Loading story…
A House committee report found that China Telecom Americas, China Mobile USA, and China Unicom Americas remained operationally dependent on parent companies in China or Hong Kong while still maintaining equipment, transmission hardware, points of presence, and active network assets inside the United States. Investigators said those lingering interconnections and private leases persisted despite federal restrictions, raising concerns that routing, service provisioning, and oversight of U.S.-based infrastructure could still be influenced from abroad.
The report also linked the carriers to entities that U.S. authorities and researchers have associated with Chinese state-backed cyber activity, including CloudRadium, Integrity Technology Group, and i-SOON. Separate reporting on the 2024 i-SOON leak said internal chats, sales materials, and malware documentation appeared genuine and tied the company to previously reported Chinese espionage operations, including overlaps with Comm100 supply-chain activity, POISON CARP, ShadowPad infrastructure, and a Linux malware controller called Treadstone. Together, the findings sharpen concerns that commercial Chinese telecom and security firms can preserve access and support capabilities that complicate efforts to remove national-security risks from U.S. networks.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
On Feb. 16, 2024, someone uploaded data to GitHub allegedly containing i-Soon internal communications, sales materials, product manuals, screenshots, and probable victim data. Unit 42 assessed with high confidence that the leaked materials are genuine.
A congressional committee report said China Unicom and Integrity Technology Group formalized a cooperation agreement in November 2023. The report said this occurred while the Flax Typhoon botnet was operating.
Trend Micro reported in September 2022 that attackers trojanized the installer for Comm100’s chat-based customer engagement application hosted on the company’s official website. Unit 42 later assessed with moderate confidence that hackers within i-Soon were involved.
On June 17, 2022, IP address 8.218.67[.]52 served a Linux ELF file from /js/xxx.jpg. Unit 42 said leaked i-Soon chats claimed this Hong Kong-based server belonged to them and linked it to infrastructure used in the Comm100 intrusion.
A 2019 U.S. grand jury indictment against three Chengdu 404 employees referenced Treadstone malware controller software and attributed it to Elemental Taurus (APT41). Unit 42 noted a leaked i-Soon manual showed a Linux malware control panel with the same name.
Citizen Lab reported a 2019 campaign using iOS and Android exploits to target Tibetan groups and attributed the activity to the Chinese threat group it tracks as POISON CARP. Unit 42 later linked leaked i-Soon data to this previously reported campaign.
A congressional committee report found that China Telecom Americas, China Mobile USA, and China Unicom Americas remained operationally dependent on parent entities in China or Hong Kong while retaining equipment and network connections inside the United States. The report also described ties to entities linked by U.S. authorities to Chinese state-backed cyber activity, including CloudRadium, Integrity Technology Group, and i-SOON.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourcescworld.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourceunit42.paloaltonetworks.com
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked hacking groups were reported to have penetrated a wide range of targets across the United States and allied regions, including manufacturers, U.S. government email systems, internet providers, and major telecommunications networks. Earlier reporting described broad economic espionage aimed at stealing trade secrets from manufacturing sectors in the U.S., Europe, and Asia, while later disclosures said Chinese operators breached U.S. government email accounts through Microsoft cloud infrastructure and infiltrated American internet providers for surveillance. Subsequent investigations tied the telecom intrusions to the **Salt Typhoon** campaign, which officials said exposed sensitive metadata and provided insight into U.S. surveillance targets. U.S. officials characterized the activity, alongside related operations such as **Volt Typhoon**, as one of the most serious cyber threats to American critical infrastructure in recent years. Reporting said investigators believed the attackers may have retained access to at least eight telecom firms, including **Verizon** and **AT&T**, and that the campaign extended to dozens of telecoms and government agencies. In response, the Biden administration moved to bar the remaining U.S. operations of **China Telecom Americas**, citing national security risks and signaling the first public retaliatory step tied to the telecom compromises, even as debate continued over broader sanctions, technology restrictions, and offensive cyber responses.
Jun 29, 2026
Major U.S. telecommunications providers have formed the **Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC)** to strengthen real-time threat sharing and collective defense after the China-linked **Salt Typhoon** campaign compromised carrier networks in the United States and abroad. The intrusions, described by Sen. Mark Warner as the worst telecom hack in U.S. history, affected multiple major providers including **AT&T, Verizon, Lumen Technologies, T-Mobile**, and others, with investigators saying the activity has been ongoing since at least 2019 and there is still no clear public evidence the threat actors have been fully removed from communications networks. Officials and reporting said the espionage campaign enabled attackers to move between telecom networks, exfiltrate large volumes of data, and in some cases listen to audio calls in real time while targeting high-value intelligence, government, and political communications. Investigators also found breaches of U.S. lawful intercept systems used for court-ordered surveillance, while a separate suspected China-linked compromise of an FBI surveillance system likely exposed phone numbers of monitored targets; the campaign has also been linked to exploitation of vulnerabilities in **Cisco** routers to gain access to telecom infrastructure.
Jun 29, 2026
Forescout reported that Chinese-manufactured connected devices continued to expand across U.S. enterprise networks despite federal restrictions and long-running national security concerns. Its analysis found nearly **300,000** such devices from **473 Chinese manufacturers** in U.S. networks in February 2024, accounting for **3.8%** of observed devices and marking a **41% year-over-year increase**. The growth was especially notable in critical sectors including **healthcare, manufacturing, government, utilities, and financial services**. The report said banned products, including **Hikvision** and **Dahua** cameras, remained present even in government environments, while many Chinese-made devices were directly exposed to the internet. Forescout identified hundreds of exposed Hikvision and Dahua systems across dozens of small U.S. utilities and warned that such devices could provide opportunities for **espionage, disruption, and initial access**. The findings also pointed to prior exploitation of Hikvision vulnerabilities and the use of IoT devices by Chinese APT actors in operations targeting critical infrastructure.
Aug 14, 2026