China’s ‘Salt Typhoon’ Cooks Up Cyberattacks on US ISPs
A freshly discovered advanced persistent threat (APT) dubbed “Salt Typhoon” has reportedly infiltrated Internet service provider (ISP) networks in the US, looking to steal information and potentially set up a launchpad for disruptive attacks.
Citing “people familiar with the matter,” the Wall Street Journal broke the news on Sept. 25 that the Chinese-sponsored state hackers have successfully targeted “a handful” of cable and broadband service providers during the campaign.
Other details are scant, but Salt Typhoon’s efforts highlight China’s priorities when it comes to geopolitical realities, researchers note.
A Sprinkle of Espionage, A Dash of Pre-Positioning
For instance, a position within the service provider network would offer valuable reconnaissance for how to further target high-value marks working for the federal government, law enforcement, manufacturers, military contractors, and Fortune 100 companies.
“Obtaining access to ISPs would make it easier to survey those users of the ISPs for information on their location and what kinds of services are being accessed,” says Sean McNee, vice president of research and data at DomainTools. “Bad actors could get information about the ISP’s users, where they live and billing information, and what kind of access or usage they have, [who they call, and] text messages.”
But the concern doesn’t stop there. Given China’s desire to control Taiwan and other assets in the region, there’s very likely a military component to the campaign as well.
“Based on the recent history of Chinese-sponsored cyber campaigns and warnings from [the Cybersecurity and Infrastructure Security Agency] and FBI, China has escalated from surveillance-only goals toward installing an offensive capability to disrupt critical US civilian and military infrastructure,” warns Sean Deuby, principal technologist at Semperis. “This could potentially range from ‘blinking the lights’ to dissuade US intervention to actively delaying or crippling a US response to Chinese activities.”
There’s precedent for that assessment. Microsoft outed Volt Typhoon in January and its alarming efforts to plant itself inside military bases, critical infrastructure assets, and telecom infrastructure — all with the goal of being able to cause outages, disrupt communications, and sow panic in the event of a kinetic conflict with the US in the South China Sea. Since then, China has denied the allegations, while the APT has been actively expanding its efforts despite its cover being blown.
China’s Recipe: Targeting Telecom, ISPs, Critical Infrastructure
The development is the latest in a string of Chinese-sponsored efforts to subvert critical infrastructure in the US and destabilize Pacific Rim allies, many flagged by Microsoft using hurricane-related names.
For instance, a Chinese threat actor known as Flax Typhoon emerged a year ago, using legitimate tools and utilities built into the Windows operating system to carry out an extremely stealthy and persistent spy operation against entities in Taiwan. Last week, news emerged that the APT had built a 200,000-device Internet of Things (IoT) botnet in order to gain a foothold in government, military, and critical manufacturing targets in the US.
There’s also the APT that Microsoft calls Brass Typhoon (aka APT41, Earth Baxia, and Wicked Panda) that recently attacked Taiwanese government agencies, Filipino and Japanese military, and energy companies in Vietnam, installing backdoors for cyberespionage purposes.
On top of that, other China-linked groups have made a name for themselves in specifically targeting communications service providers, such as