(Credit: Anton Petrus via Getty Images)
Don't miss out on our latest stories. Add PCMag as a preferred source on Google.
The US and its allies have launched a major push to remove the "Salt Typhoon" Chinese state-sponsored hacking group from their countries’ telecommunication networks.
On Wednesday, the FBI, National Security Agency, and partner agencies in Canada, Europe, and Japan published a joint 37-page alert designed to help companies and organizations protect their IT systems from the hacking group.
The report says Salt Typhoon has been active in the “United States, Australia, Canada, New Zealand, the United Kingdom, and other areas globally." Investigators discovered the group infiltrating at least nine US telecom firms in December.
On Wednesday, FBI Assistant Director Brett Leatherman also told The Wall Street Journal that Salt Typhoon targeted more than 80 countries for spying purposes. The agency even notified "roughly 600 companies that the espionage activity indicated some interest in them."
The hacking has been particularly unsettling because the group may have been infiltrating some US networks for years, enabling them to steal call data from millions of people.
“Active since at least 2019, these actors conducted a significant cyber-espionage campaign, breaching global telecommunications’ privacy and security norms,” Leatherman added in a video.
The spying only became widely known last fall when federal investigators discovered the Chinese hackers trying to spy on high-profile politicians, including Donald Trump. The US also struggled to quickly boot Salt Typhoon from affected networks, which originally included AT&T and Verizon.
In response, the US today published the alert to “offer practical steps to improve visibility and detect malicious activity early,” involving Salt Typhoon, Leatherman said in the video. “Beijing’s indiscriminate targeting of private communications demands our stronger collaboration with our partners to identify and counter this activity at the earliest stages."
Importantly, the alert notes that Salt Typhoon accesses telecom networks through existing software flaws in networking products, rather than publicly unknown ones. “Exploitation of zero-day vulnerabilities has not been observed to date,” the report says. “The APT [advanced persistent threat] actors will likely continue to adapt their tactics as new vulnerabilities are discovered and as targets implement mitigations, and will likely expand their use of existing vulnerabilities."
Salt Typhoon also focuses on targeting vulnerable “backbone” and other “edge” routers at telecommunication providers. The report warns, “These actors often modify routers to maintain persistent, long-term access to networks.”