The most recent cybersecurity attack is called the Salt Typhoon, which is a malicious attack aimed at networks of global communication organizations.

Does it come as any surprise that this latest attack on the cybersecurity of many major global telecommunications organizations comes from the People’s Republic of China? China seems to always pose a threat to information and communication. Thankfully, responses to the Salt Typhoon come from the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI).
Let’s learn a little more about this global cyberattack.

Cyberattacks can take down modern society

This latest cyberattack, sometimes called a hack, isn’t the first we’ve experienced in recent years. Unfortunately, our world today is completely dependent upon digital communications and information. By targeting critical data locations and telecommunications networks, an attack can cause systems to stop functioning, but more serious issues could be even more problematic than the inconvenience of a system’s lack of functionality for a short time.

Some of the ways that Salt Typhoon can cause panic and disruption in telecommunication provides are:

• Intercepting sensitive communications: This means accessing voice and data transmissions, which are invaluable information, especially if these communications involve government activities, corporate strategies, and personal information.
• Disrupt essential services: By compromising the infrastructure, these cyberattacks can cause widespread service outages, which impacts every part of life as we know it, but most importantly, economies, public safety, and emergency response capabilities.
• Establish long-term espionage platforms: Continued access to these networks enables the hackers to continuously monitor information, gather data as it comes in, and has the potential to manipulate communications over extended periods.

Nothing new for China

When major hacks and security challenges are found, we expect to learn of a hacking group or Chinese involvement. That’s not to say that other countries aren’t involved in similar security breaches and hacks. It’s well-known that most countries engage in some form of espionage and information theft when they can. These are often called state-sponsored events because they are funded and supported by the government.

This recent attack aligns extremely well with such espionage, making Salt Typhoon a state-sponsored attack, with that state being China. Some of the objectives of this attack are:

• Strategic intelligence gathering: This is the gathering of classified materials, trade secrets, and strategic communications to achieve some form of political or economic advantage.
• Technological leverage: Stealing intellectual property and sensitive data. This is meant to improve tech capabilities by the government hacking the communications networks without doing the necessary research and development.
• Cyber warfare preparedness: Hackers embed the information system with critical information and damaged the infrastructure to prepare for future potential conflicts in which controlling communications could impact and provide strategic advantages.
• Influence and manipulation: The attackers monitor or alter communications to support misinformation campaigns and espionage efforts or try to weaken public confidence in the companies that have been hacked.

What could Salt Typhoon do next?

This cybersecurity threat, which is supported and backed by China, isn’t going away any time soon. In fact, the aggressive tactics and expanded reach allows this organization to:

• Extend their attacks to other sectors that are critical to the infrastructure of many countries. These could be industries including energy, finance, healthcare, and transportation
• Develop more advanced malware, rootkits, and zero-day exploits. This would allow the attacks to remain undetected for longer, allowing the organization to gather more information and maintain long-term access
• Exploit supply chain vulnerabilities. This could mean third-party vendors and contractors become targets, and this attack begins to infiltrate smaller networks that can still be extremely important
• Utilize data that’s been gathered, also known as compromised data by the victims, for strategic gains, blackmail, or to launch future attacks

What should targeted organizations do?

The CISA suggests actions that are pretty much expected when such an attack takes place. Salt Typhoon relies on stealthy intrusion methods and hides in normal network traffic. This means telecommunications organizations should increase visibility, monitoring, configuration management, segmentation, and access controls. It’s also extremely important to improve security protocols and investigate any traffic that looks the least bit suspicious.

This nefarious organization also capitalizes on unpatched vulnerabilities, weak configurations, and insecure management networks. To avoid being hacked by Salt Typhoon, companies must harden systems and devices to reduce the ability of an attacker to find a weakness and exploit it. This is one of the best ways to keep potential cybersecurity risks out of necessary systems.