The FBI is seeking information from the public about the Chinese Salt Typhoon hacking campaign that, last year, was found to have breached major telecommunications providers and their wiretap request systems over a two-year period. In a bureau notice issued Thursday, the law enforcement agency said the Salt Typhoon hacks “resulted in the theft of call data logs, a limited number of private communications involving identified victims, and the copying of select information subject to court-ordered US law enforcement requests.” The statement affirmed reports about the cyberspies that have trickled out over the last several months after The Wall Street Journal brought the group to light this past fall. “FBI maintains its commitment to protecting the US telecommunications sector and the individuals and organizations targeted by Salt Typhoon by identifying, mitigating, and disrupting Salt Typhoon's malicious cyber activity,” it said.
“If you have any information about the individuals who comprise Salt Typhoon or other Salt Typhoon activity, we would particularly like to hear from you.” Salt Typhoon accessed at least nine U.S. telecom providers and dozens of others around the world. The cyberspies compromised Cisco platforms at a U.S.-based affiliate of a prominent United Kingdom telecom operator and a South African provider, according to February research disclosed by a private sector threat intelligence firm. In December, Nextgov/FCW reported that several hundred organizations — both communications firms and entities in other sectors — were notified that they may be at risk of compromise by the hacking collective.
Salt Typhoon breached several U.S. telecom firms’ “lawful intercept” systems that house wiretap requests used by law enforcement to surveil suspected criminals and spies. Telecom providers are required to engineer their networks for these legal access requests under the 1994 Communications Assistance for Law Enforcement Act. The hackers accessed the personal communications of President Donald Trump and Vice President JD Vance, as well as other high profile officials tied to the White House.
An investigatory body in the Department of Homeland Security was probing the hacks, but the Trump administration cleared it out soon after Inauguration Day. In January, the Treasury Department sanctioned Chinese firm Sichuan Juxinhe Network Technology Co., accusing the company of having “direct involvement” with China’s Ministry of State Security in the Salt Typhoon infiltrations. Trump-appointed officials and allies have vowed to exact revenge on China for the hacks, calling for a more offensive deterrent approach in cyberspace, though a specific plan has not yet been publicly put into motion.
China’s embassy in Washington, D.C., has repeatedly denied Beijing’s involvement in cyberattacks against U.S. systems, and has often flipped the blame back onto the U.S. for hacks into China-based networks. But Chinese officials tacitly admitted to involvement in hacks targeting troves of U.S. critical infrastructure during a secret meeting held in December, the WSJ reported earlier this month.
