Adapted from reporting by the Wall Street Journal

In a chilling revelation of cyber espionage, Chinese hackers tied to state intelligence launched a sophisticated attack on U.S. telecommunications infrastructure, infiltrating the cell networks of key American officials. First reported by The Wall Street Journal, this hack exposed sensitive data such as call logs, unencrypted texts, and even audio from the conversations of senior U.S. national security and policy figures. Evidence suggests that this prolonged attack may have compromised thousands of contacts across the U.S. government and extended to allied nations. This breach raises profound concerns regarding the security and resilience of America’s communications networks.

The cyber intrusion, carried out over eight months, displayed a deep understanding of American telecommunications infrastructure. Hackers accessed crucial areas of network management at major telecom providers, including Lumen Technologies, a company contracted by the U.S. government. With this access, the group, identified by investigators as “Salt Typhoon,” gained visibility into network configurations and conducted reconnaissance undetected for weeks. Through a methodical approach, they unlocked layer after layer of network defenses, building an understanding of America’s communications framework.

Evidence of Espionage and its Implications

Investigators have found that the hackers employed various techniques to breach the telecom networks. They accessed key network management layers by leveraging stolen credentials, allowing them to bypass standard security protocols. They even exploited vulnerabilities in routers from well-known providers like Cisco. In some cases, the attackers re-entered systems that had already been patched, indicating their persistence and advanced technical skills.

The primary targets of this operation were high-value political and national security figures, though the hackers had the capacity to access data from almost any American using affected carriers like AT&T and Verizon. While their focus remained on these select individuals, the reach of their access casts a wide net, potentially ensnaring countless other contacts in the process. Investigators have yet to determine the full extent of the stolen data, but early analysis suggests that the intruders captured voice audio from some victims, possibly including voice memos or actual phone calls.

This hack may also have targeted systems meant for court-authorized wiretaps, heightening fears that Beijing could monitor ongoing investigations involving Chinese spies and other sensitive matters. The espionage campaign underscores how China has achieved a level of cyber infiltration that surpasses previous assessments, using methods that blend technology and psychology. U.S. intelligence officials warn that China could be using artificial intelligence to process the stolen data, creating a complex social map of American citizens and leaders. These insights could allow China to anticipate U.S. decisions and develop profiles on key figures for future influence.

The Threat to National Security

The scale and nature of the breach have profound national security implications. The hackers’ ability to persist within these networks undetected underscores a significant vulnerability in U.S. infrastructure. “It’s a vulnerability that no one imagined or anticipated,” stated Senator Marco Rubio, the leading Republican on the Senate Intelligence Committee, emphasizing the severity of the breach. This view is echoed by the committee’s Democratic chairman, Senator Mark Warner, who remarked that it ranks among the most serious breaches he has ever witnessed.

In response, the National Security Council has initiated a coordinated federal response to mitigate the breach’s impact. Efforts are underway to support affected entities, evaluate the threat’s full scope, and reinforce security measures across the board. Yet, even as officials work to contain the damage, the breach remains a stark reminder of the risks posed by foreign actors with advanced cyber capabilities.

China’s Cyber-Espionage Legacy and Future Implications

This hack is not an isolated incident but part of a long-standing campaign of cyber-attacks orchestrated by the Ministry of State Security (MSS), China’s intelligence agency. MSS frequently employs contractors for these operations, with a Chinese contractor reportedly responsible for the current breach. A spokesman from the Chinese Embassy in Washington has denied any involvement, attributing these claims to misinformation from U.S. intelligence agencies and cybersecurity firms.

For years, U.S. officials have warned of China’s expanding cyber capabilities and its accumulation of American personal data. The MSS’s strategy of building extensive databases on Americans could be aimed at identifying spies, mapping out social connections, and even monitoring political figures for future leverage.

As the probe into this breach continues, investigators are discovering more links to past incidents, including the massive 2021 Exchange hack that affected government networks worldwide. The Biden administration previously held China accountable for that breach, further cementing concerns over the scope and ambition of China’s cyber operations.

ACZ Editor: In my intelligence days, I was taught that when you are on an open line, you do not try to “talk around” things, you do not allude to sensitive matters, none of that. Intelligence agencies are very good at interpreting such conversations correctly. Add to this, that most of the officials not only don’t suspect that they are being spied on, they also don’t know enough about what is sensitive to curb those conversations. This is a huge advantage for Chinese intelligence service, and thus the Chinese government.