Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data

Salt Typhoon, a Chinese state-sponsored cyber threat group, has intensified long-term espionage operations against global telecommunications infrastructure, according to recent legal and intelligence reporting.

Aligned with the Ministry of State Security (MSS) and active since at least 2019, Salt Typhoon has exploited edge network devices to establish deep persistence and exfiltrate highly sensitive communications metadata, VoIP configurations, lawful intercept data, and subscriber profiles from major telecom providers and related critical infrastructure sectors worldwide.

Public indictments and intelligence advisories reveal Salt Typhoon maintains operational ties to i-SOON, which provides leased infrastructure, technical support, and domain registration pipelines to facilitate offensive cyber operations. The group’s targeting spans the United States, United Kingdom, Taiwan, and EU states, with breaches reported at over a dozen U.S. telecom firms and allied networks.

Salt Typhoon operates under the Typhoon taxonomy introduced by Microsoft, with tradecraft that includes bespoke malware, LOLBINs, and router implants to sustain access, and a pattern seen in domain registrations and SSL certificates used to blend into legitimate traffic.