Salt Typhoon Cyberattack Prompts Action from FCC, CISA, FBI, and More

On December 4, the U.S. government disclosed that a large number of Americans’ metadata was stolen in a cyberespionage campaign run by Chinese hacking group “Salt Typhoon.” The attack hit at least eight telecommunications/telecommunications infrastructure firms in the U.S.. The call record metadata Salt Typhoon was able to access included information such as who individuals called, how long the calls were, and where the callers called from. The group is alleged to have been searching for corporate intellectual property and targeting high-ranking government officials such as Kamala Harris and Donald Trump. Investigators are still assessing the full scope of the attack.

Following the announcement of the breach, various agencies have taken steps to help combat telecommunications vulnerabilities. The FCC proposed a Declaratory Ruling confirming that telecommunications carriers are legally obligated to take steps to secure their networks against hackers under the Communications Assistance for Law Enforcement Act. If adopted, the Declaratory Ruling would take effect immediately. The FCC also published a Notice of Proposed Rulemaking that would require telecommunications providers to make an annual attestation certifying that they have a cybersecurity risk management plan in place and are complying with such plan.

Interagency guidance co-signed by CISA, the FBI, the NSA, and government partners from Australia, Canada, and New Zealand offers network defenders of communications infrastructure a list of  best practices “to strengthen their visibility and harden their network devices against successful exploitation.” This guidance focuses on increasing visibility, hardening systems and devices through access controls and disabling VPNs, and recognizing and addressing vulnerabilities specific to frequently targeted vendors. 

Most recently, CISA recommended that senior government officials should adhere to a series of best practices when using mobile devices, including immediately switching to end-to-end encrypted messaging and communications. 

Authored by Nathan Salminen, Emma Kotfica