Salt Typhoon: What Happened and What It Means Chinese state hackers (Salt Typhoon/MSS) spent up to 18 months…
Lara B. — Building Cyberr
Salt Typhoon: What Happened and What It Means
Chinese state hackers (Salt Typhoon/MSS) spent up to 18 months inside nine major US telecoms. Six were breached through a single shared IT contractor. Three through unpatched Cisco and Fortinet systems - patches had been available for up to six months.
They didn't steal customer data. They accessed CALEA: the wiretapping infrastructure US carriers maintain for government surveillance - and queried it against approximately 1,500 government, defense, and policy targets. They also mapped the architecture of the intercept systems themselves.
Eviction took nine months and required physical hardware replacement at multiple sites.
The consequences:
China can now disrupt America's ability to wiretap its own targets - without needing to hack anything again
The US government knows this happened but is doing nothing about it publicly, to avoid upsetting a diplomatic summit in September
American telecoms are now building their own security coalition because they can't rely on the government to protect them
China has made it legally and politically expensive for the US to ever sanction them for this
The damage isn't just what was stolen - it's what was learned about how the system works
3 reactions · 1 comments
Comments
Ryan R.: Hilarious. Everyone is so focused on checking whatever CMMC or checkbox for whatever assessment. We're spending ourselves in circles to get nowhere because we keep filling all the roles with people who fundamentally aren't hackers themselves or have at least done enough time in the trenches or have enough passion to know the difference.