China’s Hacking of US Telecoms: Officials Name More Victims

U.S. officials have named more of the domestic telecommunications firms that fell victim to what they’ve called a “broad and significant cyberespionage campaign” targeting senior government and political officials.

See Also: Live Webinar | North Korea’s Secret IT Army and How to Combat It

The group behind the attack, tracked as “Salt Typhoon” and tied to Beijing’s foreign intelligence service, has been connected to intrusions at nine telecoms, officials said. The attackers reportedly infiltrated telecoms in allied countries.

Newly disclosed U.S. victim organizations include Charter Communications, Consolidated Communications and Windstream, The Wall Street Journal first reported Saturday.

Previously disclosed American victims include AT&T, Lumen Technologies, T-Mobile and Verizon Communications.

When the hacking campaign began remains an open question. The Wall Street Journal’s latest report said the intrusions may have begun by mid-2023, if not earlier, and said investigators have now confirmed the hackers were inside one victim’s infrastructure for 18 months, and another for six months.

The FBI and Cybersecurity and Infrastructure Security Agency first publicly disclosed on Oct. 25, 2024, that they’d been probing “the unauthorized access to commercial telecommunications infrastructure by actors affiliated with the People’s Republic of China,” and said they’d notified and been providing assistance to victims, as well as other potentially affected companies.

Attackers reportedly accessed some of the telecoms they infiltrated by exploiting unpatched vulnerabilities in victims’ edge devices, including networking gear built by Cisco and Fortinet.

Officials said hackers have stymied efforts to permanently eject them. They offered no timeline for reliably confirming whether the hackers had been removed from some of the networks they had infiltrated.

“There are details that likely we will never know regarding the scope and scale,” Anne Neuberger, the White House deputy national security advisor for cyber and emerging technologies, told reporters in a Dec. 27 press briefing. “The Chinese were very careful about their techniques. They erased logs, and in many instances, companies weren’t keeping adequate logs.”

The White House said it recently identified the ninth victim of the attacks thanks to investigators identifying the tactics, techniques and procedures the advanced persistent threat group was using, and distributing a “hunting guide” for telecoms to spot those signs of attack.

Major telecoms AT&T and Verizon confirmed being hacked, but recently reported they believe they’ve now fully removed attackers from their network.

New York-based Verizon told Information Security Media Group last week that it has “contained the cyber incident brought on by this nation-state threat actor,” thanks in part to working with Google’s Mandiant incident response division. The telecom said it has seen no further signs of infiltration “for some time.”

Similarly, Dallas-based AT&T told Information Security Media Group that “we detect no activity by nation-state actors in our networks at this time.”

T-Mobile said last November that while the attackers breached its infrastructure, they failed to steal any sensitive customer information.

Lumen told The Wall Street Journal that it believes the hackers have been ejected from its network, and that they obtained no customer data.

Beijing regularly denies engaging in any hack attacks against other countries, with officials claiming China “firmly opposes and combats cyberattacks and cyber theft in all forms.”

Officials said the attackers appear to have intercepted metadata tied to millions of subscribers, including in the Washington, D.C., metro area. They also intercepted calls with then-Republican presidential candidate, now President-elect, Donald Trump, as well as to have targeted the campaign of his Democratic rival, Vice President Kamala Harris. In some cases, attackers reportedly obtained access to “lawful intercept” backdoors telecoms have installed to comply with court-ordered wiretaps. The hackers may also have been attempting to identify suspected Chinese agents under FBI surveillance.

AT&T described attackers’ focus as being on “a small number of individuals of foreign intelligence interest,” while Verizon said it found the hackers targeted a “small number of high-profile customers in government.”

The White House has called on the telecom sector to up its cybersecurity posture and create a collectively more “defensible infrastructure.” Neuberger accused some telecoms of “not doing the basics,” including employing robust monitoring and logging, and carefully administering their devices to keep them as secure as possible.

Based on the attacks, CISA in December released guidance advising the public at large to “use only end-to-end encrypted communications” across their devices and online accounts. The agency also recommended securing accounts using multifactor authentication via phishing-resistant hardware security keys. For less valuable accounts, it recommended securing them at least with MFA based not on SMS messages, but rather authenticator codes (see: US CISA Endorses Encrypted Apps Amid Chinese Telecom Hack).