The quiet entry and very long breach window without detection does definitely point to nation-state hackers. The list of Ribbon Communications clients certainly raises serious concerns about the security breach, when one sees not just Verizon present but also the U.S. Defense Department, Softbank and City of Los Angeles among others.
Despite reports of exploitation of Cisco bugs, researchers found that only one known published vulnerability was used in a compromise. For the most part, the Salt Typhoon hackers were able to obtain valid login credentials from somewhere.
Add Charter Communications, Consolidated Communications and Windstream to the list of US telecom companies compromised by the Salt Typhoon hacking campaign.
The group seemed to have a specific priority goal for the US telecoms: accessing a federal wiretap system used for legally ordered surveillance of criminal suspects, a type of intel that Chinese hackers have targeted before.