U.S. government says Salt Typhoon is still in telecom networks

The United States and other Western nations released guidance Tuesday designed to evict the China-linked group in the wake of the high-profile hack.

Telecommunications providers are still trying to evict the Chinese government-linked hackers behind a monumental and sweeping breach that the government began investigating this spring, U.S. administration officials said Tuesday, while also providing guidance they believe can attempt to kick the attackers off the network for good. 

Government agencies are also still grappling with the attack’s full scope, the officials told reporters. The hackers, a group known as Salt Typhoon, targeted officials from both presidential campaigns, including the phone of President-elect Donald Trump.

“I think it would be impossible for us to predict a time frame on when we’ll have full eviction,” said Jeff Greene, executive assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency. “Right now, the hardening guidance that we put out specifically would make the activities that we’ve seen across the victims much harder to continue. In some cases, it might result in limiting their access.”

What’s made it harder to ensure that eviction is that there’s no single way that hackers have infiltrated the telecommunications carriers, the officials said. Those that the government notified earliest are most aware of those specifics.

“Each victim is unique. These are not cookie-cutter compromises in terms of how deeply compromised the victim might be or what the actor has been able to do,” Greene said. “So it really is case-specific in terms of how to mitigate the specific activity.”

In response to the global hacking campaign tied to the People’s Republic of China, a host of agencies released communication infrastructure-focused guidance. The agencies responsible were CISA, the National Security Agency, the Federal Bureau of Investigation, the Australian Signals Directorate’s Australian Cyber Security Centre, the Canadian Cyber Security Centre and New Zealand’s National Cyber Security Centre.

An FBI official said that media reports have been incorrect in stating that the system under which the telecommunications companies comply with government surveillance requests — the Communications Assistance to Law Enforcement Act (CALEA) — was the primary focus of the Salt Typhoon campaign. It was “only one of several targets for these actors’ collection once they got into the networks,” the official said.

“It’s really important to emphasize that our focus right now is to illuminate what the PRC did and where they had access so we can successfully remove them from across the sector,” the official said. “We continue to closely work with the companies to hunt for the activity.”

While the officials wouldn’t say how many victims it had notified or identified, “the facts and scope are expected to continuously evolve.”

The government still needs to work with the telecommunications providers on whether, in the long term, they will need to replace equipment, Greene said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure