Global Alert Issued Over Chinese Cyber Attacks on Telecommunications Infrastructure

A newly released joint advisory has raised alarms about cyber attacks attributed to Chinese groups targeting global telecommunications infrastructure. These state-sponsored actors, identified by names such as Salt Typhoon and GhostEmperor, are known for exploiting well-documented but unpatched vulnerabilities.

In recent years, numerous incidents have come to light involving suspected Chinese hackers infiltrating international network systems, leading to unauthorized access and data breaches in critical telecommunications. In response, a coalition of security agencies from countries including Australia, Canada, New Zealand, the UK, the Czech Republic, Finland, Germany, Italy, Japan, the Netherlands, Poland, and the USA has collaborated to produce a comprehensive cybersecurity guideline.

This advisory outlines the methods employed by these cybercriminals, offers tips for identifying potential attacks, and recommends countermeasures. A significant number of these incursions have been linked to the exploitation of known security flaws that remain unresolved by the affected service providers. A recent case involved a North American telecom provider that fell victim to an attack via an unpatched Cisco vulnerability, demonstrating the ongoing risk posed by delayed software updates.

Among the notable cyber groups highlighted in the advisory are Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor. These Advanced Persistent Threat (APT) actors have been detected in various countries, including the USA, Australia, Canada, New Zealand, and the UK, and are believed to operate globally. Their tactics often include manipulating routers to establish persistent access to targeted networks.

Specifically, the German Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI) have flagged Salt Typhoon as a primary threat actor. This group is also known by other aliases, indicating the diverse nomenclature used internationally to describe these cyber gangs. The primary focus of these attackers is the telecommunications infrastructure, which, once compromised, allows associated Chinese intelligence services to monitor communications and track the locations of specific individuals.

Experts from Google's Threat Intelligence Group have acknowledged the sophisticated understanding these attackers possess regarding telecommunications systems, facilitating undetected breaches post-infiltration. The organized nature of these cyber gangs is noteworthy, with a network of contractors, academics, and other support personnel central to their operations. This collaborative framework is essential for the rapid evolution and expansion of their cyber operations.

In addition to telecommunications, these actors are also targeting sectors such as hospitality and transportation, which could enable them to closely surveil individuals. Information gathered from these industries could provide a comprehensive profile of an individual's communications, whereabouts, and travel patterns.