T-Mobile Physically Cuts Network Cable to Evict Chinese Salt Typhoon Hackers

In 2024, T-Mobile’s security team took an unusually direct approach to contain a cybersecurity threat: they physically cut a network cable to terminate suspected access by the Chinese state-backed hackers known as Salt Typhoon.

According to CSN, this action came after months of incident response efforts within T-Mobile’s network, during which defenders investigated signs of an intrusion linked to a broader telecom espionage campaign.

This situation highlights the challenges in removing skilled nation-state actors from interconnected carrier environments, where trusted connections and shared infrastructure can offer multiple pathways for lateral movement.

T-Mobile Physically Cuts Network Cable

T-Mobile investigators eventually detected suspicious traffic on an internal system that appeared to originate from a router operated by another unnamed telecommunications provider.

This lead allowed Jeff Simon, T-Mobile’s chief security officer, along with three colleagues, to trace the activity back to hardware located in a data center near the company’s headquarters in Bellevue, Washington.

Instead of relying solely on remote isolation or software-based remediation, the team traveled to the data center, identified the compromised connection, and physically severed the cable linking the affected equipment to the external network.

This decisive action effectively eliminated the attacker’s communication channel. Bloomberg reported that the cut cable was later framed and displayed at T-Mobile headquarters as a memento of their response effort.

While network segmentation, access-control policies, and endpoint containment are standard tools in incident response, physical disconnection remains an extremely effective measure when defenders need to urgently stop command-and-control traffic, prevent data exfiltration, or halt an adversary’s movement through uncertain network paths.

The T-Mobile incident was part of a wider espionage campaign linked to Salt Typhoon. This China-backed threat group has targeted telecommunications and internet service providers.

The FBI has indicated that this campaign affected at least 200 organizations across 80 countries, signifying a far larger scope than initially reported.

Some known victims of this campaign include AT&T, Verizon, Lumen, Charter Communications, and Windstream. The attackers focused on routers and telecom infrastructure to access valuable communication data and network traffic.

Salt Typhoon was first connected to T-Mobile in November 2024, when reports indicated that the carrier was inadvertently involved in the industry-wide activities. At that time, T-Mobile stated that it had found no evidence that significant customer data had been compromised.

The campaign raised further concerns when the FBI and CISA warned that attackers were targeting systems maintained by telecom companies to comply with lawful intercept obligations.

These systems can contain sensitive call records, communication metadata, and other information sought in intelligence operations.

This incident illustrates that effective containment planning must take physical infrastructure into account, rather than just focusing on endpoints and cloud services.

When an attacker misuses routing relationships or equipment managed across interconnected organizations, logical controls may not provide immediate assurance that access has been fully eliminated.

Defenders in the telecom and critical infrastructure sectors should prioritize the following:

• Continuous monitoring of router telemetry and any anomalous east-west traffic.
• Strict segmentation between partner, carrier, administrative, and lawful intercept environments.
• Rapid validation of third-party network trust relationships.
• Incident-response procedures that include onsite isolation options.
• Regular threat hunting to detect any persistent access after initial remediation.

For T-Mobile, a pair of scissors proved to be a powerful tool for control. For the telecom sector, this event serves as a reminder that sophisticated espionage operations can sometimes necessitate straightforward, immediate defensive actions: disconnect the adversary before they can exploit further.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC