Chinese actors breach eight US telecom providers via Salt Typhoon
Chinese state-backed actors compromised at least eight US telecommunications providers over months, targeting political candidates, law enforcement wiretap systems, and critical infrastructure backbone.
Salt Typhoon represents a months-long espionage campaign attributed to Chinese state cyber actors, likely the Ministry of State Security or People's Liberation Army, that breached at least eight major US telecommunications providers including Lumen, Charter, Verizon, and AT&T. The adversary gained access to sensitive government and military personnel communications, compromised the Communications Assistance for Law Enforcement Act (CALEA) wiretap request system used by the US Department of Justice for national security cases, and targeted senior Democratic and Republican campaign officials and candidates. The campaign exploited well-understood technical debt within the telecommunications sector, including legacy systems, inadequate monitoring, vulnerable edge devices, and configuration weaknesses that had accumulated through industry acquisitions and the layering of older, less secure technologies alongside newer systems.
The breach demonstrates that US telecommunications networks—critical infrastructure relied upon by hundreds of millions of Americans—were not adequately defended against modern threats. Attribution to Chinese state actors aligns with previous reporting of Chinese targeting of US telecom systems dating to at least 2018 and concerns raised in the Huawei security debate. The incident was initially disclosed through leaks and press releases rather than formal government announcement, and CISA's chief mitigation guidance—recommending high-profile individuals shift to end-to-end encrypted communications—reflects the depth of the compromise and difficulty of remediating vulnerabilities in legacy network infrastructure. The campaign did not involve service disruption or destruction, focusing instead on intelligence collection and counterintelligence activities.
Mentioned in this report
Detection guidance
VNC Server Process Execution with Suspicious Parent
Detects execution of VNC server processes (vncserver.exe, tvnserver.exe, ultravnc_service.exe) from unusual parents - common in lateral movement post-compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VNC Server Process Execution with Suspicious Parent
description: Detects VNC server executable execution spawned from non-standard parents
(cmd, powershell, services.exe, svchost). Attackers enable VNC for persistent remote
access after breaching edge devices and legacy systems.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
category: process_creation
product: windows
detection:
selection_vnc_image:
Image|endswith:
- \vncserver.exe
- \tvnserver.exe
- \ultravnc_service.exe
- \winvnc.exe
selection_parent:
ParentImage|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \services.exe
- \svchost.exe
filter_legitimate:
CommandLine|contains:
- -installservice
- /install
condition: selection_vnc_image and selection_parent and not filter_legitimate
falsepositives:
- VNC deployment scripts from legitimate remote management tools
- System administrators manually starting VNC services from command line in controlled
environments
level: high
id: 0b485bfb-a84a-576b-95d2-22e0de3f4600
status: experimental
author: Vorant
Windows Remote Management (WinRM) Service Activation
Detects enabling of WinRM service via winrm.cmd or powershell enable-psremoting - used for lateral movement on compromised infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Remote Management Service Activation
description: Detects WinRM service enablement via winrm.cmd quickconfig or Enable-PSRemoting
cmdlet. Attackers enable WinRM for persistent remote management access after compromising
edge devices and legacy network infrastructure.
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
category: process_creation
product: windows
detection:
selection_winrm_cmd:
Image|endswith: \winrm.cmd
CommandLine|contains: quickconfig
selection_ps_enable:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains: Enable-PSRemoting
condition: selection_winrm_cmd or selection_ps_enable
falsepositives:
- Legitimate system administration tasks enabling remote management
- Automated compliance configuration in managed enterprise environments
level: medium
id: cfae035a-38b3-5582-b1cb-ec17c2ad6bf9
status: experimental
author: Vorant
Screen Capture Activity via Built-in Windows Tools
Detects screen capture via rundll32 calling screensaver DLL or command-line screenshot utilities - intelligence collection post-compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Screen Capture Activity via Built-in Windows Tools
description: Detects screen capture activity using rundll32 with User32.dll DLL export
or command-line screenshot utilities (screenshot.exe, ss.exe). Attackers perform
screen capture for intelligence collection and exfiltration of sensitive communications
data.
tags:
- attack.collection
- attack.t1113
logsource:
category: process_creation
product: windows
detection:
selection_rundll_capture:
Image|endswith: \rundll32.exe
CommandLine|contains|all:
- User32.dll
- LockWorkStation
selection_screenshot_tool:
Image|endswith:
- \screenshot.exe
- \ss.exe
- \nircmd.exe
CommandLine|contains: screenshot
condition: selection_rundll_capture or selection_screenshot_tool
falsepositives:
- Legitimate remote support tools using screen capture functionality
- Accessibility and diagnostics utilities capturing screen for troubleshooting
level: medium
id: b0d92520-533f-5d47-8e04-6993e0193ea1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.atlanticcouncil.org/content-series/cybersecurity-policy-and-strategy/the-eight-body-problem-exploring-the-implications-of-salt-typhoon
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free