Your carrier’s routers belong in your threat model
A joint advisory described state actors working through network devices to get inside telecom and network service providers. For enterprises that buy those services, it meant treating the provider’s network as untrusted transport, its administrators as privileged users, and its silence as a monitoring gap.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On June 7, 2022, the NSA, CISA and the FBI published a joint cybersecurity advisory on People’s Republic of China state-sponsored cyber actors. It described how they had exploited publicly known flaws in network devices to compromise telecommunications companies and network service providers. The advisory listed commonly exploited flaws in products from several major networking vendors, and described the actors using compromised small office and home office routers and storage devices as relays to hide their activity. Once inside provider networks, the actors sought credentials and configurations that would give them broader access, and in some cases captured traffic. The recommended mitigations were familiar: patch promptly, replace end-of-life equipment, isolate management interfaces and require multi-factor authentication for administrators. The advisory did not disclose a new vulnerability. It described a strategy aimed at the companies that carry everyone else’s traffic.
Earlier in this series, the Cyclops Blink takedown showed that small edge devices are part of state-actor infrastructure. This advisory pointed one layer further out. The target was the provider: the carrier that runs a bank’s wide area network, the network service provider that connects a health system’s clinics, the managed service provider that operates an agency’s branch firewalls. Those organizations sit inside their customers’ trust boundaries by design. Private circuits are assumed private. Provider engineers have administrative access to customer equipment. And customers usually see little of what happens in the provider’s own network.
An attacker inside a provider inherits all three assumptions. That makes the provider a design consideration for every customer, not only a vendor risk questionnaire. We break the response into three layers: the transport the provider carries, the administrative access the provider holds, and the visibility the customer keeps for itself.
The transport: encrypt as if the circuit were public
Many regulated organizations still send sensitive traffic unencrypted over private circuits such as MPLS networks, on the reasonable assumption that the carrier separates customers from each other. That separation is a routing property, not a cryptographic one. If an attacker controls provider routers, traffic on those circuits can be copied or redirected.
The architectural answer is to treat every provider link as untrusted and encrypt end to end, between sites and between applications. Practical options include IPsec or encrypted SD-WAN tunnels between branch and data center, TLS for application traffic even inside the corporate network, and encrypted replication for storage and backups. Most of this is available in equipment organizations already own. The costs are real but manageable: some throughput overhead, key and certificate management, and troubleshooting that becomes harder when packet contents are no longer visible on the wire.
Sequencing helps. Start with the flows that would do the most harm if copied: payment and core banking traffic, clinical data moving between hospitals and clinics, case records moving between agency offices, and replication to backup sites. Then cover administrative protocols, which carry credentials. Internal traffic with little sensitivity can follow later. A simple register of which links are encrypted, and with what, gives auditors and the board a clear measure of progress.
Voice and messaging deserve their own line. Calls and text messages carried by carriers are not end-to-end encrypted by default. Executives and staff who handle sensitive matters should use approved, encrypted communication tools, and policies should say which tools are approved for which conversations. Financial institutions must still capture business communications under recordkeeping rules, which shapes which encrypted tools they can approve.
The administrator: provider access is privileged access
Managed network and security services work because provider staff can log in to customer devices. That access is usually broad, persistent and governed by the provider’s own tools and controls. An attacker who compromises the provider’s management systems can reach every customer’s devices at once.
Customers should govern provider access the way they govern their own administrators. Contracts can require multi-factor authentication for every provider login to customer equipment, unique named accounts rather than shared credentials, access only from defined management networks, and session logging that the customer can review. They can require notice within a set time of any compromise of the provider’s management environment, whether or not the provider believes customer systems were touched.
Where possible, access should be brokered through a customer-controlled jump host or privileged access tool. That adds friction for the provider’s engineers, and some providers will price it accordingly. It also means a provider-side compromise does not automatically become a customer-side compromise. For the most critical devices, such as core firewalls and data center routers, some organizations keep administration in house and buy only monitoring from the provider.
The view: keep your own eyes on the boundary
Customers of managed network services often rely on the provider for monitoring as well as operation. If the provider’s environment is compromised, its monitoring is the least reliable source of truth.
Independent visibility does not require duplicating the provider’s operations center. It requires sending logs from customer-premises equipment to the customer’s own security platform: configuration changes, administrative logins, firmware changes and routing changes. It requires a baseline of normal traffic patterns at key boundaries, so that new destinations or unusual volumes stand out. And it requires periodic verification that device configurations match what the customer expects, compared against a stored known-good copy.
This layer also covers the edge devices the advisory listed. Organizations should know which of their own routers, VPN gateways and storage appliances are internet-facing, keep them supported, and retire end-of-life units. A compromised customer device is both a door into the customer and a relay for attacks on others.
The three layers reinforce each other. Encryption limits what a compromised carrier can read. Governed access limits what a compromised manager can change. Independent monitoring shortens how long either goes unnoticed. An organization that has only one of the three is betting that the provider is never the target, and the advisory said plainly that it already was.
One more preparation is worth making: an incident playbook for provider compromise. It should cover how to cut off provider access quickly and who can take over device administration. It should also say where current configurations are stored and how to reach the provider’s security team outside the normal support line. Rehearsing it once, in a tabletop with the provider present, usually exposes gaps in both organizations.
With hindsight
The advisory proved to be an early chapter. In 2023, Microsoft and U.S. agencies described another China-linked group, widely called Volt Typhoon, using compromised small office routers to reach critical infrastructure. In January 2024 the Justice Department announced a court-authorized operation to disrupt a botnet of such routers. Reporting from late 2024 described extensive intrusions into U.S. telecommunications providers by a group often called Salt Typhoon, including access to systems used for lawful intercept. In December 2024, CISA and partner agencies issued hardening guidance for communications infrastructure and urged highly targeted individuals to use end-to-end encrypted communications. By 2026, the idea that a carrier’s network should be treated as untrusted transport is mainstream guidance rather than a specialist view. Many organizations still run unencrypted traffic over private circuits, and provider access governance remains uneven.