Cybersecurity specialists have raised alarms after the Salt Typhoon hacking collective infiltrated a U.S. state's National Guard system.

The U.S. Department of Defense (DoD) revealed that the group infiltrated the system and remained undetected for nearly twelve months, possibly accessing confidential military and law enforcement information.

The DoD report, made public after a FOI request by the Property of the People organization, outlines a prolonged operation that “severely compromised” the National Guard’s system from March 2024 to the previous December.

As part of this breach, Salt Typhoon is thought to have gathered and extracted sensitive information, including configuration files for vital national infrastructure (CNI) entities and state government departments.

“This information also contained administrator login details and network layouts — which could assist future Salt Typhoon intrusions into these units,” the DoD cautioned.

Specifics regarding the affected National Guard unit were not revealed.

The DoD report pointed out that Salt Typhoon has previously exploited stolen network configuration files to “carry out cyber intrusions elsewhere.” Between January 2023 and March 2024, the group reportedly stole 1,462 configuration files linked to 70 U.S. government and CNI identities across 12 sectors.

These included entities in energy, communications, transport, and water treatment.

The report concluded that Salt Typhoon’s success “could weaken local cybersecurity initiatives aimed at protecting critical infrastructure.”

Salt Typhoon incident raises serious concerns

This event is the latest in a series of high-profile attacks attributed to the China-linked cyber espionage group, including breaches targeting U.S. telecom giants AT&T and Verizon.

In the previous December, White House officials cautioned that this specific operation enabled the group to access and record private discussions of “high-ranking” U.S. political figures.

Gary Barlet, public sector CTO at Illumio, stated that the incident once more underscores the group's expertise and capability to penetrate U.S. government systems.

Barlet, who previously served as Chief of Ground Networks for the Air Force CIO, warned that “all U.S. forces must now assume their systems have been breached,” going forward.

“Salt Typhoon's infiltration of the U.S. National Guard represents a major incident and could potentially pose a significant threat to numerous Department of Defense systems,” he remarked.

“The capability of groups like Salt Typhoon to navigate laterally across different units and systems highlights why government agencies must speed up the adoption of Zero Trust and pursue even more robust breach containment strategies,” Barlet added.

Barlet noted that this is not the first breach of DoD systems in recent times. There have been “multiple” incidents across both public and private sectors where sensitive data was exposed due to lateral movement.

“The Ponemon Institute found that 55% of organizations admitted that a compromised device had spread infection to other devices on the network,” he added.

Be sure to follow php.cn on Google News to stay updated on all our latest news, analysis, and reviews.

The above is the detailed content of ‘All US forces must now assume their networks are compromised’ after Salt Typhoon breach. For more information, please follow other related articles on the PHP Chinese website!