U.S. government officials said Tuesday that the China-backed hacking group dubbed Salt Typhoon are still inside some of the networks of America’s largest phone and internet providers, weeks after the long-running hacking campaign first came to light.

Cybersecurity agency CISA said the affected telecom giants are still trying to evict the hackers, in part because it’s unclear what the hackers are aiming to accomplish.

Word first broke in October that Salt Typhoon was reportedly in the networks of AT&T, Verizon, and Lumen (formerly CenturyLink), among others. T-Mobile said it was targeted but largely rebuffed the attackers. It’s thought the industry-wide hacks may be China trying to spy, as the hackers were found targeting the communications of U.S. officials and senior Americans, including presidential candidates, but also accessing wiretap systems that might identify Chinese individuals under U.S. surveillance.

The U.S. government also provided guidance for telecom networks on how to harden their networks from the China-backed hackers, noting that each victim company’s remediation efforts will be unique.