Salt Typhoon: The Telecom Phantom — China's Deep Penetration of Global Telecommunications Backbone Infrastructure

Inside the wires that carry every call.

Salt Typhoon — also tracked as GhostEmperor, FamousSparrow, Earth Estries, and UNC2286 — is a Chinese state-sponsored cyber espionage cluster that has been conducting operations since at least 2020, with a singular and devastating focus: the deep compromise of telecommunications infrastructure worldwide. What sets Salt Typhoon apart from the crowded landscape of Chinese threat groups is not the sophistication of any single malware implant or exploit, but the strategic target — the backbone infrastructure that carries the phone calls, text messages, and internet traffic of entire nations. By embedding themselves inside telecommunications providers at the network infrastructure level — core routers, switches, and the systems that execute lawful intercept orders — Salt Typhoon achieved something no firewall or endpoint agent can detect: persistent, silent access to the communications of millions of people, including senior US government officials, political figures, and individuals subject to court-authorised surveillance.

The scale of Salt Typhoon's compromise, publicly disclosed through FBI and CISA warnings in late 2024, represents what senior US intelligence officials have described as one of the most significant intelligence compromises in American history. At least nine US telecommunications companies — including AT&T, Verizon, T-Mobile, and Lumen Technologies — were confirmed to have been infiltrated. The intrusions were not smash-and-grab operations; they were patient, methodical campaigns that penetrated deep into network infrastructure, persisting for months or years before detection. Salt Typhoon did not merely steal data — they positioned themselves inside the systems that the US government itself relies upon to conduct lawful surveillance, potentially gaining visibility into who the FBI and intelligence agencies are investigating, what communications are being intercepted, and which Foreign Intelligence Surveillance Act (FISA) court orders are active.

The implications are staggering. A foreign intelligence service embedded inside the lawful intercept infrastructure of a target nation can do more than eavesdrop — it can map the counterintelligence landscape, identify covert operatives, understand collection priorities, and neutralise ongoing investigations. Salt Typhoon's access to call detail records (CDRs) — the metadata that records who called whom, when, for how long, and from where — provided a comprehensive map of communication patterns across millions of Americans. For targeted individuals — including senior government officials and political campaign figures during the 2024 US presidential election — Salt Typhoon is assessed to have accessed not just metadata but actual call and message content. This is intelligence collection at industrial scale, executed from inside the infrastructure that the targets trust implicitly.

Tracing Salt Typhoon to the People's Republic of China.

The backbone of global communications.

Salt Typhoon's targeting is narrow by design but catastrophic in impact. Unlike broadly targeted threat groups that compromise organisations across dozens of industry verticals, Salt Typhoon concentrates almost exclusively on telecommunications providers and the adjacent infrastructure that supports them. This focus is not a limitation — it is a force multiplier. A single compromised telecommunications provider yields access to the communications of millions of subscribers, the network routing infrastructure of an entire region, and the lawful intercept systems that reveal the surveillance activities of the host nation's intelligence agencies. Salt Typhoon's geographic targeting spans the United States, Southeast Asia, Europe, and other regions of strategic interest to the PRC.

Living inside the network fabric.

Salt Typhoon's defining technique is the deep compromise of network infrastructure itself — not the servers, workstations, or endpoints that sit atop the network, but the routers, switches, and management systems that are the network. This distinction is critical. Most threat groups — even sophisticated state-sponsored APTs — operate at the application layer, compromising operating systems, deploying malware on endpoints, and using standard C2 channels over the network. Salt Typhoon operates at the infrastructure layer, embedding themselves in the devices that route, switch, and manage network traffic. From this position, they can intercept communications passively, without generating the endpoint telemetry or anomalous network traffic that defenders rely upon for detection.

The exploitation of Cisco IOS XE vulnerabilities — particularly CVE-2023-20198 and CVE-2023-20273 — exemplifies this approach. These vulnerabilities in Cisco's network operating system allowed Salt Typhoon to gain privileged access to core routing and switching infrastructure. Once inside a Cisco device, the group could modify routing configurations, mirror traffic to collection points, create covert accounts for persistent access, and monitor all data flowing through the compromised device — all without touching a single endpoint. Traditional endpoint detection and response (EDR) tools are blind to this activity because the compromise exists below the layer where they operate. Network monitoring tools may detect anomalies, but only if defenders know what to look for in the management plane of network devices — a capability that many organisations lack.

