Salt Typhoon telecommunications intrusions
Disclosed October to November 2024
In November 2024 the FBI and CISA said their investigation had revealed a broad and significant cyber espionage campaign by PRC-affiliated actors who had compromised networks at multiple telecommunications companies. A joint advisory in 2025 described these actors' targeting of backbone, provider-edge and customer-edge routers worldwide.
- Victim
- Multiple US and international telecommunications companies
- Sector
- Telecommunications
- Public attribution
- The FBI and CISA attributed the campaign to actors affiliated with the People's Republic of China; a 2025 joint advisory links the activity to groups including Salt Typhoon.Salt Typhoon profile
Impact
According to the FBI and CISA, theft of customer call records data, compromise of private communications of a limited number of people mainly involved in government or political activity, and copying of information subject to US law enforcement requests under court orders.
Root cause
Exploitation of network devices at the edge of telecom networks, where monitoring is often weaker than on endpoints.
Lessons learned: the controls it teaches
- Patch and harden network devices, and collect logs from them centrally.
- Treat lawful-intercept and other sensitive systems as high-value targets.
- Use end-to-end encrypted communications for sensitive conversations.