Beijing-backed hackers breach ‘major telecommunications companies,’ authorities warn

Cyber hackers backed by China are successfully targeting U.S. telecommunication companies in major breaches, the federal Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday.

The FBI, National Security Agency (NSA) and CISA said in an advisory that hackers affiliated with the People’s Republic of China (PRC) have targeted and compromised major telecommunication companies through easy and known network and system vulnerabilities.

The PRC has waged a successful cyber campaign against telecommunication networks since at least 2020, the federal agencies announced in a Tuesday press release.

“Exploiting these vulnerabilities has allowed them to establish broad infrastructure networks to exploit a wide range of public and private sector targets,” the release reads.

Along with Russia, China is one of the most lethal and dangerous actors in the cyberspace. In a CrowdStrike report released last year, researchers said a threat group likely linked to China known as “LightBasin” has targeted global telecommunication companies since at least 2016.

CrowdStrike explained in the past two years alone, at least 13 telecommunications groups were successfully compromised in breaches likely sponsored by China.

Last August, hackers successfully breached telecom giant T-Mobile, stealing data from 40 million customers, the company said. Syniverse, a company used by major global telecommunication companies to route messages, also said last year that hackers had quietly exploited its network system for years.

The state-sponsored Chinese hackers appear to be exploiting open-source tools, such as open router softwares and devices manufactured by companies such as Cisco, Fortinet, and MikroTik, according to the advisory. Once those are exploited, cyberhackers gain a foothold, can scan IP addresses and further exploit systems for data or breaches.

Rob Joyce, the cybersecurity director at NSA, said hackers were using telecommunication networks to scale up more sophisticated attacks in the cyber realm.

“To kick them out, we must understand the tradecraft and detect them beyond just initial access,” Joyce tweeted on Tuesday.

In the advisory, the federal agencies recommended several mitigation strategies to combat the cyber intrusions, including patching up systems as soon as possible, disabling unnecessary ports and protocols and replacing outdated infrastructure.

For the latest news, weather, sports, and streaming video, head to The Hill.