Summary Bullets:

• In a published blog, Lumen says its Black Lotus Labs has identified an active exploitation of a zero-day vulnerability in its Versa Director servers, which orchestrate its SD-WAN network services.

• Though the company, attributing the attack to threat actors Volt Typhoon backed by China, didn’t specify which of its clients would have been affected, others suggest the attack may have penetrated the infrastructure supporting sensitive government wiretapping communications.

Reports circulated this summer that state-sponsored cybercriminals connected to China hacked into US federal government resources via major telecom providers’ networks. Last week, it was revealed by several journalism sources including the Wall Street Journal that the target of the activity was federal government communications related to court-ordered network wiretapping applications that the hackers accessed through AT&T, Lumen, and Verizon’s networks. Though no one with direct knowledge of the situation was named, anonymous sources say the threat actors could have been tapped into the networks months ago.