The FBI has revealed that a massive Chinese espionage campaign known as Salt Typhoon has spread far wider than originally understood. According to investigators, it has reached into the communications networks of more than 80 countries and touched over 600 companies. The operation, linked to Beijing, began at least as far back as 2019 and was only discovered last year.

Brett Leatherman, the FBI’s top cyber official, described the scale of the breach in blunt terms. “This is one of the more consequential cyber espionage breaches we have seen here in the United States,” he told the Wall Street Journal. He emphasized that the campaign went beyond what governments usually consider to be espionage, saying, “That global indiscriminate targeting really is something that is outside the norms of cyberspace operations.”

How Salt Typhoon Operates

The hackers gained entry by exploiting a range of known software and hardware flaws. Vulnerabilities in Cisco routers, Palo Alto Networks firewalls, and Ivanti Secure systems were among those used to break into communications networks. Once inside, the attackers modified devices to maintain persistent access, stole credentials, and monitored internet traffic. According to a joint alert issued by the FBI and allied agencies, Salt Typhoon “often modifies routers to maintain persistent, long-term access to networks” and then leverages compromised devices to pivot deeper into other systems.

The operation’s reach allowed Chinese intelligence officers to access call records, text messages, geolocation data, and even systems used for court-authorized wiretaps. Leatherman explained the implications, saying, “If you are able to exfiltrate similar information globally you can start to aggregate that data and start to understand a much different intelligence picture than what you would get if you just targeted and compromised one country.”

The Damage Done

U.S. officials said the breach may have exposed over one million call records and directly targeted more than 100 Americans. The ability to track the movements and private communications of individuals alarmed investigators. Reports indicated that calls involving Donald Trump were among those swept up. The FBI also said the hackers gained access to “sensitive law-enforcement information and technical network information that could inform future attacks.”

One senator described the scale of the intrusion as “mind-boggling,” while another warned it could represent “the largest telecommunications hack in our nation’s history.” Analysts said the ability to map communications globally could give China a strategic edge in both intelligence gathering and future conflict preparation.

Responses from the Telecom Sector

Major U.S. carriers confirmed they had been targeted. Verizon Communications reported earlier this year that a “nation-state threat actor” gained access to its systems, though it said the incident had been contained. AT&T said that “the People’s Republic of China targeted a small number of individuals of foreign intelligence interest” and that it complied with notification requirements in the cases where information was impacted. T-Mobile US stated that its defenses “worked as designed to prevent any access to or exfiltration of customer or sensitive information.”

Still, the FBI confirmed that it has warned around 600 companies of possible interest to the hackers, noting that compromises of varying degrees were detected in many countries.

Remedies and International Action

To counter the threat, the FBI, along with agencies from thirteen other nations, released a detailed advisory that included technical information to help companies identify Salt Typhoon’s presence. Agencies from the UK, Canada, Germany, Italy, Japan, Australia, and others co-signed the alert. Annie Fixler of the Foundation for Defense of Democracies noted that the unusually large coalition underscored the seriousness of the campaign. “This type of joint alert from so many partners speaks to the importance of the information and the level of confidence in the attribution,” she told The Register.

The U.S. Treasury has already sanctioned Sichuan Juxinhe Network Technology, one of three Chinese firms accused of supplying cyber products and services to the Ministry of State Security and the People’s Liberation Army. Two other companies, Beijing Huanyu Tianqiong Information Technology and Sichuan Zhixin Ruijie Network Technology, were also named in international advisories.

Experts warn that Salt Typhoon is far from finished. As Fixler explained, “Salt Typhoon is a persistent actor. Even if one method of access is thwarted, they are going to keep trying to get in.”

The United States has made it clear that this was not business as usual. Investigators believe the targeting was broader and more indiscriminate than typical espionage. In an interview, Leatherman said, “It should really set off alarm bells for all Americans.”

The FBI, joined by the Cybersecurity and Infrastructure Security Agency, has urged the use of encrypted communications and stronger defenses to counter the threat. Google’s Mandiant team and other cybersecurity firms have also been involved in helping companies repair the damage.

China’s Denial

Beijing has rejected all accusations of involvement. A spokesman for the Chinese embassy in Washington, Liu Pengyu, said the United States had failed to provide “conclusive and reliable evidence” linking the campaign to the Chinese government. He added, “China firmly opposes and combats all forms of cyber attacks and cyber crime.” China’s Foreign Ministry went further, accusing the United States of enlisting other nations to “smear and frame” China for political reasons.

The ability to tap into communications across 80 countries reveals how cyber operations are reshaping global security. John Hultquist, chief analyst at Google’s Threat Intelligence Group, explained why this operation was different: “Though there are many Chinese cyber espionage actors regularly targeting the sector, this actor’s familiarity with telecommunications systems gives them a unique advantage, especially when it comes to evading detection.”

ACZ Editor: Seems to us that we are losing this fight – a fight we barely recognized that we were in until recently. China preyed on our telecom networks, ingrained themselves and are now reaping the benefit.