T-Mobile Cut a Cable With Scissors to Boot Out Chinese Hackers

A new investigation by Bloomberg reveals how cybersecurity specialists at the American carrier T-Mobile detected and drove Chinese hackers out of their network in 2024. The attacks came amid a wave of large-scale intrusions orchestrated by Beijing to steal user data.

The Salt Typhoon Campaign

Behind the breaches was Salt Typhoon, a group backed by the Chinese government. Over the course of the campaign, hundreds of phone companies, internet giants and data center providers were compromised. The goal was to collect phone records and information on high-ranking U.S. officials, including the presidential candidates of the time.

Among those affected were AT&T, Verizon, the satellite operator Viasat, as well as infrastructure giants Charter and Windstream. T-Mobile, however, largely avoided a full-scale breach precisely because it spotted the suspicious activity at an early stage.

Months of Searching, and a Pair of Scissors

According to Bloomberg, the company's cyber specialists spent months fruitlessly searching their network for traces of the suspected intruders. In the end, they identified unusual behavior on one of their systems — traffic was coming from a router belonging to another telecommunications company, whose name T-Mobile did not disclose.

Having pinpointed the source of the intrusion, T-Mobile's head of cybersecurity, Jeff Simon, drove to the nearest data center in Bellevue, Washington, together with three colleagues. There they found the compromised equipment, pulled out a pair of scissors and simply cut the cable connecting it to the outside world.

The approach proved striking in its simplicity: when digital methods yielded no results, the matter was settled mechanically. TechCrunch has reached out to T-Mobile for additional comment.

Source: TechCrunch