FBI and CISA Report Chinese Hackers Compromised Several U.S. Telecom Providers

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have announced that Chinese hackers have compromised several American telecommunications service providers. The affected companies, which have not been named, have already been notified of the breaches. Authorities are now actively warning other potential targets about increased cyber activity.

“The U.S. government is investigating unauthorized access to commercial telecommunications infrastructure by entities linked to the People’s Republic of China,” the official statement reads. “After the FBI identified certain malicious activity targeting this sector, the FBI and CISA immediately notified the affected companies, provided them with technical assistance, and quickly shared information to help other potential victims.”

Since the investigation is still ongoing, there is currently little official information available about the incident.

Background and Possible Motives

Earlier in October, The Wall Street Journal reported, citing its own sources, that the Chinese hacking group Salt Typhoon (also known as Earth Estries by Trend Micro, FamousSparrow by ESET, Ghost Emperor by Kaspersky Lab, and UNC2286 by Mandiant) had breached several American providers, including major companies like Verizon, AT&T, and Lumen Technologies.

The exact timing of the attack remains unknown. However, it is believed that the hackers’ goal was espionage and intelligence gathering, as the attackers allegedly had access for “several months” to U.S. federal government systems used for court-authorized wiretapping.

According to the report, the attack was discovered by the U.S. government and private sector cybersecurity experts. Specialists are currently assessing the potential consequences of the incident, as well as the scope and type of data that may have been accessed or stolen by the hackers.

“It appears the hackers were collecting vast amounts of traffic from internet providers whose clients include large and small businesses, as well as millions of Americans,” The Wall Street Journal reported at the time.

So far, there is no official confirmation that the CISA and FBI statement is directly related to the attack described by The Wall Street Journal.