Chinese nation-state threat actors [6], including APT groups Salt Typhoon, Flax Typhoon [1] [2] [3] [4] [5] [6] [7] [8] [9], and Velvet Ant, have been targeting US internet service providers (ISPs) as part of cyber espionage campaigns [7].
Description
These actors have exploited vulnerabilities in network devices [7], such as Cisco Systems routers and switches [7], to infiltrate networks and gather sensitive information. The APT group Salt Typhoon [6], also known as FamousSparrow and GhostEmperor [1] [4] [6] [9], has been identified as behind the campaign, deploying a rootkit named Demodex to compromise high-profile entities [4]. In a separate incident [6], the China-linked APT group Velvet Ant exploited a zero-day vulnerability in Cisco switches to deploy custom malware [6]. Additionally, the APT group StormBamboo compromised an ISP to poison DNS responses for target organizations [6], targeting insecure software update mechanisms to install malware on victim machines [6]. Furthermore, a botnet named Raptor Train [6], controlled by the APT group Flax Typhoon [6], compromised over 200,000 IoT devices since May 2020 [6]. The US government has taken action to disrupt a botnet controlled by a Beijing-linked hacking crew called Flax Typhoon [4], part of ongoing Chinese state-sponsored efforts targeting critical infrastructure sectors [1] [4] [9]. Salt Typhoon [1] [3] [4] [5] [6] [7] [8] [9], a Beijing-linked cyberspy group [8], has been detected infiltrating US internet service providers in stealthy data-stealing operations [8]. This group, along with other Chinese government-affiliated cyber actors like Flax Typhoon [8], has been targeting US critical infrastructure [6] [8], government [1] [3] [4] [5] [8] [9], and academic institutions [8]. The FBI and international law enforcement recently disrupted a 260,000-device botnet controlled by Flax Typhoon [8], which had been active since 2021 [8]. These incidents highlight the ongoing threat posed by Chinese state-sponsored cyber espionage campaigns targeting US networks [8]. A recent cyber attack attributed to a Chinese-linked group known as Flax Typhoon targeted critical infrastructure [2], adding to a series of aggressive campaigns by state-sponsored actors aligned with Beijing [2]. These attacks focus on infiltrating telecommunications [2], ISPs [2] [3] [6] [7] [9], and other essential networks [2], aiming to gain long-term access for data theft and potential system disruption [2]. The strategic nature of these intrusions highlights the evolving landscape of cyber warfare [2], where infrastructure is as much a target as traditional intelligence agencies or military assets [2]. The GhostEmperor group’s infiltration of US ISPs serves as a reminder of the constant threat posed by state-sponsored cyber espionage [2], emphasizing the need for preparedness [2], vigilance [2], and collaboration in defending against such attacks [2]. Hackers with ties to the Chinese government have targeted US internet service providers in a cyber espionage campaign known as Salt Typhoon [5]. This operation aimed to infiltrate US broadband networks to access sensitive data stored by telecommunications companies or launch damaging cyberattacks [5]. Beijing has been increasing its cyberhacking capabilities [5], with US officials disrupting a network infected by the Chinese hacking team Flax Typhoon [5]. Another operation [5], Volt Typhoon [1] [3] [4] [5] [6] [7] [8] [9], targeted ports and utilities that could disrupt US military operations in Taiwan [5]. FBI Director Christopher Wray has warned that China’s hacking program is larger than that of every other major nation combined [5]. Salt Typhoon [1] [3] [4] [5] [6] [7] [8] [9], a Chinese state-sponsored APT [1] [3] [4] [8] [9], has targeted multiple US ISPs in 2024 [3], aiming to steal sensitive data and establish a foothold for future cyberattacks [3]. The group utilizes advanced rootkits and memory-based malware [3], similar to related Chinese APT groups like Flax Typhoon and Volt Typhoon [3]. The infiltration of US ISP networks poses a significant risk to critical infrastructure [3], potentially impacting communications [3], government agencies [3] [5] [8], and private corporations [3]. The strategic implications of these activities [3], particularly concerning China’s broader geopolitical ambitions [3], are also discussed [3]. Recommendations for bolstering defenses against such sophisticated cyber threats are provided [3].
Conclusion
These incidents underscore the critical need for enhanced cybersecurity measures to protect against state-sponsored cyber espionage campaigns targeting US networks. Mitigating the risks posed by Chinese nation-state threat actors requires a coordinated effort involving government agencies, private sector entities, and international partners [8]. As cyber threats continue to evolve, staying ahead of adversaries and safeguarding critical infrastructure remains a top priority for national security.
References
[1] https://vulners.com/thn/THN:81D77AFADCF53112CB924814F80DA3FA
[2] https://www.cyclonis.com/chinese-hackers-breach-us-internet-providers-covert-cyber-espionage-operation/
[3] https://bobbragg.substack.com/p/quicklook-salt-typhoon-chinas-silent
[4] https://thehackernews.com/2024/09/chinese-hackers-infiltrate-us-internet.html
[5] https://www.semafor.com/article/09/25/2024/chinas-salt-typhoon-hacking-campaign-targets-us-internet-service-providers
[6] https://securityaffairs.com/168941/apt/salt-typhoon-china-linked-threat-actors-breached-us-isp.html
[7] https://www.csoonline.com/article/3541071/chinese-hackers-allegedly-hacked-us-isps-for-cyber-espionage.html
[8] https://www.threatshub.org/blog/chinas-salt-typhoon-cyber-spies-are-deep-inside-us-isps/
[9] https://www.techregister.co.uk/chinese-hackers-infiltrate-u-s-internet-providers-in-cyber-espionage-campaign/
