Article
Salt Typhoon: what telecom customers should do
Salt Typhoon breached telecom networks through known flaws. What customers and CISOs should ask carriers and check on their own routers and edge devices.
Read more
Significant cyber incident
Salt Typhoon telecom intrusions
From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries.
In short
From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries. The US government first said publicly on 25 October 2024 that it was investigating. The FBI and CISA said the actors stole customer call records and copied some information tied to court-ordered law enforcement requests. Telecom networks carry the data that shows who talks to whom, and where people are.
What happened
On 25 October 2024 the US government said it was investigating unauthorized access to commercial telecom networks by actors linked to China. On 13 November 2024 the FBI and CISA said these actors had compromised multiple telecom companies. They stole customer call records, compromised the private communications of a limited number of people mainly in government or political activity, and copied some information tied to court-ordered law enforcement requests.
Later government reports widened the picture. The FCC cited a US agency confirming that at least eight US communications companies were infiltrated. Canada reported three devices of a Canadian telecom compromised in mid-February 2025. In August 2025 the US, UK and other governments published an advisory saying the activity covered telecom, government, transportation, lodging and military networks in many countries.
The advisory links the activity to three China-based companies that sell services to Chinese intelligence services. Sources differ on the start: Treasury says Salt Typhoon has been active since at least 2019, and the August 2025 advisory says operations began at least in 2021.
Timeline
-
2019
Treasury later says Salt Typhoon has been active since at least 2019
-
2021
The August 2025 advisory says the actors have run operations globally since at least 2021
-
25 October 2024
The US government says it is investigating unauthorized access to telecom networks by actors linked to the PRC
-
13 November 2024
FBI and CISA describe a broad cyber espionage campaign that included theft of call records
-
4 December 2024
CISA, NSA, FBI and partners publish hardening guidance for communications infrastructure; the FCC cites a US agency confirming at least eight US communications companies were infiltrated
-
15 January 2025
The FCC adopts a Declaratory Ruling on carrier network security, released 16 January
-
17 January 2025
US Treasury sanctions Sichuan Juxinhe Network Technology Co., LTD.
-
Mid-February 2025
Three devices of a Canadian telecom company are compromised, per the Canadian Cyber Centre
-
24 April 2025
FBI asks the public for tips on Salt Typhoon and notes a State Department reward of up to $10 million
-
19 June 2025
Canadian Cyber Centre and the FBI warn about Salt Typhoon targeting Canadian telecoms
-
27 August 2025
UK NCSC and partners publish an advisory linking three China-based companies to the campaign (AA25-239A)
-
21 November 2025
The FCC releases an order rescinding its January 2025 ruling and withdrawing the related proposed rules
How the attack worked
Getting in
The advisory says the actors had considerable success exploiting publicly known vulnerabilities in internet-facing devices (Exploit Public-Facing Application, T1190). It says no zero-day exploitation was seen. Example flaws include CVE-2024-21887 and CVE-2024-3400 in VPN and firewall gateway software, CVE-2023-20198 and CVE-2023-20273 in a router operating system, and CVE-2018-0171 in a router’s smart install remote code execution feature. The router flaws were commonly chained to get code execution as root (Exploitation for Privilege Escalation, T1068). Using CVE-2023-20198, the actors bypassed authentication and created unauthorized administrative accounts.
Infrastructure and pivoting
The actors used virtual private servers (Acquire Infrastructure: Virtual Private Server, T1583.003) and compromised intermediate routers (Compromise Infrastructure: Network Devices, T1584.008). They used compromised devices and trusted or private links between providers and customers to move into other networks (Trusted Relationship, T1199).
Staying in
The actors modified routers to keep long-term access. They changed access control lists to allow their own IP addresses (Impair Defenses: Disable or Modify System Firewall, T1686). They enabled SSH servers and opened external-facing ports on network devices (Remote Services: SSH, T1021.004). On some network devices they ran commands in an on-box Linux container, where activity is not closely monitored (Deploy Container, T1610).
Collecting data
The actors targeted authentication systems such as TACACS+ and passively collected packet captures from specific ISP customer networks (Network Sniffing, T1040). They changed a router’s TACACS+ server setting to point to an actor-controlled address (Modify Authentication Process, T1556). They also modified routing, turned on traffic mirroring and set up GRE and IPsec tunnels.
