Feds Identify Ninth Telecom Victim in Salt Typhoon Hack

U.S. investigators uncovered a ninth telecommunications firm hit in ongoing attacks by Chinese hackers tracked as Salt Typhoon to penetrate communications systems and target senior government and political officials.

Chinese hackers linked to Beijing’s foreign intelligence service maintained “broad and full” access to vulnerable telecommunications infrastructure across the country while aiming to steal customer call records and copy sensitive data used in law enforcement requests. Deputy National Security Advisor for Cyber and Emerging Technologies Anne Neuberger told reporters Friday the widespread hack was carried out by the same advanced persistent threat group that infiltrated systems handling court-authorized wiretaps while targeting President-elect Donald Trump, Vice President-elect JD Vance and other political leaders (see: FBI Updates on Vast Chinese Hack on Telecom Networks).

Neuberger said the hackers could potentially geolocate millions of Americans through their cellphones and were specifically targeting a limited number of government and politically affiliated individuals mainly based in the Washington, D.C. area.

“The Chinese were very careful about their techniques, they erased logs, and in many instances, companies weren’t keeping adequate logs,” Neuberger said during a media briefing, adding: “There are details that likely we will never know regarding the scope and scale.”

The Cybersecurity and Infrastructure Security Agency and FBI launched investigations earlier this year after reports indicated Verizon Communications, AT&T and Lumen Technologies were among targeted broadband providers. Experts warn Salt Typhoon – which has been active since August 2019 – is still embedded in U.S. telecommunications infrastructure.

Neuberger urged telecom firms to adopt stronger cybersecurity practices, noting how in one example hackers gained access to over 100,000 routers due to a singular insecure administrator account. Officials have declined to name victim companies or individuals included in the attack, and it remains unclear whether the hackers successfully stole records from campaign phones used by Trump or others.

“The reality is that China is targeting critical infrastructure in the United States,” Neuberger said. “Those are private sector companies, and we still see companies not doing the basics.”

Neuberger said the federal government will announce additional actions next month to hold Beijing accountable for the historic breach of U.S. telecommunications infrastructure. The Federal Communications Commission is set to vote in January on a declaratory ruling that would bolster cybersecurity protections for U.S. critical infrastructure, while the General Services Administration is evaluating federal contracts to improve cybersecurity measures across government systems.

On Monday, President Joe Biden signed an annual defense bill authorizing $3 billion to help small and rural carriers replace Chinese-made equipment (see: US Congress Authorizes $3B to Replace Chinese Telecom Gear). The FCC’s Secure and Trusted Communications Networks Reimbursement Program was initially launched in 2020 with a $1.9 billion investment, but experts said the agency has since struggled with a $3 billion funding gap to fully eradicate the threat.