A security company has reported on a prolonged cyberattack against global phone networks, where hackers have apparently collected data related to phone conversations — from call duration to the identity of the parties and even the physical location of the device. Areport from Cybereason, an international cyber-security company with its headquarters in Boston, says it has worked with one telecoms provider to combat five waves of attacks that have taken place since 2018, and went on to discuss these attacks with more than 12 other networks.
Cybereason detailed how the attacks took place. Apparently targeting Call Detail Records, or CDRs, the attackers turned to a familiar system to gain entry to private networks — malware activated through opening infected files sent by email. Once access had been acquired, the security firm believes the target was to obtain the CDRs. The company claims it saw the attack, then worked to stop a further four attacks over the next few months, where each time the tools had been reworked, and applied using different techniques.
The networks targeted have not been named, but apparently the CDR data collected was related to users in Asia, the Middle East, and in Europe. Cybereason says the attacks were persistent and advanced, and attempts were made to steal usernames, passwords, call records, billing information, geo-location data, and more. The security company said this was, “a complete takeover of the network.”
APT10 has been in the news before. At the end of 2018 it was identified as being behind cyberattacks against Managed Service Providers in the U.K., a simultaneous attack in Japan, and elsewhere around the world, which became known asOperation Cloud Hopper. At the time,investigators at PwCsaid the large scale operation was, “only likely to reflect a small portion of APT10’s global operations.” It’s entirely possible the latest attack, named Operation Soft Cell by Cybereason, is also only one aspect of APT10’s current operations. It has also been blamed for recentcyber espionage activity in the Philippines. TheChinese Foreign Ministry respondedwhen at the end of 2018, the U.S. indicted two Chinese citizens that were allegedly members of APT10, stating it does not support, nor participate in, the stealing of commercial secrets.
