AT&T, Verizon say they evicted Salt Typhoon from their networks

Telecom network above a city · Cybersecurity Dive · NicoElNino via Getty Images

Matt Kapko

Tue, Jan 7, 2025, 1:12 AM 2 min read

AT&T and Verizon, two of the nine U.S. telecom companies attacked by Salt Typhoon, said they evicted the China-government sponsored threat group from their networks.
“We detect no activity by nation-state actors in our networks at this time,” an AT&T spokesperson said in a prepared statement. A Verizon spokesperson made a similar statement, asserting the carrier has “contained the cyber incident brought on by this nation-state threat actor. An independent and highly respected cybersecurity firm has confirmed the Verizon containment.”
AT&T and Verizon did not say when they ejected the nation-state group from their networks, but declared their networks secure last week.

Dive Insight:

The network operators’ statements of eradication came just days after federal cyber officials declined to say the nation-state attackers have been evicted from any of the intruded networks.

“Once companies are taking those steps to make their networks defensible, we would feel more confident to say that the Chinese actors have been evicted and can continue to not be able to come in,” Anne Neuberger, deputy national security advisor for cyber and emerging technology, said during a Dec. 27 media briefing.

An investigation into the sweeping attack spree on U.S. telecom networks is ongoing, but U.S. officials will likely never know some details regarding the scope and scale of the intrusion, Neuberger said.

Salt Typhoon was “very careful about their techniques. They erase logs. In many cases, companies were not keeping adequate logs,” Neuberger said.

Neuberger’s office did not respond to a request for comment on AT&T and Verizon’s response and recovery efforts.

“We have not detected threat actor activity in the Verizon network for some time, and after considerable work addressing this incident, we can report that Verizon has contained the activities associated with this particular incident,” Vandana Venkatesh, EVP and chief legal officer at Verizon, said in a statement.

AT&T and Verizon both said they’ve notified individuals who were directly targeted and impacted by Salt Typhoon’s activities.

“We will continue to work closely with government officials, other telecommunication companies, and third-party experts on the investigation of this nation-state action, and we are monitoring and remediating our networks to protect our customers’ data,” AT&T’s spokesperson said.

AT&T and Verizon are two of the three largest telecom providers in the U.S. T-Mobile, the third leg of that trio, said a threat group resembling Salt Typhoon intruded its network but the carrier said it kicked the attackers out of its systems before the nation-state group caused serious damage.