Hiding and sending data out
The actors deleted or cleared logs and turned off logging (Indicator Removal, T1070). They abused peering connections (Network Boundary Bridging, T1599) and often used IPsec and GRE tunnels for command and control and data theft (Exfiltration Over Unencrypted Non-C2 Protocol, T1048.003). In at least one case they used GRE and MPLS tunnels to move data back to China.
ATT&CK techniques
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique Exploitation for Privilege Escalation Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with. T1068 · Privilege Escalation
- Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
Who says who was behind it
Attributed by the FBI and CISA, 25 October 2024 and 13 November 2024: actors affiliated with the People's Republic of China (PRC).
Attributed by the US Treasury, 17 January 2025: Sichuan Juxinhe Network Technology Co., LTD. had direct involvement in Salt Typhoon intrusions, and the PRC Ministry of State Security has strong ties with it.
Attributed by the UK NCSC and 12 partner countries, advisory AA25-239A, 27 August 2025: activity linked to at least three China-based companies (Sichuan Juxinhe Network Technology Co. Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., Sichuan Zhixin Ruijie Network Technology Co., Ltd.) that provide services to Chinese intelligence services, including units of the People's Liberation Army and the Ministry of State Security.
Attributed by the Canadian Cyber Centre, 19 June 2025: the Cyber Centre and the FBI warned of a PRC state-sponsored actor tracked in industry reporting as Salt Typhoon.
Sources differ on the start date: Treasury says active since at least 2019, the advisory says since at least 2021.
The UK NCSC says the advisory only partially overlaps with campaigns the security industry reports as Salt Typhoon. The advisory authors say they do not adopt a commercial naming convention.
Impact
FBI and CISA (13 November 2024): networks of multiple telecom companies compromised; customer call records stolen; private communications of a limited number of people, mainly in government or political activity, compromised; some information tied to court-ordered law enforcement requests copied.
FCC fact sheet (December 2024): a US agency confirmed at least eight US communications companies were infiltrated, in a campaign described as affecting dozens of countries.
Treasury (17 January 2025): multiple major US telecom and internet service providers had network infrastructure compromised.
Canadian Cyber Centre (19 June 2025): three devices of a Canadian telecom were compromised in mid-February 2025; the actors used one flaw to read configuration files and set up a tunnel to collect traffic.
Advisory AA25-239A (August 2025): the cluster was seen in the US, Australia, Canada, New Zealand, the UK and elsewhere. Stolen data can let Chinese intelligence services identify and track targets' communications and movements.
No source opened gives a total count of victims or of affected customers.
Government and regulator response
- 25 October 2024: FBI and CISA announced an investigation, notified affected companies and shared information with other possible victims.
- 13 November 2024: FBI and CISA described the campaign and said they expected their understanding to grow.
- 4 December 2024: CISA, NSA, FBI and agencies from Australia, Canada and New Zealand published hardening guidance for communications infrastructure.
- 15-16 January 2025: the FCC adopted and released a Declaratory Ruling that said carriers’ duties under CALEA section 105 cover how they manage their networks.
- 17 January 2025: the US Treasury sanctioned Sichuan Juxinhe Network Technology Co., LTD.
- 24 April 2025: the FBI asked the public for tips and pointed to a State Department Rewards for Justice offer of up to $10 million.
- 19 June 2025: the Canadian Cyber Centre and the FBI warned Canadians about Salt Typhoon.
- 27 August 2025: the UK NCSC and partners from 12 other countries published advisory AA25-239A and named three China-based companies.
- 21 November 2025: the FCC released an order rescinding the January 2025 ruling and withdrawing the related proposed rules.
Lessons
-
Known flaws, not zero-days, did the work
The UK NCSC says the actors succeeded with known vulnerabilities rather than bespoke malware or zero-days, so timely patching could have avoided attacks. The advisory also says no zero-day exploitation was seen.
-
Edge devices are the front door
The advisory lists flaws in VPN gateways, firewalls and routers as the usual way in. Devices at the network edge need the fastest patch cycle.
-
Network gear can be a hiding place
The actors ran commands in a Linux container on network devices, where activity is not closely monitored, and cleared or turned off logs. Routers need logging and checks like servers do.
