US Telecom Giant T-Mobile Detects Network Intrusion Attempts by Cable Provider

28 November 2024Ravie LakshmananNetwork Security / Cyber ​​Espionage

US carrier T-Mobile said it recently detected attempts by bad actors to infiltrate its systems in recent weeks, but noted that no sensitive data was accessed.

Those attempted intrusions “stemmed from a cable provider’s network that was connected to ours,” Jeff Simon, chief security officer at T-Mobile, said in a statement. “We don’t see any cases of previous attempts like this.”

The company further said that its security defenses prevented the threat actors from disrupting its services or obtaining customer information. It has since confirmed that it disconnected from the unnamed provider’s network. It did not explicitly attribute the activity to any known threat actor or group, but noted that it has shared its findings with the US government.

Talking to Bloomberg, Simon said the company observed that the attackers ran discovery-related commands on routers to examine the network’s topography, adding that the attacks were contained before moving laterally across the network. T-Mobile is the first company to publicly acknowledge the cyber incident.

The development comes shortly after reports that a China-linked cyberespionage group called Salt Typhoon (aka Earth Estries, FamousSparrow, GhostEmperor and UNC2286) targeted several US telecommunications companies, including AT&T, Verizon and Lumen Technologies, as part of an intelligence-gathering campaign.

“Simply put, our defenses functioned as designed—from our layered network design to robust monitoring and partnerships with third-party cybersecurity experts and a rapid response—to prevent the attackers from advancing and, importantly, preventing them from gaining access to sensitive customer information ,” Simon said. “Other providers may see different results.”