T-Mobile used a direct, physical measure to stop a device linked to the Salt Typhoon espionage campaign: a technician cut the router’s cable. The incident, reported by Bloomberg and recounted by T-Mobile Chief Information Officer Jeff Simon, showed how the company tracked down equipment communicating with its network while appearing to be one of its own devices.
Salt Typhoon targeted more than 200 organizations in 80 countries in autumn 2024, with the United States among the most affected. The attackers infiltrated nine major US telecommunications companies, including Verizon, AT&T and T-Mobile. Subsequent analyses indicated that they were able to collect call and message metadata belonging to millions of customers.
T-Mobile’s investigation began after an unusual router at one of its California data centers appeared to communicate with another company site despite being switched off. A technician unplugged the device and took it to the company’s headquarters in Washington for examination. There, staff determined that the signal came from a different telecom company’s data center in Chicago.
According to Simon, the attackers had altered the Chicago router so it appeared within the network as a T-Mobile device and could communicate with other equipment. Technicians went to the data center and found the router. One of them cut its cable, a faster option than shutting down the device, Simon said.
T-Mobile took the router away and restarted it in an isolated testing environment, but the attackers could no longer be found. Simon said they had access only to external networks and had not reached customer data. The severed cable is now displayed in a frame as a reminder of the incident.
Sources: t3n.