-
Trust links carry risk
The actors used trusted links between providers and customers, and peering links, to move on and send data out. Your partners' networks are part of your attack surface.
-
Authentication traffic is a prize
The actors captured TACACS+ traffic and changed router authentication settings to point to their own address. Admin logins to network gear need the same care as server logins.
-
Look for the full scope before evicting
The advisory warns that if the full scope is not found and fixed, the actors may keep access and cause more harm.
What to check in your own organization
-
Patch the listed flaws
Check that your edge and network devices are fixed for CVE-2024-21887, CVE-2024-3400, CVE-2023-20198, CVE-2023-20273 and CVE-2018-0171, and that none is exposed unpatched to the internet.
-
Review router and firewall settings
Look for unexpected GRE or other tunnels, external IP addresses in access control lists, and unexpected packet capture or traffic mirroring settings.
-
Check authentication servers on devices
Confirm the TACACS+ or RADIUS servers set on each router are the ones you own. The advisory lists unexpected external addresses as a warning sign.
-
Find odd remote access ports
Look for SSH or web management on non-default high ports and for new local admin accounts on network devices.
-
Look for containers on network gear
Where you do not expect virtual containers on routers or switches, check whether any are running and what commands run inside.
-
Keep configurations and logs off the device
Store device configurations centrally, compare them to what is running, and send logs to a central place that an attacker on the device cannot clear.
-
Lock down management access
Limit management traffic to a separate management network or dedicated admin systems, and block outbound connections from management interfaces.
Where it happened
- Country Canada Canada faces state espionage, ransomware against hospitals, governments and critical infrastructure, and pro-Russia denial of service campaigns. North America
- Industry Telecommunications State-sponsored intrusions, subscriber data theft, SIM swapping and account takeover at telecom providers, and the rules that apply.
- Country United Kingdom The United Kingdom faces cyber threats from states and from ransomware crews. Europe
- Country United States This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America
Questions
What is Salt Typhoon?
It is the name commonly used for the China-linked actors behind intrusions into telecom and other networks. The August 2025 advisory authors say they do not adopt a commercial name, and the UK NCSC says their advisory only partly overlaps with what industry calls Salt Typhoon.
When did the public first hear of it?
The US government first said publicly on 25 October 2024 that it was investigating unauthorized access to telecom networks by actors affiliated with China. A fuller statement followed on 13 November 2024.
What was taken?
FBI and CISA said customer call records were stolen, private communications of a limited number of people mainly in government or political activity were compromised, and some information tied to court-ordered law enforcement requests was copied.
How did the attackers get in?
The advisory says they exploited publicly known vulnerabilities in network edge devices, listed in the advisory by CVE number. No zero-day exploitation was observed.
Who has been named?
The US Treasury sanctioned Sichuan Juxinhe Network Technology Co., LTD. on 17 January 2025. The August 2025 advisory names three China-based companies, including that one, that provide services to Chinese intelligence services.
Was this only a US problem?
No. The advisory says the activity was seen in the US, Australia, Canada, New Zealand, the UK and elsewhere. Canada reported three compromised devices at a Canadian telecom in mid-February 2025.
In our research
- Salt Typhoon: what telecom customers should do October 2026
- Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using June 2026
- Telecommunications Industry
- Salt Typhoon Threat group
Sources
- Joint Statement by FBI and CISA on PRC Activity Targeting Telecommunications CISA
- Joint Statement from FBI and CISA on the People's Republic of China (PRC) Targeting of Commercial Telecommunications Infrastructure CISA
- Enhanced Visibility and Hardening Guidance for Communications Infrastructure CISA
- Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (AA25-239A) CISA, NSA, FBI and partners
- Fact Sheet: Implications of Salt Typhoon Attack and FCC Response Federal Communications Commission
- Declaratory Ruling and Notice of Proposed Rulemaking, FCC 25-9 Federal Communications Commission
- Order on Reconsideration, FCC 25-81 Federal Communications Commission
- Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise U.S. Department of the Treasury
- FBI Seeking Tips about PRC-Targeting of US Telecommunications FBI Internet Crime Complaint Center
- Cyber threat bulletin: PRC cyber actors target telecommunications companies as part of a global cyberespionage campaign Canadian Centre for Cyber Security
- UK and allies expose China-based technology companies for enabling global cyber campaign against critical networks UK National Cyber Security Centre
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.