Hackers have compromised communication of government officials, intelligence agencies say

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have announced that state-sponsored hackers from the People’s Republic of China have targeted the commercial telecommunications infrastructure and stole confidential information of a ‘limited number’ of government officials.

“Specifically, we have identified that PRC-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data,” the intelligence agencies say in a joint statement.

They added that the attackers compromised “private communications of a limited number of individuals who are primarily involved in government or political activity, and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders”.

The news comes after the FBI and CISA disclosed that hackers from the People’s Republic of China breached multiple commercial telecommunication service providers in the United States. They wouldn’t say what internet service providers got hit, but according to The Wall Street Journal this included Verizon, AT&T and Lumen Technologies.

According to the same report, a Chinese hacking group called Salt Typhoon is responsible for the attack. The group is also known as Ghost Emperor, Earth Estries, FamousSparrow, and UNC2286.

“The hackers appear to have engaged in a vast collection of internet traffic from internet service providers that count businesses large and small, and millions of Americans, as their customers,” the newspaper wrote.

It’s not just the US that’s being targeted by hackers from the People’s Republic of China. The Canadian government issued a press release a few weeks ago, stating that Chinese hackers have been performing broad network scans against numerous domains in Canada throughout 2024, targeting primarily government organizations, political parties, media organizations, think tanks and NGOs.

The FBI’s and CISA’s joint statement confirms that the threat actor that’s responsible for the incident had access to federal government systems. The agencies promise to continue to “render technical assistance, rapidly share information to assist other potential victims, and work to strengthen cyber defenses across the commercial communications sector”.

Organizations and businesses that believe they might have fallen victim to state-sponsored Chinese hackers, are encouraged to contact the local field office of the FBI or CISA.