Salt Typhoon

Overview

Salt Typhoon is one of the operationally significant Chinese state-sponsored threat actors ever documented. While the U.S. Treasury's January 2025 sanctions named Sichuan Juxinhe Network Technology Co. as directly involved, full public attribution to a specific MSS bureau or unit has not been declassified. The group's targeting profile, tooling, and operational patience align precisely with Chinese intelligence collection priorities — signals intelligence against U.S. government officials, law enforcement targets, and policy makers. The name "Salt Typhoon" was assigned by Microsoft; the U.S. government adopted the same designation in its official advisories. Other well-documented MSS-linked clusters operating in parallel include APT41 (Silver Dragon), which combines state espionage with financially motivated cybercrime, APT10 (Stone Panda), known for managed service provider supply chain intrusions, and Earth Lusca, which overlaps with Salt Typhoon's Southeast Asian targeting geography.

The group is distinguished by its focus on telecommunications infrastructure rather than end-user devices. By gaining persistent access to backbone networks that carry voice and data traffic, Salt Typhoon positioned itself to intercept communications at scale without ever touching the phones or computers of individual targets. The CALEA breach was particularly alarming: it gave the group access to the same systems U.S. law enforcement uses to conduct court-ordered wiretaps — meaning Salt Typhoon could read the list of who the FBI and DOJ were legally surveilling. Senator Maria Cantwell described it plainly: "These systems became an open door for Chinese intelligence."

Senator Mark Warner, chairman of the Senate Intelligence Committee, put the scale in perspective: "This is massive, and we have a particularly vulnerable system. Unlike some European countries where you might have a single telco, our networks are a hodgepodge of old networks." He warned that purging the hackers could require replacing "literally thousands and thousands and thousands of pieces of equipment across the country."

Cisco Talos confirmed in February 2025 that Salt Typhoon maintained access to at least one victim network for over three years before discovery. As of early 2026, the FBI has confirmed the group hacked at least 200 companies across 80+ countries, with 600+ organizations formally notified of potential compromise. The Cyber Safety Review Board, which was actively investigating the breach, was disbanded by the Trump administration in January 2025 before completing its work. CISA has since taken over the investigation. Salt Typhoon operates within a broader cluster of Chinese state-sponsored groups — including Volt Typhoon, which focuses on pre-positioning inside U.S. critical infrastructure for potential wartime disruption, and Storm-0558, which breached Microsoft Exchange to steal U.S. government emails. Understanding all three is essential to the full picture of China's cyber posture. Not sure which threat actors are targeting your sector? Use the NoHacky industry threat scanner to find out.

Campaign Timeline

Target Profile

Salt Typhoon focuses primarily on telecommunications infrastructure rather than end-user systems. The strategic value is access to communications at scale — intercepting traffic in transit rather than compromising individual endpoints. The August 2025 CISA advisory confirmed the group targets networks globally across sectors including "telecommunications, government, transportation, lodging and military infrastructure networks." Salt Typhoon is not the only threat actor with a fixation on telecoms: Scattered Spider has separately targeted carriers using social engineering and SIM-swapping, representing a completely different entry vector into the same high-value sector.

• Telecommunications carriers: Nine U.S. carriers confirmed, plus Canadian providers (confirmed February 2025), all four Singapore telecoms (breached by UNC3886, a related China-aligned APT cluster, confirmed February 2026), and providers in Norway, the United Kingdom, Italy, the Netherlands, Brazil, South Africa, Myanmar, and across Asia, Africa, and Europe. New Zealand confirmed Salt Typhoon activity spanning government, transportation, lodging, and military networks, not just telecoms. Cisco routers at universities in Argentina, Mexico, Bangladesh, Indonesia, Malaysia, and Thailand were targeted. The group targets network backbone infrastructure, routing equipment, and CALEA-compliant intercept systems. Early reporting also documented supply chain intrusion techniques including malicious payloads embedded in firmware updates and telecom equipment.
• Government and political targets: Communications of senior U.S. government officials accessed in real time. Confirmed targets included Donald Trump, JD Vance, and staff from the Kamala Harris 2024 presidential campaign. State Department officials were also targeted. U.S. House of Representatives committee systems were compromised in December 2025.
• Military and defense: A U.S. state Army National Guard network was compromised for nine months (March–December 2024). The CISA advisory explicitly names military infrastructure networks as targets, with analysts noting Salt Typhoon is pre-positioning to slow U.S. military mobilization in the event of conflict over Taiwan — a mission it shares with Volt Typhoon, whose destructive pre-positioning operations target a different layer of the same critical infrastructure.
• Satellite communications: Viasat breach confirmed in June 2025, extending reach beyond terrestrial networks through abuse of remote management links tied to ground infrastructure.
• Transportation and lodging: Confirmed in the August 2025 multi-agency advisory. ESET has documented prior Salt Typhoon intrusions at hotels and government agencies worldwide, providing intelligence on the movements of targets.
• Global scope: 200+ companies hacked across 80+ countries, with 600+ organizations formally notified by the FBI. Countries with confirmed or disclosed activity include Canada, the United Kingdom, Norway, the Netherlands, Italy, Brazil, South Africa, Myanmar, Bangladesh, Indonesia, Malaysia, Thailand, Argentina, Mexico, India, Taiwan, Philippines, Afghanistan, Eswatini, New Zealand, Japan, Australia, and others. Czech cybersecurity officials reported related incidents in Finland and Poland. Dutch authorities noted targeted smaller internet providers and web hosts via routers, though core internal networks were not compromised.

