Chinese actors breach eight US telecom providers via Salt Typhoon
Chinese state-backed actors compromised at least eight US telecommunications providers over months, targeting political candidates, law enforcement wiretap systems, and critical infrastructure backbone.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Salt Typhoon represents a months-long espionage campaign attributed to Chinese state cyber actors, likely the Ministry of State Security or People's Liberation Army, that breached at least eight major US telecommunications providers including Lumen, Charter, Verizon, and AT&T. The adversary gained access to sensitive government and military personnel communications, compromised the Communications Assistance for Law Enforcement Act (CALEA) wiretap request system used by the US Department of Justice for national security cases, and targeted senior Democratic and Republican campaign officials and candidates. The campaign exploited well-understood technical debt within the telecommunications sector, including legacy systems, inadequate monitoring, vulnerable edge devices, and configuration weaknesses that had accumulated through industry acquisitions and the layering of older, less secure technologies alongside newer systems.
The breach demonstrates that US telecommunications networks—critical infrastructure relied upon by hundreds of millions of Americans—were not adequately defended against modern threats. Attribution to Chinese state actors aligns with previous reporting of Chinese targeting of US telecom systems dating to at least 2018 and concerns raised in the Huawei security debate. The incident was initially disclosed through leaks and press releases rather than formal government announcement, and CISA's chief mitigation guidance—recommending high-profile individuals shift to end-to-end encrypted communications—reflects the depth of the compromise and difficulty of remediating vulnerabilities in legacy network infrastructure. The campaign did not involve service disruption or destruction, focusing instead on intelligence collection and counterintelligence activities.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/content-series/cybersecurity-policy-and-strategy/the-eight-body-problem-exploring-the-implications-of-salt-typhoon
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs