The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have disclosed that hackers tied to the Chinese government, Salt Typhoon, accessed the private communications of select U.S. government officials by infiltrating several major telecommunications providers. The breach also reportedly allowed attackers to collect data on customer call records and details related to law enforcement requests.
The joint statement, released by CISA and the FBI, confirms the breach at multiple broadband providers, including major names like AT&T, Verizon, and Lumen Technologies.
Salt Typhoon — also known as Earth Estries, FamousSparrow, GhostEmperor, and UNC2286 — focuses on targeting government entities and telecommunication companies in Southeast Asia.
It is estimated that the hackers may have maintained network access for months, allowing them to collect extensive internet traffic. This prolonged access would have potentially provided hackers with sensitive data from big and small businesses that could affect millions of Americans.
The agencies’ statement confirmed that the attackers exploited the networks to steal customer call records and obtain information related to law enforcement requests, which require court approval in the United States. Notably, the breach extended to the private communications of individuals engaged in political or government activities, adding a troubling security angle to the attack.
“Specifically, we have identified that PRC-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data, the compromise of private communications of a limited number of individuals who are primarily involved in government or political activity, and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders,” said the joint statement.
Last week, it was reported that Earth Estries was conducting a sophisticated campaign to target exchange servers and network tools.
Another Chinese hacker group, Volt Typhoon, hacked Singapore’s largest mobile carrier, Singapore Telecommunications Ltd. This breach was discovered in June and is part of a broader campaign by the threat actor against telecommunications and critical infrastructure.
In the News: The Guardian leaves X, citing racism and far-right content
