Chinese State-Sponsored Hackers Exploiting Network Edge Devices to Harvest Sensitive Data

Salt Typhoon, a Chinese state-sponsored cyber threat group aligned with the MSS, has been targeting global telecommunications infrastructure since at least 2019, using exploits on network edge devices to harvest vast quantities of sensitive data. Their campaigns span multiple regions including the United States, United Kingdom, Taiwan, and the European Union, and have compromised at least a dozen U.S. telecom providers, along with state National Guard networks and allied services.

The group deploys bespoke malware, living-off-the-land binaries and stealthy firmware implants on routers, VPN gateways and firewalls to intercept VoIP configurations, lawful intercept logs, subscriber metadata and call detail records.

Salt Typhoon operates through front companies and contractor ecosystems to obscure attribution while maintaining direct oversight from Beijing, with entities such as i-SOON (Anxun Information Technology Co., Ltd.) and Sichuan Juxinhe Network Technology providing domain registration pipelines and leased infrastructure. Attribution efforts have identified two key individuals: Yin Kecheng and Zhou Shuai (aka “Coldface”).

Their modular, industrialised tradecraft and shared infrastructure offer defenders detectable patterns in domain provisioning, SSL certificates and DNS usage, underscoring the need for strengthened firmware security and robust anomaly detection across edge devices.