Chinese cybercriminal groups attack commercial telecoms infrastructure

In late October, the FBI and CISA reported that the Chinese APT group Salt Typhoon (also known as Earth Estries, FamousSparrow, Ghost Emperor and UNC2286) was behind attacks on several internet providers such as AT&T, Verizon and Lumen Technologies. However, the investigation continued and in a second joint statement, they confirmed that these actions are part of a cyber espionage campaign targeting the telecommunications sector.

While the investigation is ongoing and further victims are not ruled out, it is understood that the cybercriminals had access to these companies for months, which has allowed them to obtain a vast amount of information on users and companies (both large and small), including call records and information subject to court orders by US law enforcement agencies. Private conversations of a small group of individuals belonging to the government or political organisations were also compromised.