A Chinese hacking group that may have stolen information from nearly every American “almost certainly” targeted a Canadian telecommunications company as well, according to a warning from Canada’s cyber intelligence agency.
The prowess of the Beijing-backed group often referred to as Salt Typhoon is back in the news after more than a dozen international government agencies issued a joint statement warning of a “deliberate and sustained campaign.”
The U.S.-led statement was co-signed by international intelligence agencies, including from the United States, Australia and Canada’s Communications Security Establishment (CSE).
The joint advisory found that Salt Typhoon targeted “telecommunications, government, transportation, lodging and military infrastructure networks.”
The statement, released late last week, said the stolen data “ultimately can provide Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world.”
Cynthia Kaiser, a former senior official with the Federal Bureau of Investigation (FBI) who oversaw investigations into the hacking, told The New York Times she “can’t imagine any American was spared given the breadth of the campaign.”
While some of Salt Typhoon’s operations have previously been reported, the joint statement suggests the scope and persistence of the attacks are larger than originally thought.
Late last year, U.S. agencies reported that Salt Typhoon had compromised multiple telecommunications networks as part of an espionage campaign. U.S. media reported the devices used by since re-elected U.S. President Donald Trump and his then running mate, JD Vance, were targeted in the hack.
Now the FBI says the group “recklessly stole personal data belonging to millions of Americans, and in some instances surveilled communications — all in support of the Chinese Communist Party.”
The bureau said in a statement last week that “the expectation of privacy was violated not just in the United States but abused globally.”
CSE did not respond to CBC News questions about how many Canadians may have been swept up in the attack.
“We cannot comment on specific or alleged cyber incidents,” said spokesperson Janny Bender Asselin, but added the attacks on critical infrastructure noted in the joint statement are happening globally.
“The People’s Republic of China presents the most sophisticated and active cyber threat to Canada and we regularly release warnings, advisories and guidance about this threat.”
However, CSE issued a troubling warning about Salt Typhoon earlier this year.
In June the agency said it was “aware of malicious cyber activities currently targeting Canadian telecommunications companies” and that PRC state-sponsored actors, specifically Salt Typhoon, are “almost certainly” responsible.
CSE said those actors compromised network devices registered to a Canadian telecommunications company in February enabling traffic collection. It’s not clear what company was hit and how many Canadians were involved.
The agency, which is in charge of foreign signal intelligence and cybersecurity, said state-sponsored cyber threat actors have persistently compromised telecommunications providers to extract bulk customer data and collect information on high-value targets of interest, like government officials.
It also said in June that reports coming from its partners suggested “that this targeting is broader than just the telecommunications sector.”
“It’s possible and/or likely that the data of Canadians was exposed,” said Charles Finlay, executive director of the Rogers Cybersecurity Catalyst at Toronto Metropolitan University.
“Salt Typhoon represents the most sophisticated, most persistent and maybe the most successful example that we have had to date of a cyberattack by the government of China against infrastructure in other countries.”
The joint statement said the hackers have been performing malicious operations globally since at least 2021 and have had “considerable success” exploiting publicly known common vulnerabilities and other “avoidable weaknesses.”
While the statement included mitigation recommendations for network operators, Finlay said the average cellphone user doesn’t have much of a defence.
“The average Canadian on the street is just not going to be able to take practical steps to defend themselves from that kind of an attack,” he said. “What the average Canadian can do and should do is recognize that this international cybersecurity conflict is happening.”
He urged Parliament to centre cybersecurity in the conversation around defence capacity.
“What we’re talking about is the digital battle space,” he said. “The moment for strategies is over. It is time for action and investment.”
