FBI asks public for tips about Salt Typhoon telecom hacks

MalBot · April 24, 2025, 8:25pm

The FBI is seeking information from the public about the Chinese Salt Typhoon hacking campaign that, last year, was found to have breached major telecommunications providers and their wiretap request systems over a two-year period.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

In a bureau <a href=“Internet Crime Complaint Center (IC3) | FBI Seeking Tips about PRC-Targeting of US Telecommunications”>notice</a> issued Thursday, the law enforcement agency said the Salt Typhoon hacks “resulted in the theft of call data logs, a limited number of private communications involving identified victims, and the copying of select information subject to court-ordered US law enforcement requests.” The statement affirmed reports about the cyberspies that have trickled out over the last several months after The Wall Street Journal <a href=“https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835”>brought the group to light</a> this past fall.

“FBI maintains its commitment to protecting the US telecommunications sector and the individuals and organizations targeted by Salt Typhoon by identifying, mitigating, and disrupting Salt Typhoon's malicious cyber activity,” it said. “If you have any information about the individuals who comprise Salt Typhoon or other Salt Typhoon activity, we would particularly like to hear from you.”

Salt Typhoon accessed at least nine U.S. telecom providers and dozens of others around the world. The cyberspies compromised Cisco platforms at a U.S.-based affiliate of a prominent United Kingdom telecom operator and a South African provider, according to <a href=“Salt Typhoon hackers possibly targeted telecom research at US universities - Nextgov/FCW”>February research</a> disclosed by a private sector threat intelligence firm.

In December, Nextgov/FCW reported that <a href=“Hundreds of organizations were notified of potential Salt Typhoon compromise - Nextgov/FCW”>several hundred organizations</a> — both communications firms and entities in other sectors — were notified that they may be at risk of compromise by the hacking collective.

Salt Typhoon breached several U.S. telecom firms’ “lawful intercept” systems that house <a href=“It’s time to rethink how wiretaps work after Chinese hack, experts say - Nextgov/FCW”>wiretap requests</a> used by law enforcement to surveil suspected criminals and spies. Telecom providers are required to engineer their networks for these legal access requests under the 1994 Communications Assistance for Law Enforcement Act.

The hackers accessed the personal communications of President Donald Trump and Vice President JD Vance, as well as other high profile officials tied to the White House. An investigatory body in the Department of Homeland Security was probing the hacks, but the Trump administration cleared it out soon after Inauguration Day.

In January, the Treasury Department <a href=“US sanctions Chinese firm behind sweeping Salt Typhoon telecom hacks - Nextgov/FCW”>sanctioned</a> Chinese firm Sichuan Juxinhe Network Technology Co., accusing the company of having “direct involvement” with China’s Ministry of State Security in the Salt Typhoon infiltrations.

Trump-appointed officials and allies have vowed to exact revenge on China for the hacks, calling for a more offensive deterrent approach in cyberspace, though a specific plan has not yet been publicly put into motion.

China’s embassy in Washington, D.C., has repeatedly denied Beijing’s involvement in cyberattacks against U.S. systems, and has often flipped the blame back onto the U.S. for hacks into China-based networks. But Chinese officials <a href=“https://www.wsj.com/politics/national-security/in-secret-meeting-china-acknowledged-role-in-u-s-infrastructure-hacks-c5ab37cb”>tacitly admitted</a> to involvement in hacks targeting troves of U.S. critical infrastructure during a secret meeting held in December, the WSJ reported earlier this month.

Article Link: FBI asks public for tips about Salt Typhoon telecom hacks - Nextgov/FCW