T-Mobile has joined the growing list of US telecom operators who have been breached by Salt Typhoon. The company confirmed in a statement to the Wall Street Journal that while a breach had occurred, there was no evidence to suggest the attackers had accessed or exfiltrated any customer data.

The second infection sequence, in contrast, is a lot more sophisticated, with the threat actors abusing susceptible Microsoft Exchange servers to implant the China Chopper web shell, which is then used to deliver Cobalt Strike, Zingdoor, and Snappybee (aka Deed RAT), a suspected successor to the ShadowPad malware.

T-Mobile, one of America's largest wireless carriers, has confirmed it was compromised in a recent wave of sophisticated cyberattacks targeting U.S. telecom companies.