Salt Typhoon Believed to be Behind Commvault Data Breach

A Chinese government-backed hacking group known for targeting U.S. critical infrastructure and cloud software providers is linked to a recent breach of data management firm Commvault’s cloud environment, reigniting concerns over the exposure of sensitive government and corporate data hosted in the cloud.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The U.S. Cybersecurity and Infrastructure Security Agency said in a recent advisory that Commvault detected threat activity in its Microsoft Azure-hosted applications after attackers may have accessed client services for its Microsoft 365 backup software-as-a-service platform. The agency stopped short of naming the hackers. It said the breach gave threat actors unauthorized access to Commvault customers’ Microsoft 365 environments where application secrets were stored.

A source familiar with the incident confirmed to Information Security Media Group that officials believe the attack was carried out by Salt Typhoon, a Chinese state hacking unit behind last year’s breach into American telecommunications infrastructure that partly targeted then President-elect Donald Trump. The advisory warned the activity likely signals a wider campaign against cloud applications left exposed by default configurations and elevated permissions.

The advisory follows warnings to Congress from national security and telecommunications analysts who said the Salt Typhoon hack exposed a major failure in national cyber defenses, with little action taken since to strengthen critical infrastructure. Experts have cautioned that Chinese state-backed hackers likely remain embedded in U.S. systems and that another major cyberattack could be imminent (see: Experts Warn Congress Another Salt Typhoon Attack Is Coming).

Commvault said in a May blog post that Microsoft first alerted the company on Feb. 20 that a nation-state threat actor had gained unauthorized access to its Azure environment. The company said the actor may have accessed a subset of application credentials used by some customers to authenticate their Microsoft 365 environments. It said there was no unauthorized access to customer backup data and no material impact on business operations or service delivery.

CISA urged users and administrators to monitor Entra audit logs for unauthorized changes to service principal credentials initiated by Commvault applications. The agency also recommended reviewing Microsoft logs, conducting internal threat hunting, implementing conditional access policies and rotating application secrets and credentials used in Commvault Metallic applications between February and May.

Salt Typhoon, a Chinese government-backed group active since August 2019, was identified through telemetry on government networks during its attack on U.S. telecom infrastructure, then – CISA Director Jen Easterly said in January (see: CISA First Spotted Salt Typhoon Hackers in Federal Networks).

The link between the Commvault breach and Salt Typhoon was first reported by Nextgov, which highlighted an April warning from CISA about flaws in Commvault products. The company runs a large federal services arm and has a variety of large private clients, including Deloitte and Sony.

A Commvault spokesperson told ISMG the company has not “independently attributed the activity to a particular threat actor.” The statement also said that CISA’s advisory did not contain any new information beyond what the company previously reported to the agency in early May.

CISA declined to comment. The FBI did not immediately respond to a request for comment.