Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat

Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat charts a state-directed cyber espionage program that targets global telecommunications and defence-adjacent networks, with activity traced back to 2019 and continuing through 2025. The operation blends MSS tasking with a contractor ecosystem, leveraging front companies and pseudo-private firms such as i-SOON to provide domain registration, infrastructure, and tooling at scale.

Salt Typhoon’s infrastructure extends to at least 45 registered domains from 2020 to 2025, three known contractor linkages, and a pattern of ProtonMail-based Whois records and fabricated U.S. personas to blend into domestic traffic. The report highlights two named individuals, Yin Kecheng and Zhou Shuai, who have been indicted and sanctioned, with Yin described as an infrastructure operator and Zhou as a data broker and strategic coordinator.

It notes the group’s focus on telecoms, National Guard networks, and critical infrastructure across the U.S., U.K., EU and elsewhere, including long-dwell router implants and lawful intercept data harvesting. According to the U.S. Department of the Treasury, Salt Typhoon epitomises a growing contractor-enabled model that distances state direction from operational execution, challenging attribution and defence.