
New York-based Verizon likewise told TechCrunch in a statement that it has “contained the cyber incident brought on by this nation-state threat actor,” thanks in part to working with a third-party incident response firm, which it declined to name. The telco said it has seen no further signs of infiltration “for some time.”
Efforts to trace and jettison what officials have described as the Chinese hackers’ “broad and full” access to U.S. telecommunications firms’ infrastructure have been ongoing for months. Reported victims include officials tied to the presidential campaigns of both Democrat Kamala Harris and Republican Donald Trump.
Hackers’ access gave them “the capability to geolocate millions of individuals” as well as “to record phone calls at will,” Anne Neuberger, the White House deputy national security advisor for cyber and emerging technologies, told reporters Friday.
Investigators said attackers in some cases appeared to have gained direct access to the “lawful intercept” backdoors telecoms have installed to comply with court-ordered wiretaps.
AT&T said the Salt Typhoon hackers who infiltrated its network appear to have targeted “a small number of individuals of foreign intelligence interest,” with investigators finding “relatively few instances” in which the hackers actually intercepted their communications or other personal information.
“We will continue to work closely with government officials, other telecommunication companies and third-party experts on the investigation of this nation-state action, and we are monitoring and remediating our networks to protect our customers’ data,” it said.
Similarly, Verizon said it found the hackers targeted a “small number of high-profile customers in government.”
The Cybersecurity and Infrastructure Security Agency and FBI are among the agencies participating in the national security probe, as The Wall Street Journal first reported in September. At that time, officials said the infiltrations might have begun many months before and gone undetected.
Known victims of the attacks have included not only Verizon and AT&T but also Lumen Technologies. America’s largest telco, T-Mobile, last month said that while the attackers also breached its infrastructure, they failed to steal any sensitive customer information.
Publicly disclosed details about the efforts to remove the advanced persistent threat attackers from telcos’ networks led the APT groups to change tack, and they have remained difficult to excise, officials said earlier this month (see: No Timeline for Evicting Chinese Hackers from US Networks).
Beijing regularly denies engaging in any hack attacks against other countries, with officials claiming China “firmly opposes and combats cyberattacks and cyber theft in all forms.”
White House officials have said the hackers appeared to intercept telephone conversations for some high-level government and political figures, as well as broad swaths of metadata tied to voice and text messaging – comprising who, what, where and when – for a large group of individuals, largely based in the metropolitan Washington, D.C.
On Friday, the White House raised the count of hacked U.S. telecom from eight to nine, although declined to name the additional victim. Neuberger said the latest victim was identified thanks to investigators building a “hunting guide” for all telecom, based on the tactics, techniques and procedures they learned the APT group using.
Officials have yet to state how the intrusion campaign first got discovered.
Verizon said it responded quickly once it learned of the intrusions. “Immediately upon learning of this incident, Verizon took several key actions to protect its customers and its network, including partnering with federal law enforcement and national security agencies, industry partners and private cybersecurity firms,” Verizon said in a statement. “After considerable work addressing this incident, we can report that Verizon has contained the activities associated with this particular incident.”
The White House has called on the communications sector to improve cybersecurity practices. Neuberger on Friday said some telecoms were “not doing the basics,” including robust monitoring, logging and administrative practices, which made their networks easier to hack, and those hack attacks much more difficult for investigators to later trace.
“The Chinese were very careful about their techniques, they erased logs, and in many instances, companies weren’t keeping adequate logs,” Neuberger said.
At one telecom, which she declined to name, she said attackers successfully accessed over 100,000 routers, due to a single administrator account that the organization was failing to properly secure. She’s called on the industry to collectively get smarter about creating a more “defensible infrastructure,” including better configuration management, vulnerability management as well as sharing threat information.