Salt Typhoon: China’s State-Sponsored Espionage Group Infiltrates Global Telecoms for Long-Term Cyber Warfare

Salt Typhoon is described as a Chinese state-sponsored cyber threat group aligned with the Ministry of State Security (MSS) and active since at least 2019, specialising in long-term espionage against global telecommunications providers and embedding itself within critical infrastructure to collect SIGINT and prepare for potential cyber warfare.

According to DomainTools, Salt Typhoon is a Chinese state-sponsored cyber threat group aligned with the Ministry of State Security (MSS), specialising in long-term espionage operations targeting global telecommunications infrastructure. The group operates with a hybrid model, receiving direct MSS oversight while also leveraging front companies and state-linked contractors to obscure attribution.

These contractors include Sichuan Juxinhe, Beijing Huanyu Tianqiong, and Sichuan Zhixin Ruijie, which provide infrastructure, domain registration pipelines, and tools to scale operations. Targeted intrusions are detailed across several regions, including U.S. telecom breaches in 2024 affecting operators such as AT&T, Verizon, and T-Mobile, as well as 2024 intrusions into the U.S.

National Guard, UK critical infrastructure from 2023 to 2024, and EU router hijacking in 2022 to 2023, underscoring a dual-use mission of espionage today with potential disruption capabilities for wartime. The operation presents unusual fingerprints, such as the use of publicly trackable domains registered with false U.S. personas, including ProtonMail accounts and fabricated identities, patterns defenders can use to track campaigns.

Salt Typhoon is portrayed as a prototype of China’s next-generation cyber espionage model, where covert access is privatized, capabilities are modular, and deniability is built into every layer of the intrusion lifecycle.