Tactics, Techniques & Procedures

Salt Typhoon's TTPs were formally documented in the August 2025 multi-agency advisory (CISA AA25-239A), co-signed by 25 agencies across allied nations. The group's operational signature is its patience: it prioritizes long-term undetected access over rapid exploitation, routinely maintaining footholds for years before detection. All technique IDs below link to NoHacky's MITRE ATT&CK reference library where available.

Known Campaigns

Tools & Malware

Salt Typhoon operates with an unusually broad malware arsenal — a mix of proprietary tools and payloads shared across Chinese APT groups via what Trend Micro assesses may be malware-as-a-service (MaaS) platforms. The group assigns different tools to different campaigns and regional targets, and its C2 infrastructure appears to be managed by separate teams, reflecting a high degree of organizational sophistication.

• GhostSpider: A highly modular, memory-resident backdoor first identified by Trend Micro in November 2024, used primarily in Southeast Asian telecom intrusions. Loaded via DLL hijacking and registered as a service using legitimate regsvr32.exe. Communicates with C2 servers by hiding instructions inside HTTP headers and cookies. Each functional module is deployed independently, meaning analysts observing one instance may see a completely different capability set from another. Designed for long-term espionage operations where stealth takes precedence over speed. Source: Trend Micro, November 2024.
• Demodex: A Windows kernel-mode rootkit named by Kaspersky Lab. Provides persistent, low-level access and uses advanced anti-forensic and anti-analysis techniques to remain undetected. Confirmed across multiple Salt Typhoon campaigns. Shared C2 infrastructure with SparrowDoor and CrowDoor has been observed, enabling Trend Micro to link campaigns attributed to Earth Estries/GhostEmperor/FamousSparrow with high confidence.
• SNAPPYBEE (Deed RAT): A modular backdoor shared across multiple Chinese APT groups — a hallmark of MaaS distribution, also used by Bronze Starlight and other clusters within the China-nexus ecosystem. Supports data exfiltration, system monitoring, credential theft via TrillClient stealer integration, and remote command execution. Deployed primarily in campaigns targeting Taiwanese government and chemical sector targets. Source: Trend Micro, November 2024.
• Masol RAT: A cross-platform backdoor first observed targeting Southeast Asian government Linux servers in 2020. Evolved over time to target multiple operating systems. Initially unattributed; Trend Micro confirmed Earth Estries deployment in 2024. Source: Trend Micro, November 2024.
• SparrowDoor: A modular backdoor providing remote access and C2 communication, used for lateral movement. Shared C2 infrastructure with Demodex and CrowDoor confirms it as part of the same cluster. Associated with early FamousSparrow intrusions at hotels and government networks.
• CrowDoor: A data exfiltration-focused malware identified in Trend Micro's Earth Estries research. Shares C2 infrastructure with SparrowDoor and Demodex.
• Custom IOS XE implants: Post-exploitation backdoors deployed following CVE-2023-20198 exploitation. Configured GRE tunnels to pull data through compromised routers. Designed to persist across reboots and evade standard network monitoring. Recorded Future documented 1,000+ compromised Cisco devices across six continents. For the latest Cisco-specific threat context, see Interlock's exploitation of the Cisco FMC zero-day — a different threat actor using the same device category as an attack surface.
• Living-off-the-land tooling: Extensive use of native binaries — WMIC.exe, PsExec, PowerShell — for lateral movement. NeoReGeorg tunneling tool, Cobalt Strike, and open-source reverse proxy frpc also confirmed. The preference for legitimate tools over custom malware significantly complicates detection within high-traffic carrier environments. Source: CISA AA25-239A, August 2025; SC Media, November 2024.

