<\/div>\n

China-linked APT group Salt Typhoon breached U.S. broadband providers, potentially accessing systems for lawful wiretapping and other data.<\/h2>\n\n\n\n

China-linked APT group Salt Typhoon<\/a> (also known as\u00a0FamousSparrow<\/a>\u00a0and\u00a0GhostEmperor<\/a>) breached U.S. broadband providers, including Verizon, AT&T, and Lumen Technologies, potentially accessing systems for lawful wiretapping and other data.<\/p>\n\n\n\n

According to the Wall Street Journal, which reported the news exclusively, the security breach poses a major national security risk. The WSJ states that the compromise remained undisclosed due to possible impact on national security. Experts believe that threat actors are aimed at gathering intelligence.<\/p>\n\n\n\n

“A cyberattack tied to the Chinese government penetrated the networks of a swath of U.S. broadband providers, potentially accessing information from systems the federal government uses for court-authorized network wiretapping requests.” reported the WSJ<\/a>.<\/em><\/p>\n\n\n\n

“For months or longer, the hackers might have held access to network infrastructure used to cooperate with lawful U.S. requests for communications data, according to people familiar with the matter, which amounts to a major national security risk.”<\/em><\/p>\n\n\n\n

The Salt Typhoon<\/a> group targeted surveillance systems used by the US government to investigate crimes and threats to national security, including activities carried out by nation-state actors.<\/p>\n\n\n\n

The investigation into the breaches of the U.S. broadband providers is still ongoing, government experts are assessing its scope. <\/p>\n\n\n\n

Experts suspect the state-sponsored hackers have gathered extensive internet traffic and potentially compromised sensitive data. <\/p>\n\n\n\n

This attack is the latest incident linked to China\u2019s expansive espionage strategies.<\/p>\n\n\n\n

U.S. officials are increasingly concerned about Chinese cyber efforts to infiltrate critical infrastructure. Intelligence experts believe that security breaches like this could enable disruptive attacks during potential future conflicts.<\/p>\n\n\n\n

The Salt Typhoon campaign is part of this broader strategy. Experts are still investigating the origins of the attack and whether threat actors compromised Cisco routers. <\/p>\n\n\n\n

This week Wall Street Journal first\u00a0reported<\/a>\u00a0that experts are investigating the security breaches to determine if the attackers gained access to\u00a0Cisco Systems\u00a0routers, which are core network components of the ISP infrastructures.<\/p>\n\n\n\n

A Cisco spokeswoman confirmed the investigation and said that \u201cat this time, there is no indication that Cisco routers are involved\u201d in the Salt Typhoon activity, the spokeswoman said.<\/p>\n\n\n\n

\u201cHackers linked to the Chinese government have broken into a handful of U.S. internet-service providers in recent months in pursuit of sensitive information, according to people familiar with the matter.\u201d Wall Street Journal reported<\/a>.<\/em><\/p>\n\n\n\n

\u201cThe hacking campaign, called Salt Typhoon by investigators, hasn\u2019t previously been publicly disclosed and is the latest in a series of incursions that U.S. investigators have linked to China in recent years. The intrusion is a sign of the stealthy success Beijing\u2019s massive digital army of cyberspies<\/a> has had breaking into valuable computer networks in the U.S. and around the globe.\u201d<\/em><\/p>\n\n\n\n

China has long targeted global internet service providers and recent attacks are aligned with past operations linked to Beijing.<\/p>\n\n\n\n

Intelligence and cybersecurity experts warn that Chinese nation-state actors have shifted from stealing secrets to infiltrate critical U.S. infrastructure, suggesting that they are now targeting the core of America\u2019s digital networks.<\/p>\n\n\n\n

The Salt Typhoon hacking campaign, linked to China, appears focused on intelligence gathering rather than crippling infrastructure, unlike the attacks carried out by another China-linked APT group called\u00a0Volt Typhoon<\/a>. Chris Krebs from SentinelOne suggested that the group behind Salt Typhoon may be affiliated with China\u2019s Ministry of State Security, specifically the\u00a0APT40<\/a>\u00a0group, which specializes in intelligence collection. This group was publicly called out by the U.S. and its allies for hacking activities in July.<\/p>\n\n\n\n

Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking,\u00a0Salt Typhoon)<\/strong><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

<\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

China-linked APT group Salt Typhoon breached U.S. broadband providers, potentially accessing systems for lawful wiretapping and other data. China-linked APT group Salt Typhoon (also known as\u00a0FamousSparrow\u00a0and\u00a0GhostEmperor) breached U.S. broadband providers, including Verizon, AT&T, and Lumen Technologies, potentially accessing systems for lawful wiretapping and other data. According to the Wall Street Journal, which reported the news […]<\/p>\n","protected":false},"author":1,"featured_media":26533,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6054,3323,5,6],"tags":[374,41,182,9508,9506,4113,10918,15416,841,1533],"class_list":["post-169460","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apt","category-breaking-news","category-hacking","category-intelligence","tag-apt","tag-china","tag-data-breach","tag-hacking-news","tag-information-security-news","tag-intelligence","tag-it-information-security","tag-salt-typhoon","tag-security-affairs","tag-security-news"],"yoast_head":"\n