American telecom company T-Mobile, during the widespread cyberattacks attributed to China in 2024, took an unusual step to prevent hackers from infiltrating its network and physically cut a network cable to sever a suspicious system's connection to the outside.
A new Bloomberg report shows T-Mobile’s cybersecurity team, during the widespread wave of attacks known as Salt Typhoon, detected and stopped the attackers' activity before it could turn into a broad intrusion into the company's network.
How was the Salt Typhoon attack discovered?
The Salt Typhoon hacking group, attributed to the Chinese state, targeted a range of telecom and infrastructure companies in 2024. The campaign aimed to access communications data and customers’ call records and to gather information related to senior U.S. government officials.
During these attacks, companies including AT&T, Verizon, Viasat, Charter, and Windstream were also targeted. The breadth of the campaign made Salt Typhoon one of the most significant cyber operations attributed to China against U.S. communications infrastructure.
T-Mobile initially tried to identify potential attacker activity in its network. However, the company’s cybersecurity team was unable to definitively find the source of the suspicious activity for months.
An unusual behavior revealed the hackers’ path
According to Bloomberg, the key clue came when T-Mobile security experts observed unusual behavior in one of their systems. Investigations showed this activity entered via a router belonging to another telecom company, whose name was not disclosed in the report.
After identifying this connection, Jeff Simon, T-Mobile’s head of cybersecurity, along with three others, went to the company’s data center in Bellevue, Washington to examine the suspicious system in person.
After locating the compromised system, the security team, instead of waiting for the usual incident response processes to run their course, decided to physically sever its connection. According to Simon, they grabbed a pair of scissors and cut the cable that connected the system to the network outside the facility.
This simple but immediate action severed the compromised system’s link to the outside world and prevented the attackers from continuing their activity via the same route.
How did T-Mobile prevent a widespread intrusion?
Techcrunch reports the importance of this action becomes clear when we know Salt Typhoon’s attacks aimed to penetrate telecom infrastructure and access large volumes of communications data. Early detection of the suspicious activity on T-Mobile’s network allowed the company to block the route used by the attackers before the attack spread.
The cable-cutting episode shows that defending against sophisticated cyberattacks is not always limited to advanced software tools, and in emergency situations, physically disconnecting an infected system can serve as a last line of defense.
While attacks attributed to Salt Typhoon continue to pose significant security concerns for telecom companies and Western governments, T-Mobile’s experience is an example of the importance of fast detection of anomalous behaviors and immediate response to cyber threats in critical infrastructure.