Product Code Database
Salt Typhoon is an advanced persistent threat actor believed to be operated by China's Ministry of State Security (MSS) which has conducted high-profile cyber espionage campaigns, particularly against the United States. The group's operations place an emphasis on counterintelligence targets in the United States and data theft of key corporate intellectual property. The group has infiltrated over 200 targets in over 80 countries. Former NSA analyst Terry Dunlap has described the group as a "component of China's 100-Year Strategy."
According to Trend Micro, the group is a "well-organized group with a clear division of labor" whereby attacks targeting different regions and industries are launched by distinct actors, suggesting the group consists of various teams, "further highlighting the complexity of the group's operations." The Cyberattack were reported to have commenced since at least 2023.
In late 2024 U.S. officials announced that affiliated with Salt Typhoon had accessed the computer systems of nine U.S. telecommunications companies, later acknowledged to include Verizon, AT&T, T-Mobile US, Spectrum, Lumen, Consolidated Communications, and Windstream. The attack targeted U.S. broadband networks, particularly core network components, including routers manufactured by Cisco, which route large portions of the Internet. In October 2024, U.S. officials revealed that the group had compromised internet service provider (ISP) systems used to fulfill CALEA requests used by U.S. law enforcement and intelligence agencies to conduct court-authorized wiretapping.
The hackers were able to access metadata of users calls and Text messaging, including date and time stamps, source and destination , and phone numbers from over a million users; most of which were located in the Washington D.C. metro area. In some cases, the hackers were able to obtain audio recordings of telephone calls made by high-profile individuals. Such individuals reportedly included staff of the Kamala Harris 2024 presidential campaign, as well as phones belonging to Donald Trump and JD Vance. According to deputy national security advisor Anne Neuberger, a "large number" of the individuals whose data was directly accessed were "government targets of interest."
In March 2025, the United States House Committee on Homeland Security requested that the Department of Homeland Security (DHS) turn over documents on the federal government's response to the hacking.
The second Trump administration fired all members of the Cyber Safety Review Board before it could complete its investigation of the intrusion. In April 2025, the Federal Bureau of Investigation (FBI) announced a US$10 million bounty for information on individuals associated with Salt Typhoon.
In August 2025, the FBI stated that Salt Typhoon has hacked at least 200 companies across 80 countries.
| + |
| Ivanti Connect Secure and Ivanti Policy Secure web-component command injection vulnerability |
| Palo Alto Networks PAN-OS GlobalProtect arbitrary file creation leading to OS command injection. |
| Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation |
| Cisco IOS XE web user interface authentication bypass |
| Cisco IOS and IOS XE smart install remote code execution |
| Microsoft Exchange Server Server-Side Request Forgery Vulnerability (ProxyLogon) |
| Sophos Firewall Code Injection Vulnerability |
| FortiClient Enterprise Management Server (FortiClientEMS) SQL Injection Vulnerability |
| Ivanti Connect Secure and Ivanti Policy Secure Authentication Bypass Vulnerability |
On January 17, 2025 the U.S. Department of the Treasury announced sanctions against Sichuan Juxinhe Network Technology Co., LTD. The statement accused Sichuan Juxinhe of having direct involvement with Salt Typhoon and that the group was responsible for breaching multiple U.S. telecommunication and internet service provider companies.
|
|
