For those of you old enough to remember party lines when using your telephones, you could not just pick up the phone and start talking, as there were likely two others on the same ‘line,’ until those talking would hang up their phones. So, you didn’t want to begin sharing any personal information with these two strangers. A party line (multiparty line, shared service line, party wire) is a local loop telephone circuit shared by multiple telephone service subscribers. Fast forward to 2024. The US government’s Consumer Financial Protection Bureau (CFPB) advises employees to avoid using cell phones for work after China-linked APT group Salt Typhoon hackers breached significant telecom providers. The CFPB is a US government agency created in 2011 to protect consumers in the financial sector, ensuring fair, transparent, and competitive financial markets.
See: https://redskyalliance.org/xindustry/salt-typhoon-hackers
The agency has issued a directive to employees to reduce the use of their phones and invite them to use Microsoft Teams and Cisco WebEx for meetings and conversations involving nonpublic data. “In an email to staff sent [last week], the chief information officer at the Consumer Financial Protection Bureau warned that internal and external work-related meetings and conversations that involve nonpublic data should only be held on platforms such as Microsoft Teams and Cisco WebEx and not on work-issued or personal phones,” explained in an article published by the Wall Street Journal (WSJ).
“Do NOT conduct CFPB work using mobile voice calls or text messages,” reads the email sent to the employees referencing a recent government statement acknowledging the telecommunications infrastructure attack. “While there is no evidence that this unauthorized access has targeted CFPB, I ask for your compliance with these directives so we reduce the risk that we will be compromised,” said the email sent to all CFPB employees and contractors.
China-linked threat actors have breached several US internet service providers in recent months as part of a cyber espionage campaign code-named Salt Typhoon. The state-sponsored hackers aimed to gather intelligence from the targets or carry out disruptive cyberattacks.
The WSJ reported that experts are investigating the security breach to determine if the attackers gained access to Cisco Systems routers, which are core network components of the ISP infrastructures. A Cisco spokeswoman confirmed the investigation and said that “at this time, there is no indication that Cisco routers are involved” in the Salt Typhoon activity, the spokeswoman said.
The cyber campaign is attributed to the China-linked APT group Salt Typhoon, FamousSparrow, and GhostEmperor. “Hackers linked to the Chinese government have broken into a handful of U.S. internet-service providers in recent months in pursuit of sensitive information, according to people familiar with the matter.” Wall Street Journal reported.
“The hacking campaign, called Salt Typhoon by investigators, hasn’t previously been publicly disclosed and is the latest in a series of incursions that U.S. investigators have linked to China in recent years. The intrusion is a sign of the stealthy success Beijing’s massive digital army of cyberspies has had breaking into valuable computer networks in the U.S. and around the globe.”
China has long targeted global internet service providers and recent attacks have been aligned with past operations linked to Beijing. Intelligence and cybersecurity experts warn that Chinese nation-state actors have shifted from stealing secrets to infiltrating critical U.S. infrastructure, suggesting that they are now targeting the core of America’s digital networks.
The Salt Typhoon hacking campaign, linked to China, appears focused on intelligence gathering rather than crippling infrastructure, unlike the attacks carried out by another China-linked APT group called Volt Typhoon. Chris Krebs from SentinelOne suggested that the group behind Salt Typhoon may be affiliated with China’s Ministry of State Security, specifically the APT40 group, which specializes in intelligence collection. The U.S. and its allies publicly called out this group for hacking activities in July.
In July 2024, Cisco fixed an actively exploited NX-OS zero-day that allowed previously unknown malware to be installed as root on vulnerable switches. Cisco also addressed an NX-OS zero-day, tracked as CVE-2024-20399 (CVSS score of 6.0), that the China-linked group Velvet Ant exploited to deploy previously unknown malware as root on vulnerable switches.
Cybersecurity firm Sygnia observed the attacks on April 2024 and reported them to Cisco. “Sygnia identified that CVE-2024-20399 was exploited in the wild by a China-nexus threat group as a ‘zero-day’ and shared the vulnerability details with Cisco. By exploiting this vulnerability, a threat group named ‘Velvet Ant' successfully executed commands on the underlying operating system of Cisco Nexus devices.” reads the report published by Sygnia. “This exploitation led to executing a previously unknown custom malware that allowed the threat group to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code on the devices. “
In August 2024, Volexity researchers reported that a China-linked APT group tracked as StormBamboo (aka Evasive Panda, Daggerfly, and StormCloud) successfully compromised an undisclosed internet service provider (ISP) to poison DNS responses for target organizations. The threat actors targeted insecure software update mechanisms to install malware on macOS and Windows victim machines.
This article is shared at no charge and is for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com
• Reporting: https://www.redskyalliance.org/
• Website: https://www.redskyalliance.com/
• LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
Comments