Fact Checked by 
China-linked spies continue to infiltrate U.S. telecommunications networks, with their presence still detected nearly six months after American officials launched an investigation into the breaches, senior officials reported on Tuesday (Dec. 3).
The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and international partners have now released a joint guide detailing best practices to defend against an alleged threat actor affiliated with the People’s Republic of China (PRC) that has infiltrated the networks of major global telecommunications providers.
This marks the first official confirmation from U.S. authorities that Salt Typhoon hackers continue to maintain access to critical infrastructure, posing significant challenges in efforts to remove them. In November, CISA and the FBI issued a warning about these threat actors.
CISA Executive Assistant Director for Cybersecurity Jeff Greene said in a joint statement: “The PRC-affiliated cyber activity poses a serious threat to critical infrastructure, government agencies, and businesses.”
He encouraged software manufacturers to integrate the principles outlined in the guide, Enhanced Visibility and Hardening Guidance for Communications Infrastructure, into their development processes to enhance the security of their customers’ systems.
FBI’s Cyber Division Assistant Director, Bryan Vorndran, reiterated the comments, adding: “We strongly encourage organizations to review and implement the recommended measures in this guide and to report suspicious activity to their local FBI field office.”
The guide outlines fundamental steps such as maintaining activity logs on the network, keeping an inventory of all devices within the telecom environment, and updating any default equipment passwords. For now, officials recommend that government employees use encrypted services for phone calls and text messages.
Salt Typhoon hack
An official noted that most individuals affected by this extensive surveillance are believed to be located in the D.C. metro area. Politico previously reported that up to 80 telecommunications and internet service providers might have been impacted by the widespread hack. Some of these reportedly include AT&T, Verizon, and Lumen, among others, while T-Mobile said it was targeted but largely repelled the attackers.
In a limited number of targeted cases, Salt Typhoon specifically sought to intercept text messages and eavesdrop on phone calls from certain individuals. FBI and CISA officials acknowledge they do not yet have a timeline for when U.S. telecom providers will completely remove Salt Typhoon from their networks.
In February, ReadWrite reported CISA revealed that China-backed hackers had been infiltrating major U.S. critical infrastructure sectors for “at least five years.” Volt Typhoon had systematically targeted and gained prolonged access to networks within critical sectors, including water, transportation, energy, and communications.
Featured image: Ideogram