The compromise of lawful intercept infrastructure represents the most strategically significant aspect of Salt Typhoon's technique. In the United States, the Communications Assistance for Law Enforcement Act (CALEA) requires telecommunications providers to build interception capabilities into their networks, enabling law enforcement and intelligence agencies to conduct court-authorised surveillance. These systems are, by design, capable of intercepting any communication that traverses the network. By gaining access to CALEA infrastructure, Salt Typhoon effectively co-opted the surveillance apparatus that the US government built for its own use — turning a lawful intercept capability into an espionage platform. This is not a theoretical risk; FBI and CISA have confirmed that Salt Typhoon accessed these systems and used them to collect communications data.

Purpose-built implants for infrastructure-level access.

Entering through the infrastructure itself.

From Southeast Asian telecoms to the heart of American communications.

Salt Typhoon's campaign history reflects a methodical expansion from regional telecommunications targeting in Southeast Asia to the audacious compromise of the largest telecommunications providers in the United States. The earliest documented activity — tracked by Kaspersky as GhostEmperor and by Trend Micro as Earth Estries — emerged in 2020 and 2021, targeting telecommunications providers and government entities in Southeast Asia, the Middle East, and South Africa. These early campaigns served as proving grounds, allowing Salt Typhoon to refine their tradecraft for telecommunications infrastructure penetration before applying those techniques against harder, higher-value targets.

Kaspersky's GhostEmperor reporting (2021) provided the first detailed public analysis of the cluster's operations. The research documented sophisticated intrusions targeting telecommunications companies and government organisations in Southeast Asia and the Middle East, deploying the Demodex rootkit — a Windows kernel-mode implant that used a vulnerable legitimate driver (BYOVD technique) to load unsigned kernel code, achieving deep system-level concealment. The GhostEmperor campaigns demonstrated a level of rootkit engineering sophistication that distinguished this cluster from the broader Chinese threat landscape. Kaspersky noted that the group showed significant investment in anti-forensic and anti-analysis techniques, including multi-stage loading chains designed to frustrate incident response.

ESET's parallel reporting on FamousSparrow documented a related cluster targeting hotels, governments, and international organisations with the SparrowDoor backdoor. FamousSparrow campaigns exploited vulnerabilities in internet-facing servers — including Microsoft Exchange ProxyLogon (CVE-2021-26855) — to establish initial footholds. While the hotel targeting initially appeared anomalous, the intelligence value of hotel guest records — travel itineraries, passport data, and communication patterns of government officials and diplomats — aligns with broader MSS collection priorities. The overlap between FamousSparrow and GhostEmperor activity — in infrastructure, tooling, and targeting — led threat intelligence analysts to assess these as sub-clusters of the same overarching operation.

Trend Micro's Earth Estries campaigns (2023) expanded the picture further, documenting intrusions targeting telecommunications providers and government agencies across the United States, Asia-Pacific, the Middle East, and South Africa. Earth Estries operators deployed a toolkit including HemiGate, TrillClient, and customised Cobalt Strike payloads, demonstrating an evolution in capabilities and a broadening of geographic scope. Critically, the Earth Estries reporting documented the group's increasing focus on telecommunications infrastructure — moving beyond traditional server and endpoint compromise to target the network management systems and provisioning platforms that control telecommunications network operations.

The US telecommunications compromise — publicly disclosed in late 2024 through coordinated FBI and CISA advisories — represented the culmination of Salt Typhoon's operational evolution. At least nine US telecommunications companies were confirmed compromised, including AT&T (the largest US carrier by subscribers), Verizon (the second-largest), T-Mobile, and Lumen Technologies (a major internet backbone provider). The compromises were not recent — investigators determined that Salt Typhoon had maintained persistent access to some networks for over a year before detection. The group penetrated deep into network infrastructure, compromising core routers and switches that carry voice and data traffic for hundreds of millions of subscribers.

The most alarming aspect of the US telecommunications compromise was Salt Typhoon's access to lawful intercept (CALEA) infrastructure. CALEA requires US telecommunications providers to maintain the ability to execute court-authorised wiretaps and surveillance orders. Salt Typhoon accessed these systems, potentially gaining visibility into active FISA court orders, law enforcement wiretap requests, and the identities of individuals under government surveillance. For a foreign intelligence service, this represents an extraordinary counterintelligence windfall — the ability to see who the adversary is watching, what they are collecting, and which investigations are active. Senior US officials described the breach as having potentially compromised the integrity of the US intelligence community's surveillance capabilities.

