# Chinese actors breach eight US telecom providers via Salt Typhoon

Published: 2024-12-20 · Severity: routine · Sectors: telecommunications, government-national, defense
Canonical: https://vorant.io/reports/95ef012a-a4cc-59a1-a4d8-403da55dfbc2/chinese-actors-breach-eight-us-telecom-providers-via-salt-typhoon

> Chinese state-backed actors compromised at least eight US telecommunications providers over months, targeting political candidates, law enforcement wiretap systems, and critical infrastructure backbone.

Salt Typhoon represents a months-long espionage campaign attributed to Chinese state cyber actors, likely the Ministry of State Security or People's Liberation Army, that breached at least eight major US telecommunications providers including Lumen, Charter, Verizon, and AT&T. The adversary gained access to sensitive government and military personnel communications, compromised the Communications Assistance for Law Enforcement Act (CALEA) wiretap request system used by the US Department of Justice for national security cases, and targeted senior Democratic and Republican campaign officials and candidates. The campaign exploited well-understood technical debt within the telecommunications sector, including legacy systems, inadequate monitoring, vulnerable edge devices, and configuration weaknesses that had accumulated through industry acquisitions and the layering of older, less secure technologies alongside newer systems.

The breach demonstrates that US telecommunications networks—critical infrastructure relied upon by hundreds of millions of Americans—were not adequately defended against modern threats. Attribution to Chinese state actors aligns with previous reporting of Chinese targeting of US telecom systems dating to at least 2018 and concerns raised in the Huawei security debate. The incident was initially disclosed through leaks and press releases rather than formal government announcement, and CISA's chief mitigation guidance—recommending high-profile individuals shift to end-to-end encrypted communications—reflects the depth of the compromise and difficulty of remediating vulnerabilities in legacy network infrastructure. The campaign did not involve service disruption or destruction, focusing instead on intelligence collection and counterintelligence activities.

## Mentioned in this report

- Threat actors: Ministry of State Security, People's Liberation Army, Salt Typhoon
- Campaigns: Salt Typhoon

## Detection guidance (public sample)

### VNC Server Process Execution with Suspicious Parent

ATT&CK: T1021.005

Detects execution of VNC server processes (vncserver.exe, tvnserver.exe, ultravnc_service.exe) from unusual parents - common in lateral movement post-compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VNC Server Process Execution with Suspicious Parent
description: Detects VNC server executable execution spawned from non-standard parents
  (cmd, powershell, services.exe, svchost). Attackers enable VNC for persistent remote
  access after breaching edge devices and legacy systems.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_vnc_image:
    Image|endswith:
    - \vncserver.exe
    - \tvnserver.exe
    - \ultravnc_service.exe
    - \winvnc.exe
  selection_parent:
    ParentImage|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \services.exe
    - \svchost.exe
  filter_legitimate:
    CommandLine|contains:
    - -installservice
    - /install
  condition: selection_vnc_image and selection_parent and not filter_legitimate
falsepositives:
- VNC deployment scripts from legitimate remote management tools
- System administrators manually starting VNC services from command line in controlled
  environments
level: high
id: 0b485bfb-a84a-576b-95d2-22e0de3f4600
status: experimental
author: Vorant
```

### Windows Remote Management (WinRM) Service Activation

ATT&CK: T1021.006

Detects enabling of WinRM service via winrm.cmd or powershell enable-psremoting - used for lateral movement on compromised infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Remote Management Service Activation
description: Detects WinRM service enablement via winrm.cmd quickconfig or Enable-PSRemoting
  cmdlet. Attackers enable WinRM for persistent remote management access after compromising
  edge devices and legacy network infrastructure.
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_winrm_cmd:
    Image|endswith: \winrm.cmd
    CommandLine|contains: quickconfig
  selection_ps_enable:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains: Enable-PSRemoting
  condition: selection_winrm_cmd or selection_ps_enable
falsepositives:
- Legitimate system administration tasks enabling remote management
- Automated compliance configuration in managed enterprise environments
level: medium
id: cfae035a-38b3-5582-b1cb-ec17c2ad6bf9
status: experimental
author: Vorant
```

### Screen Capture Activity via Built-in Windows Tools

ATT&CK: T1113

Detects screen capture via rundll32 calling screensaver DLL or command-line screenshot utilities - intelligence collection post-compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Screen Capture Activity via Built-in Windows Tools
description: Detects screen capture activity using rundll32 with User32.dll DLL export
  or command-line screenshot utilities (screenshot.exe, ss.exe). Attackers perform
  screen capture for intelligence collection and exfiltration of sensitive communications
  data.
tags:
- attack.collection
- attack.t1113
logsource:
  category: process_creation
  product: windows
detection:
  selection_rundll_capture:
    Image|endswith: \rundll32.exe
    CommandLine|contains|all:
    - User32.dll
    - LockWorkStation
  selection_screenshot_tool:
    Image|endswith:
    - \screenshot.exe
    - \ss.exe
    - \nircmd.exe
    CommandLine|contains: screenshot
  condition: selection_rundll_capture or selection_screenshot_tool
falsepositives:
- Legitimate remote support tools using screen capture functionality
- Accessibility and diagnostics utilities capturing screen for troubleshooting
level: medium
id: b0d92520-533f-5d47-8e04-6993e0193ea1
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/content-series/cybersecurity-policy-and-strategy/the-eight-body-problem-exploring-the-implications-of-salt-typhoon

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/95ef012a-a4cc-59a1-a4d8-403da55dfbc2/chinese-actors-breach-eight-us-telecom-providers-via-salt-typhoon.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup