November 28, 2024Ravie LakshmananNetwork security / cyber espionage

US telecommunications provider T-Mobile said it had discovered attempts by criminals to break into its systems in recent weeks, but noted that sensitive data had not been accessed.

These intrusion attempts “came from a landline provider’s network that was connected to ours,” Jeff Simon, chief security officer at T-Mobile, said in a statement. “We don’t see any cases of previous attempts like this.”

The company also said its security measures prevented the threat actors from disrupting its services or obtaining customer information. It has since been confirmed that the connection to the unnamed provider’s network has been lost. It did not specifically attribute the activity to a known threat actor or group, but noted that it has shared its findings with the U.S. government.

Speaking to Bloomberg, Simon said the company observed the attackers running detection commands on routers to examine the topography of the network, adding that the attacks were contained before they spread laterally across the network. T-Mobile is the first company to publicly announce the cyber incident.

The development comes shortly after reports that a China-linked cyber espionage group called Salt Typhoon (aka Earth Estries, FamousSparrow, GhostEmperor and UNC2286) targeted several US telecommunications companies, including AT&T, Verizon and Lumen Technologies, as part of an intelligence gathering campaign.

“Simply put, our defenses worked as planned – from our layered network design to robust monitoring and partnerships with third-party cybersecurity experts to a rapid response – to stop the attackers from advancing and, more importantly, prevent them from emerging “To access confidential customer information,” Simon said. “Other providers may see different results.”