Operation Soft Cell

Operation Soft Cell is a long-running cyber espionage campaign attributed to a Chinese threat actor, likely state-sponsored. The operation targets telecommunications providers globally and has been particularly active in the Middle East. The activity was first reported by cybersecurity firm Cybereason in June 2019, but according to their analysis, these malicious activities have been ongoing since at least 2012. The intrusion set shares tooling overlaps with other Chinese-aligned hacking efforts such as those tracked by Microsoft as Gallium and APT41. In March, SentinelLabs published an in-depth analysis of Operation Soft Cell, revealing its expansive reach over more than a decade. The operation has been linked to various Chinese hacking efforts focused on telecom targets worldwide. However, despite the similarities, conclusive attribution to a specific group or entity remains challenging, as noted by both Sentinel Labs and QGroup researchers. As of 2023, a Chinese cyber-espionage actor connected with Operation Soft Cell has continued to target Middle East telecom providers. This persistent targeting indicates the strategic value these entities hold for the threat actors. Overall, Operation Soft Cell represents a significant and ongoing threat to global telecommunications infrastructure, highlighting the need for robust cybersecurity measures within this sector.