The stakes for secure communication have reached an unprecedented high. A stark reminder of this came in the final days of 2024, when a White House press briefing revealed that Chinese linked cyber threat actor Salt Typhoon had successfully breached a ninth U.S. telecommunications company and many more around the globe. Collectively, the threat actor used these breaches to access sensitive phone calls and text messages of specific targets, and the metadata of millions of users.
Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technology, highlighted some glaring security vulnerabilities across telecom networks. “As we look at China’s compromise of now nine telecom companies, the first step is creating a defensible infrastructure. We wouldn’t leave our homes, our offices unlocked, and yet our critical infrastructure — the private companies owning and operating our critical infrastructure — often do not have the basic cybersecurity practices in place that would make our infrastructure riskier, costlier, and harder for countries and criminals to attack.”
She emphasized issues like weak configuration management, inadequate network segmentation, and general cybersecurity complacency as enabling Salt Typhoon's success. If this is the type of environment your data must traverse, how can you protect it? Your organization must make secure communications part of a holistic cyber defense strategy.
Communications Infrastructure as the New Attack Surface
For years, cyberattacks largely focused on infiltrating individual devices using malware or phishing attacks. However, that paradigm is evolving, and cyber adversaries are refocusing their efforts on communication infrastructure itself. Targeting telecom networks or internet service providers (ISPs) allows attackers to bypass device-level protections and these infrastructure attacks are more dangerous to organizations and governments because they grant access to the vast troves of data contained in these interconnected systems.
This trend paints a clear warning for governments, telecom companies, and enterprise organizations alike.
The Hidden Risks of Consumer Communication Tools
While telecom providers are working to secure their infrastructure, individuals and organizations face additional risks from widespread consumer-grade communication tools like WhatsApp, Signal, and others. While these platforms are often touted for their end-to-end encryption and ease of use, you should be aware of the hidden vulnerabilities in many “free” communication apps.
As we know all too well from social media platforms, if it’s free, you’re the product. Your data becomes an asset that can be sold, shared, or exploited. And recently, cyber threat groups like APT41 have exploited vulnerabilities in such apps, using campaigns like LightSpy malware to infiltrate even seemingly secure systems.
Many enterprise teams also operate under the mistaken belief that consumer-grade platforms are secure enough for sensitive conversations simply because of their popularity or perceived encryption standards. But when used without security oversight or additional controls, these tools can compromise critical business operations and personal privacy.
The assumption of security is dangerous, especially as attackers increasingly target metadata to weaponize insights about individuals and organizations.
