(Bloomberg) — Suspicious behavior on T-Mobile US Inc.’s network devices tipped off the company to a breach that was potentially part of a sprawling cyber-espionage campaign that has raised urgent questions about the exposure of a critical sector of the economy.
Most Read from Bloomberg
Jeff Simon, T-Mobile’s chief security officer, said in an interview with Bloomberg News that while the behavior wasn’t “inherently malicious,” it was unusual enough to draw the attention of the company’s network engineers. In recent weeks, the engineers had spotted unauthorized users running commands on the company’s network devices, seeming to probe the structure of the network, Simon said.
Upon discovery, the engineers booted the bad actors from the network before they got deeper into the network or accessed customer data.
“That was what initially clued us into some suspicious behavior, discovery-type commands being run on some of our routers and commands that have been known to be related to Salt Typhoon,” he said. Salt Typhoon is the name of an alleged Chinese state-sponsored hacking group that is believed to be behind the campaign.
China has repeatedly denied involvement.
T-Mobile is the first carrier to publicly offer a profile of markers potentially associated with Salt Typhoon, a name given to the hacking group by Microsoft Corp. US officials have accused Chinese state-sponsored hackers of a “broad and significant” spying campaign that has breached multiple telecommunications companies, but the companies believed to be prime targets have said little themselves.
The hackers, embedded in routers and burrowing deeper into communications networks for months, were able to access details of those subject to lawful surveillance targets – potentially exposing US efforts to track down foreign agents, according to two people familiar with the matter. They also spied on communications belonging to what the FBI has said is a “limited number” of people in government and politics, according to the US. That included President-Elect Donald Trump, Vice President-Elect JD Vance and staffers for Vice President Kamala Harris.
AT&T and Verizon were among the companies breached in the hacking campaign, according to the Wall Street Journal. T-Mobile said it, too, was breached with methods that appeared similar to those used by Salt Typhoon. However, T-Mobile said it was able to contain the intrusion before it left network routers and reached customers’ phones. The company said the threat originated from a “wireline” —- or non-wireless — provider’s network that connected to T-Mobile’s.