Analysts hunting for Salt Typhoon malware samples can use REMnux v8 with AI-assisted malware analysis to triage GhostSpider and Demodex artifacts — particularly useful given both tools' heavy use of obfuscation and anti-analysis techniques.

Mitigation & Defense

The August 2025 CISA Advisory AA25-239A — co-signed by 25 agencies across allied nations including Canada, the UK, Germany, and Japan — is the most comprehensive public guidance available. It covers indicators of compromise from August 2021 through June 2025, custom software documentation, and actionable threat hunting guidance. Notably, the FCC moved in November 2025 to reverse cybersecurity rules adopted specifically after Salt Typhoon was disclosed, making voluntary hardening measures more important than ever.

• Patch edge devices immediately: Cisco IOS XE, Ivanti Connect Secure, Fortinet, Sophos Firewall, and other network edge devices must be patched within 24–48 hours of disclosure. Investigators found carriers running equipment with patches available for seven years or more that had never been applied. Salt Typhoon exploits these gaps faster than defenders typically patch.
• Audit CALEA and lawful intercept systems: Organizations subject to CALEA compliance should conduct immediate audits of who has accessed intercept infrastructure and review access logs for anomalies dating back to 2019. Investigators found credential reuse across network appliances and absent multi-factor authentication on highly privileged accounts — basic failures that enabled the breach.
• Network segmentation: Enforce strict segmentation between management plane, data plane, and lawful intercept systems. CISA AA25-239A specifically warns that Salt Typhoon exploits flat network architectures and leverages trusted connections between carrier networks to pivot into additional victims.
• Encrypted communications: The FBI and CISA explicitly recommended end-to-end encrypted messaging apps — Signal, iMessage — for sensitive communications following the Salt Typhoon disclosure. This recommendation reflects the reality that carrier-level interception cannot be prevented at the device level without end-to-end encryption.
• Monitor for GRE tunnels and ACL modifications: Deploy behavioral monitoring on network infrastructure devices, not just endpoints. Look for GRE tunnel configurations not in your baseline, unexpected ACL modifications adding unknown IP addresses, unusual CLI activity, and anomalous outbound connections on non-standard ports. CISA AA25-239A contains specific threat hunting queries for Salt Typhoon indicators.
• Credential hygiene on network devices: Rotate all privileged credentials on network infrastructure. Eliminate credential reuse across appliances. Require MFA for all privileged network administrator accounts. Salt Typhoon maintains persistence through stolen admin credentials after initial exploitation.
• Memory-based implant detection: Standard disk-based antivirus will not detect GhostSpider, which resides solely in memory. Deploy EDR solutions capable of detecting in-memory implants and obfuscated payloads, DLL sideloading, and suspicious use of regsvr32.exe for service registration.

Sources & Further Reading

• NoHacky — Salt Typhoon: Inside the Worst Telecom Hack in U.S. History
• U.S. Department of the Treasury — Treasury Sanctions Company Associated with Salt Typhoon (January 17, 2025)
• CISA Advisory AA25-239A — Countering Chinese State-Sponsored Actors (August 27, 2025)
• CISA/FBI — People's Republic of China-Linked Actors Compromise Routers and IoT Devices (2024)
• Cisco Talos — Weathering the Storm: In the Midst of a Typhoon (February 20, 2025)
• Trend Micro — Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions (November 25, 2024)
• MITRE ATT&CK — Salt Typhoon, Group G1045
• U.S. Senate Commerce Committee — Experts Agree U.S. Communications Networks Remain Vulnerable (December 3, 2025)
• Nextgov/FCW — Salt Typhoon Hackers Targeted Over 80 Countries, FBI Says (August 27, 2025)
• Help Net Security — China-Linked Salt Typhoon Hackers Attempt to Infiltrate European Telco (October 20, 2025)
• TechCrunch — Salt Typhoon Is Hacking the World's Phone and Internet Giants (March 9, 2026)
• NJCCIC — Salt Typhoon Threat Analysis (New Jersey Cybersecurity and Communications Integration Cell)
• The Register — Singapore spent 11 months evicting suspected telco spies (UNC3886 / Operation Cyber Guardian) (February 10, 2026)
• TechCrunch — Singapore: China-backed hackers targeted country's largest phone companies (February 10, 2026)
• Cybersecurity Dive — Federal agencies abruptly pull out of RSAC after organizer hires Easterly (January 26, 2026)
• The Register — Private sector wants feds' help to tackle China's Typhoons (RSA 2026 panel recap) (March 23, 2026)