AT&T and Verizon have confirmed their networks were compromised in a widespread Chinese espionage campaign targeting telecommunications carriers globally. Both companies have successfully removed the threat actors from their systems and implemented containment measures.

AT&T reported identifying a limited number of cases where attackers attempted to gather foreign intelligence information, affecting some customer data. Verizon’s Chief Legal Officer stated they have successfully contained the incident and detected no recent threat activity.

T-Mobile also disclosed a breach by the “Salt Typhoon” hackers in November, but their cyber defenses prevented access to sensitive customer data and lateral movement through their network.

According to White House deputy national security adviser Anne Neuberger, the Chinese hacking campaign impacted nine US telecommunications companies and carriers in numerous other countries.

In response to these security breaches:
– The US government is considering banning China Telecom’s remaining US operations
– Potential restrictions on TP-Link routers are under review
– The FCC is working to strengthen carrier infrastructure security requirements
– Senator Ron Wyden has proposed new legislation to secure US telecommunications networks

The Salt Typhoon group, active since 2019 and known by various names (Earth Estries, FamousSparrow, Ghost Emperor, UNC2286), has a history of targeting telecom companies and government entities, particularly in Southeast Asia.