US Discovers Hacking Group Responsible for Salt Typhoon Telecom Breaches

On January 17, 2025, the U.S. federal government announced that it has successfully traced intrusions by Chinese hackers targeting telecommunications networks back to a government contractor based in Sichuan, a region identified as a hotspot for hacking activities. The Cybersecurity & Infrastructure Security Agency and the Treasury Department have identified the contractor, Sichuan Juxinhe Network Technology, as complicit in such operations.

The Department of Treasury has levied sanctions against Sichuan Juxinhe, which is part of a growing hack-for-hire ecosystem thriving in Sichuan, particularly in its capital, Chengdu. This action comes amid ongoing efforts by major U.S. telecom providers, including AT&T and Verizon Communications, to repel incursions attributed to a state-backed entity known as Salt Typhoon. As recently reported, both companies have successfully mitigated foreign intrusions from their networks.

In addition to the sanctions against Sichuan Juxinhe, Treasury officials have also targeted Chinese national Yin Kecheng, who has been implicated in breaches affecting federal computing systems. Yin, believed to be operating from Shanghai and linked to China’s Ministry of State Security, reportedly accessed sensitive departments responsible for enforcing economic sanctions and assessing foreign investments for national security risks.

This recent sanction reflects a broader trend of intensified U.S. measures against Chinese cyber threats, which includes previous actions against other entities. Most notable was the sanction imposed on January 3, 2025, against Integrity Technology Group, which supports the group known as Flax Typhoon, a name associated with another state-sponsored hacking initiative. Another firm, Sichuan Silence Information Technology, was sanctioned in December, coinciding with an indictment of a Chinese national who allegedly developed exploits for Sophos firewalls.

Amid these developments, the Biden administration has taken steps to fortify the U.S.’s cybersecurity posture. An executive order issued recently allows Treasury to expand its authority to sanction individuals involved in facilitating hacking activities. This order empowers the department to act against those who “directly or indirectly” enable hackers or exploit compromised systems for financial gain.

The implications of these actions highlight the ongoing cybersecurity challenges posed by state-sponsored threats. The tactics employed in these attacks likely include initial access methods such as phishing or exploiting vulnerabilities in publicly accessible services, persistence techniques designed to maintain long-term access, and privilege escalation tactics that allow attackers to gain further control over systems.

While the outgoing Biden administration has indicated a robust approach to countering cybersecurity threats, the extent to which the incoming administration will utilize the newly granted powers remains to be seen. The ongoing developments underscore the necessity for businesses to remain vigilant and proactive against potential cyber threats and vulnerabilities.