Washington, D.C. — The U.S. government has uncovered a wide-ranging cyber espionage campaign by actors affiliated with the People’s Republic of China (PRC), targeting critical telecommunications infrastructure across the nation. This investigation, led by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA), has revealed that these PRC-linked actors have compromised networks at multiple telecommunications companies to facilitate the theft of sensitive data and private communications. The findings expose a sophisticated operation aimed at accessing customer call records, intercepting private communications, and extracting data under U.S. law enforcement protection.
Among the most concerning revelations is the targeting of individuals involved in government and political activities. The actors appear to have focused on gathering intelligence by exploiting vulnerabilities within telecom networks, compromising data protected under court orders. As the investigation unfolds, the FBI and CISA are intensifying efforts to assist affected organizations and bolster the resilience of the telecommunications sector. “Our goal is to protect critical infrastructure and ensure the confidentiality of communications,” said CISA Director Jen Easterly. “We urge any organization that suspects it may be a victim to contact their local FBI field office or CISA immediately.”
CISA and the FBI have been providing technical assistance to mitigate the impact of these intrusions. This includes sharing threat intelligence, offering guidance on best practices for cyber defense, and coordinating with industry partners to improve overall cybersecurity posture.
Specifically, we have identified that PRC-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data, the compromise of private communications of a limited number of individuals who are primarily involved in government or political activity, and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders. We expect our understanding of these compromises to grow as the investigation continues.
The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) continue to render technical assistance, rapidly share information to assist other potential victims and work to strengthen cyber defenses across the commercial communications sector. We encourage any organization that believes it might be a victim to engage its local FBI field office or CISA.
For detailed information on protecting your organization and reporting incidents, visit the FBI’s cybercrime resource page, FBI Cyber Crime Resources, or CISA’s advisory site, CISA Cybersecurity Alerts.
This discovery comes amid rising tensions between the U.S. and China over cybersecurity issues. It underscores the ongoing challenges in securing critical infrastructure against state-sponsored cyber operations. As more details emerge, the U.S. government will likely ramp up efforts to strengthen defenses and hold malicious actors accountable.
Read the full press release here: NSA Joins in Releasing Case Studies Showing PRC Tradecraft in Action
Read the full report here: APT40 Advisory PRC MSS tradecraft in action
