Salt Typhoon: China Hacked 80 Countries and No One Got Them Out

Salt Typhoon, a hacking group tied to China's Ministry of State Security, has now compromised at least 200 companies across 80 countries. AT&T and Verizon have not been able to confirm the attackers have been fully removed from their networks.

What Is Salt Typhoon?

Salt Typhoon is an advanced persistent threat (APT) group attributed to China's Ministry of State Security. It specialises in long-term, silent access to telecommunications infrastructure — not for immediate data theft, but to pre-position inside systems that governments use for lawful interception of communications.

The FBI first publicly attributed Salt Typhoon to China in late 2024. By August 2025, the FBI confirmed the scope had expanded to over 80 countries and at least 200 companies. In April 2025, the FBI posted a $10 million bounty for information on individuals connected to the group.

How They Got In

Salt Typhoon exploited unpatched Cisco router vulnerabilities to gain initial access. From there they moved using living-off-the-land techniques — abusing legitimate system tools and administrator credentials rather than deploying custom malware that would trigger security alerts.

Living-off-the-land is particularly effective against telecom carriers because those carriers run complex, heterogeneous networks where unusual tool use is normal. An attacker using built-in network management commands looks identical to a network engineer doing routine maintenance.

Intrusions reportedly began as far back as 2019. Some of the compromised systems had been silently accessible for six or more years before detection.

Who They Targeted and Why

Salt Typhoon specifically targeted systems that US telecommunications companies maintain for lawful interception — the wiretapping infrastructure that US law enforcement agencies use under court orders to intercept criminal suspects. By compromising these systems, China gained visibility into who US agencies were monitoring.

The December 2025 intrusions went further: US House of Representatives committee systems were compromised. Data center giant Digital Realty and Comcast were confirmed as victims in the latest expansion.

This is not a financial crime. Salt Typhoon is not selling stolen data or ransoming companies. It is building persistent access to communications infrastructure that, in a conflict scenario, could be used for sabotage or to blind US surveillance capabilities at a critical moment.

The Scale of the Problem

The FBI stated in early 2025 that AT&T and Verizon had not been able to confirm Salt Typhoon was fully evicted from their networks. That is an extraordinary admission: two of the largest telecommunications companies in the United States cannot verify they have removed a foreign nation-state from their infrastructure.

Why Developers Should Care

If your application transmits data over US telecoms infrastructure, there is a non-zero probability that a nation-state adversary has had access to routing metadata — not necessarily the content of encrypted HTTPS traffic, but connection metadata: who connected to what, when, from where.

For high-sensitivity applications — financial services, healthcare data, anything with government contracts — the implication is that transport-layer encryption alone is not sufficient. Encrypt at the application layer. Assume the network is hostile. This is not paranoia; it is the situation the FBI has publicly described.

The Cisco vulnerability entry point is also a reminder that edge network devices are the highest-risk attack surface. Core application servers get patched. Routers and switches in telecom backbone infrastructure often do not. Any organisation running legacy Cisco IOS versions without active patch management should treat this as a direct threat model.

What China Gains

Access to lawful interception systems gives China three capabilities. First, it can identify which Chinese nationals or entities US agencies are monitoring, warning them before prosecution. Second, it can monitor US government communications about China policy made over compromised networks. Third, in a crisis scenario, it can disable or corrupt the telecommunications infrastructure US emergency responders and military communications depend on.

Salt Typhoon is not spying on individual citizens. It is mapping and maintaining access to the infrastructure of American power.

Key Takeaways

• 200 companies across 80 countries — confirmed Salt Typhoon compromise scope as of August 2025
• Intrusions started as early as 2019 — the attackers had up to 6 years of silent access before detection
• AT&T and Verizon cannot confirm eviction — two US telecoms giants have not cleared the network
• $10 million FBI bounty — posted April 2025 for information on Salt Typhoon individuals
• For developers: Encrypt at the application layer, not just transport. Assume routing metadata is observable by nation-state adversaries on US telecom infrastructure. Patch edge network devices — routers and switches are the entry point, not app servers.
• What to watch: Whether the US Cyber Safety Review Board publishes a formal Salt Typhoon attribution report in 2026, which would trigger mandatory remediation requirements for US telecoms