A House panel report found that US telecommunications companies connected their systems to data centers in ways that created security vulnerabilities, potentially facilitating the Salt Typhoon cyberattacks.
According to the House panel investigation, American telcos exposed their infrastructure to compromise through inadequate security practices when integrating their systems with third-party data centers and related facilities.
The report identifies poor architectural decisions and insufficient network segmentation as key factors that allowed threat actors to exploit entry points. Salt Typhoon, a Chinese state-sponsored hacking group, leveraged these vulnerabilities to gain access to sensitive telecom networks beginning in mid-2023.
The investigation reveals that telcos failed to implement robust isolation protocols between their core systems and external data center connections. This created a pathway for attackers to move laterally through networks once initial access was obtained.
Specific security gaps cited in the report include inadequate authentication mechanisms, insufficient monitoring of data center connections, and lack of threat detection on interconnected systems. The panel found that companies prioritized connectivity and operational efficiency over security controls.
The Salt Typhoon campaign affected multiple major US carriers and reportedly enabled access to customer call records and text messages. The breach raised alarms about the vulnerability of critical telecommunications infrastructure to nation-state actors.
The House panel's findings underscore systemic weaknesses in how US telcos manage third-party infrastructure relationships. Experts note that similar architectural problems exist across the industry, potentially exposing other carriers to comparable attacks.
The report recommends mandatory security standards for data center connections, improved network segmentation requirements, and enhanced monitoring capabilities. It also calls for better information sharing between telcos and federal agencies on infrastructure vulnerabilities.
Telecommunications companies face mounting pressure to remediate these weaknesses before additional threat actors can exploit similar gaps. The findings contribute to broader concerns about the security posture of US critical infrastructure.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.