Chinese group accused of hacking Singtel in telecom attacks

The U.S. telecommunications attacks, which investigators have attributed to another Chinese group called Salt Typhoon, breached AT&T Inc. and Verizon Communications Inc., among others, and the hackers may have accessed systems the federal government uses for court-authorized network eavesdropping requests Wall Street Journal reported in early October. US intelligence officials believe that the Chinese hacking group, Microsoft Corp. Salt Typhoon has been operating in U.S. telecommunications companies for months and may have found a way into an access point for legally authorized wiretapping, according to a person familiar with its views.

AT&T declined to comment. Verizon did not respond to a request for comment.

Through these intrusions, the hackers are believed to have targeted the phones of former President Donald Trump, his Vice President JD Vance and Trump family members, as well as members of Vice President Kamala Harris' campaign team and others, The New York Times reported.

In the case of the alleged Singtel breach, one of the people familiar with the incident said the attack relied on a tool called Web Shell.

In August, researchers at Lumen Technologies Inc. said in a blog post that they had “moderate confidence” that Volt Typhoon used such a web shell. According to Lumen researchers, a sample of the malware was first uploaded to VirusTotal, a popular website for security experts to research malicious code, on June 7 by an unknown company in Singapore. The web shell allowed hackers to intercept and collect credentials to gain access to a customer's network disguised as a real user, they said.

According to Lumen researchers, the hackers then attacked four U.S. companies, including internet service providers, and another in India.

Gen. Timothy Haugh, director of the National Security Agency, said in early October that the investigation into the latest telecommunications breaches was in its early stages. Later that month, the FBI and the Cybersecurity and Infrastructure Security Agency said they had identified specific malicious activities by actors linked to the Chinese government, immediately notified affected companies and “provided technical assistance.”

A National Security Council spokesman last week noted the “ongoing investigative and containment efforts” but directed further questions to the FBI and CISA.

According to another person familiar with the investigation, Singtel uncovered the breach of its network after detecting suspicious traffic on a central back-end router and what it believed to be sophisticated and possibly state-sponsored malware. The malware was in “eavesdropping mode” and did not appear to have been activated for espionage or other purposes, the person said, adding that this reinforced suspicions that the attack was either a test run of a new hacking capability or that its aim was to create a strategic access point for future attacks.

There is evidence that Salt Typhoon reached the US at least as early as spring 2024 and possibly well before that, and investigators tracking the group believe it has infiltrated other telecommunications companies across Asia, including in Indonesia, Nepal , the Philippines, Thailand and Vietnam. According to two people familiar with the effort.

The NSA has been warning since 2022 that telecommunications infrastructure is vulnerable to Chinese hacker attacks. Active since at least mid-2020, Volt Typhoon has attacked sensitive networks in Guam and elsewhere in the U.S., aiming to penetrate critical infrastructure and remain undetected for as long as possible.

The hacks by both Chinese Typhoon groups have alarmed Western officials and raised concerns about the number and severity of backdoors – a way to bypass security tools and gain high-level access to a computer system – that China has built into critical IT systems. These entry points could be used for espionage purposes or to prepare the battlefield for a possible military conflict with the West.

Chinese hackers have long been accused of carrying out espionage attacks against the United States – most notably stealing security clearance applications for tens of millions of U.S. government employees held by the Office of Personnel Management. But officials say the recent hacks go a step further and, in some cases, suggest China may be amassing capabilities to disrupt or impair critical services in the U.S. and abroad.

Paul Nakasone, a retired general who led the NSA for nearly six years until February, told reporters in October that the recent Salt Typhoon telecommunications hacks were notable for their scale and that the two Chinese groups posed a huge challenge to the government . “I am not satisfied with the status of the two typhoons,” he said.

– With assistance from Kelcee Griffis and Gao Yuan.

Most read by Bloomberg Businessweek

©2024 Bloomberg LP