T-Mobile confirmed being a victim of recent hacking campaigns linked to China-based threat actors targeting telecom companies.
The breach is part of a long-running cyber espionage campaign that targeted U.S. telecoms to steal call records and access private communications mainly of government and political figures.
Salt Typhoon, also known as FamousSparrow and GhostEmperor, is a China-linked APT group active since at least 2019 that focused on government entities and telecommunications companies in Southeast Asia.
The cyberattack poses a major national security risk and implicates China's digital army of Cyberspies breaking into valuable computer networks in the United States and around the globe.
The cybersecurity experts warn that Chinese nation-state actors have shifted from stealing secrets to infiltrate critical US infrastructure, suggesting that they are now targeting the core of America’s digital networks.
The Salt Typhoon hacking campaign appears to focus on intelligence gathering rather than crippling infrastructure, unlike the attacks carried out by another China-linked APT group called Volt Typhoon.
Salt Typhoon used sophisticated methods to infiltrate American telecom infrastructure through vulnerabilities, including Cisco Systems routers, and investigators suspect the hackers relied on AI or machine learning to further their espionage operations.
The cyberattack raises concern as T-Mobile has suffered multiple data breaches in recent years, with the most recent breach in August 2021 impacting 54 million customers.
T-Mobile assures its customers that it closely monitors the industry-wide attack: no impact to customer information has been identified, and the authorities are working with relevant peers.
The FBI and CISA are continuing the investigation, and they expect their understanding of these compromises to grow as the investigation continues.