Simultaneously, Salt Typhoon targeted the communications of specific high-profile individuals through the compromised telecom infrastructure. Individuals associated with the 2024 US presidential campaigns — including figures linked to both the Trump and Harris campaigns — were among those whose communications were targeted. Senior government officials in the State Department and national security apparatus were also targeted. The collection reportedly included both metadata (call detail records showing who communicated with whom, when, and for how long) and, for priority targets, actual communications content. This targeting was conducted through the telecommunications infrastructure rather than through endpoint compromise — the targets' phones and devices were never directly hacked, but the networks carrying their communications were owned by the adversary.

Defending against threats below the endpoint.

Defending against Salt Typhoon is fundamentally different from defending against conventional threat actors because their primary targets — network infrastructure devices — exist in a monitoring blind spot for most organisations. Traditional security architectures focus detection at the endpoint (EDR) and network perimeter (firewall, IDS/IPS), but Salt Typhoon operates at the infrastructure layer between these controls. A compromised core router does not generate EDR telemetry, and traffic interception at the switch level does not trigger IDS signatures. Effective defence against Salt Typhoon requires extending security monitoring to encompass network infrastructure itself — treating routers, switches, and management systems as first-class assets that require the same level of security scrutiny as servers and workstations.

Salt Typhoon within China's Typhoon campaigns.

Salt Typhoon operates within a constellation of Chinese state-sponsored threat groups that Microsoft collectively designates with the 'Typhoon' naming convention — each representing a distinct operational cluster with specific targeting mandates and technical approaches. Together, these groups represent a comprehensive Chinese strategy to achieve persistent access to critical infrastructure across the United States and allied nations. Understanding Salt Typhoon's position within this ecosystem reveals the breadth and coordination of PRC cyber operations: Volt Typhoon pre-positions in energy and water infrastructure for potential wartime disruption, Salt Typhoon embeds in telecommunications for intelligence collection, Flax Typhoon builds botnets from IoT devices for operational infrastructure, and Brass Typhoon (APT41) conducts broad espionage with financial crime elements. Each group serves a distinct role in a larger strategic framework.

Salt Typhoon's position within this ecosystem highlights a critical evolution in Chinese cyber strategy: the shift from targeting endpoints and data stores to targeting infrastructure itself. Where earlier Chinese APT campaigns (APT1, APT10, APT41) focused on stealing data from servers and workstations, Salt Typhoon and Volt Typhoon represent a new generation of operations that target the infrastructure layer — the routers, switches, and control systems that underpin entire sectors of the economy. This shift makes detection dramatically harder and raises the strategic stakes: compromise at the infrastructure level potentially affects every entity that depends on that infrastructure, multiplying the impact of a single intrusion by orders of magnitude.

The bottom line.

Salt Typhoon represents a paradigm shift in state-sponsored cyber espionage — the move from stealing data off endpoints to embedding directly inside the infrastructure that carries all communications. By compromising at least nine US telecommunications providers at the network infrastructure level, accessing lawful intercept (CALEA) systems, collecting call detail records for millions of Americans, and targeting the communications of senior government officials and political figures, Salt Typhoon achieved one of the most significant intelligence compromises in US history. This was not a data breach in the conventional sense — it was the co-option of the communications backbone itself, transforming the infrastructure that Americans trust to carry their calls and messages into a collection platform for a foreign intelligence service.

The strategic implications extend far beyond the data collected. Salt Typhoon's access to lawful intercept infrastructure potentially compromised the integrity of US intelligence and law enforcement surveillance capabilities — revealing which individuals are under investigation, which FISA court orders are active, and what communications are being collected. This counterintelligence damage is difficult to quantify and may take years to fully assess. Chinese intelligence services can use this information to identify compromised operatives, neutralise ongoing investigations, and understand the priorities and capabilities of their primary intelligence adversary. The FBI and CISA's unprecedented public warnings in late 2024 — including the extraordinary recommendation that Americans use end-to-end encrypted communications — reflected the severity of the compromise.

For defenders — particularly those responsible for telecommunications and critical infrastructure security — Salt Typhoon demands a fundamental reassessment of what constitutes the security perimeter. Network infrastructure devices cannot remain in a monitoring blind spot. Routers, switches, and management systems must be treated as first-class assets subject to continuous integrity monitoring, aggressive patching, strict access controls, and active threat hunting. The CALEA infrastructure that enables lawful intercept must be secured with dedicated controls that reflect its extraordinary sensitivity. And the broader lesson of Salt Typhoon is clear: in an era where adversaries target infrastructure rather than endpoints, security that stops at the operating system boundary is no longer sufficient. The network itself must be defended.