State-sponsored actor Salt Typhoon (linked to China's MSS) compromised US telecommunications providers and FBI surveillance networks by exploiting unpatched edge networking devices, including Cisco routers. Adversaries leveraged lateral movement from provider edge (PE) and customer edge (CE) routers to access CALEA-compliant interception gateways. This allowed unauthorized exfiltration of court-authorized wiretap returns, pen register data, and trap-and-trace metadata for over one million users. The breach exposed sensitive PII and operational security (OPSEC) for FBI investigative targets and undercover assets. Persistence was maintained via the Demodex kernel rootkit and SparrowDoor backdoors, with C2 traffic routed through LightNode VPS.

• Attack Vector: Edge Exploitation and Lateral Movement

  • Exploited known vulnerabilities in enterprise-grade edge routers and VPN concentrators, some of which lacked critical patches for over seven years.
  • Utilized compromised backbone routers to pivot from provider edge (PE) and customer edge (CE) segments into restricted management planes.
  • Targeted CALEA (Communications Assistance for Law Enforcement Act) interfaces to intercept lawful surveillance data directly from carrier gateways.

• Technical Tooling and Persistence

  • Deployed the Demodex kernel rootkit and SparrowDoor/GhostSpider backdoors to maintain stealthy, low-signal persistence within carrier infrastructure.
  • Utilized Cobalt Strike for post-exploitation, routing command-and-control (C2) traffic through LightNode VPS and encrypted tunnels.
  • Exfiltrated sensitive data via legitimate web services, including GitHub, Gmail, AnonFiles, and File.io, to blend in with standard HTTPS traffic.

• Impact Assessment: National Security and Law Enforcement

  • Compromised "pen register and trap and trace" returns, allowing a foreign intelligence service to identify active FBI investigative targets.
  • Intercepted unencrypted SMS, audio communications, and real-time geolocation data across nine major US telecommunications carriers.
  • Extended lateral movement into the US Army National Guard, exfiltrating administrative credentials and network diagrams across all 50 states.

• Regulatory and Defensive Imperatives

  • The FCC proposed a Declaratory Ruling clarifying that CALEA Section 105 mandates a legal obligation for carriers to secure interception systems against unlawful access.
  • CISA and the NSA issued "Enhanced Visibility and Hardening Guidance" focusing on aggressive patching of PE routers and Zero Trust architecture adoption.
  • Federal authorities are urging a shift toward end-to-end encrypted (E2EE) messaging to mitigate the risk of metadata and content interception at the carrier level.