Chinese hackers breach telcos in espionage campaign

The FBI has confirmed that Chinese state-sponsored hackers infiltrated multiple telcos in an espionage campaign to steal data on politicians. This revelation follows reports that a Chinese hacking group known as Salt Typhoon may have targeted the phones of incoming US President Donald Trump and Vice President JD Vance.

In a joint statement, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) described the Chinese hacking activities as “a broad and significant cyber espionage campaign.” 

Outlining the scope of the attack, the agencies wrote: “Specifically, we have identified that PRC-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data, the compromise of private communications of a limited number of individuals who are primarily involved in government or political activity, and the copying of certain information that was subject to US law enforcement requests pursuant to court orders.”

The agencies’ statement highlights the chilling implication that Chinese hackers attempted to access the very infrastructure used by ISPs like AT&T and Verizon to respond to court-authorised wiretap requests. This suggests a potentially alarming scenario where China gained a foothold within the US’ own surveillance network, capable of intercepting communications.

Adding further fuel to these concerns, The Wall Street Journal reported last week that Chinese hackers successfully compromised phone lines belonging to several high-ranking national security and policy officials in an espionage campaign.

“The hackers appeared to have had the ability to access the phone data of virtually any American who is a customer of a compromised carrier,” the Journal stated, although it clarified that only a few dozen political and national security figures were ultimately targeted.

Donny Chong, Director at Nexusguard, views this attack as a turning point: “Yesterday evening, CISA and the FBI confirmed that the Salt Typhoon attack, launched in October, breached US telecom providers, allowing hackers to access private communications of a ‘limited number’ of federal government officials. 

“This is yet another example of how communication service providers are becoming a goldmine for nation-state hackers. Telecom providers have become gateways through which foreign adversaries can reach government officials and sensitive data.”

Chong stresses the need for a multi-faceted response: “The role of telecom providers is transforming. Once viewed primarily as connectivity providers, they now stand on the frontlines of cyber warfare and espionage. Securing these networks shouldn’t fall solely on the private sector. Government support is essential, with regulations and security standards to help protect this critical infrastructure.

“The telecom sector needs increased regulation that sets cybersecurity standards in line with this rising threat. Funding should be extended to telecom providers that are looking to bolster cybersecurity measures in the form of tax incentives for security investments or cybersecurity skill development. These measures can help set stronger foundations for cyber resilience moving forward.”

(Photo by FlyD)

See also: Cyber threats surge from state-sponsored and criminal actors

Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including BlockX, Digital Transformation Week, IoT Tech Expo, and AI & Big Data Expo.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.

Tags: connectivity, cyber security, cybersecurity, hackers, hacking, infosec, mobile, Networks, salt typhoon, Security, telecoms