Customers of the affected carriers should assume call records may have been exposed, and should ask two questions: has our carrier checked its routers, and have we checked ours? Government agencies said the Salt Typhoon campaign compromised multiple telecom networks, and the UK NCSC said the actors used known vulnerabilities, not zero-days.
What happened in the Salt Typhoon telecom hacks?
On 25 October 2024 the US government said it was investigating unauthorized access to commercial telecom infrastructure by actors affiliated with the People’s Republic of China. On 13 November 2024 the FBI and CISA described a broad and significant cyber espionage campaign. The goals included theft of customer call records.
A limited number of people, mainly in government or political activity, had private communications compromised. Some information tied to US law enforcement requests under court orders was also copied. An FCC fact sheet says a US security agency confirmed on 4 December 2024 that foreign state-sponsored actors infiltrated at least eight US communications companies, and calls it a massive espionage campaign affecting dozens of countries.
Our Salt Typhoon incident page holds the full timeline and sources. This post covers what a buyer can do with it.
Who says the campaign is state-backed?
The attribution comes from several governments, not from one source. The FBI and CISA attributed the activity to actors affiliated with the PRC. On 17 January 2025 the US Treasury sanctioned Sichuan Juxinhe Network Technology Co., LTD., saying it had direct involvement in Salt Typhoon. Treasury also said the Ministry of State Security has strong ties with several computer network exploitation companies, including that one.
On 27 August 2025 the UK NCSC and partners from twelve other countries published an advisory linking three China-based companies to the campaign. The advisory says these companies provide products and services to China’s intelligence services, including units of the People’s Liberation Army and the Ministry of State Security. Sources differ on the start date: Treasury says active since at least 2019, the advisory says operations since at least 2021.
Why did known flaws matter more than new malware?
The UK NCSC said the actors succeeded using known vulnerabilities rather than bespoke malware or zero-days. The advisory AA25-239A says initial access came from publicly known CVEs and that zero-day exploitation has not been observed. The advisory’s examples include CVE-2024-21887, CVE-2024-3400, CVE-2023-20198, CVE-2023-20273 and CVE-2018-0171. The first two are VPN gateway flaws, and the last three affect router software.
The Canadian Cyber Centre reported that three network devices of a Canadian telecom company were compromised in mid-February 2025. The actors used CVE-2023-20198 to read configuration files and then changed one to set up a GRE tunnel that collected traffic from the network. The advisory adds that with the same flaw they used web management endpoints to bypass authentication and create unauthorized administrative accounts.
Where could the attack have been caught?
The advisory says the actors focus on backbone routers of major telecoms, plus provider edge and customer edge routers, and that they often modify routers to keep long-term access. Each change below is a place where a configuration comparison or a log review could raise an alert.
- Entry through a known flawPublic-facing device with a listed CVETechnique T1190 (MITRE ATT&CK, opens in a new tab)
- New admin accountsAuthentication bypass, then unauthorized administrative accounts
- Access list changesRules allowing actor-controlled IP addressesTechnique T1686 (MITRE ATT&CK, opens in a new tab)
- Authentication server changeTACACS+ server setting pointed to an actor-controlled IPTechnique T1556 (MITRE ATT&CK, opens in a new tab)
- Log removalLogs deleted or cleared, logging turned offTechnique T1070 (MITRE ATT&CK, opens in a new tab)
- Data leaves in tunnelsGRE and IPsec tunnels for control and exfiltrationTechnique T1048.003 (MITRE ATT&CK, opens in a new tab)
The advisory also says the actors set up GRE and IPsec tunnels and static routes, enabled traffic mirroring, enabled SSH servers and opened external-facing ports. On network devices they ran commands in an on-box Linux container, which is not closely monitored. In at least one instance they used GRE and MPLS tunnels to move data back to China.
What should a customer ask a carrier, and check at home?
Start with the carrier. The December 2024 CISA guide for communications infrastructure advises checking for configuration changes on switches, routers and firewalls made outside the change management process. A fair question is whether your carrier does that check and how often. Your own team can then run the same checks on the gear you operate.
- List every edge and network deviceShow its patch level and whether any advisory CVE is still open.
- Compare running and approved configurationLook for tunnels, external IPs in access lists and traffic mirroring.
- Check each TACACS+ server settingConfirm the address is one you own.
- Look for new remote accessSSH servers enabled and external-facing ports opened on devices.
- Look for containers on network gearCheck what runs inside, since activity there is not closely monitored.
- Keep logs where the device cannot clear themThe actors deleted logs and turned off logging.
The advisory also recommends isolating the management plane in an out-of-band network or management VRF. If you do find a compromise, it says to establish the full scope before evicting the actors, because they may otherwise keep access.
Can customers count on rules to protect them?
The FCC adopted a Declaratory Ruling on 15 January 2025, released on 16 January, saying carriers’ CALEA section 105 duties cover how they manage their networks, not only the equipment. On 21 November 2025 the FCC released an order, adopted on 20 November, rescinding that ruling and withdrawing the accompanying rulemaking.
So ask which network security commitments are written into your contract. The Canadian Cyber Centre also said the targeting is broader than just the telecommunications sector, and that the actors will almost certainly keep targeting Canadian organizations over the next two years. The advisory lists government, transportation, lodging and military networks as well as telecoms.
Related reading: the F5 breach and the cyber incidents of 2026.