Path & Payload

The Intercept on the Interceptors: Inside Salt Typhoon

In 1994, Congress passed a law requiring U.S. telecommunications carriers to build a door for court-authorized surveillance. Thirty years later, an APT called Salt Typhoon walked through it.

Among the data Salt Typhoon extracted from major U.S. carrier networks was information associated with lawful intercept requests — information that could reveal the identities of individuals under court-authorized U.S. surveillance. A foreign intelligence service that knows who American law enforcement is watching can burn compromised assets and adjust tradecraft accordingly. Salt Typhoon, a PRC state-backed cluster, maintained access to some carrier environments for years before anyone noticed. Neither the initial public disclosure nor U.S. sanctions has stopped them.

Salt Typhoon has been active since at least 2019. By mid-2026, the FBI had detected its activity in at least 80 countries, making it one of the most consequential espionage campaigns against telecommunications infrastructure ever publicly attributed.

A Patient Approach to a Strategic Target

Salt Typhoon is tracked under several overlapping labels across the vendor community, including GhostEmperor (Sygnia), Operator Panda, UNC5807, and RedMike (Recorded Future). MITRE tracks the group as G1045. Earth Estries (Trend Micro) and UNC2286 (Mandiant) describe related PRC activity, but the public record does not establish a one-to-one correspondence among all of these clusters. The variation reflects both independent research timelines and the limits of public attribution.

An August 2025 joint advisory says the industry labels partially overlap and may not map exactly to the agencies’ understanding of the operators. Trend Micro's analysis describes a structured organization of distinct, specialized teams responsible for different geographic regions and target verticals, which may help explain why activity associated with the broader cluster can produce TTPs different enough to generate competing attribution tracks.

PRC state backing is the assessed consensus among U.S. intelligence agencies, reflected in official government advisories. Public reporting has connected companies supporting the activity to China's Ministry of State Security, but the precise organizational relationship between the operators, contractors and intelligence services is less clear. Unlike North Korean state actors such as Lazarus Group, which blend espionage objectives with direct revenue generation, Salt Typhoon's documented operations focus on intelligence collection. No ransom notes, no leak site, no financially motivated affiliate recruitment. Its output is intelligence.

The cluster's documented operational patience defines it as much as any particular TTP. Trend Micro's analysis of Earth Estries, which overlaps with parts of the wider PRC activity, found that most victims had been breached for several years before detection. A Cisco report — cited in Senator Cantwell's July 2025 letter to Mandiant — found that Salt Typhoon “demonstrated [the threat actor’s] ability to persist in target environments… maintaining access in one instance for over three years.”

Several U.S. carrier intrusions are assessed to have begun as early as 2021. The initial public disclosure came in September 2024, when the Wall Street Journal reported on anonymous sources describing breaches at multiple providers. CISA and the FBI offered official confirmation in October 2024 with a joint statement acknowledging unauthorized access to commercial telecommunications infrastructure by PRC-affiliated actors. By August 2025, the FBI had revised the scope significantly upward: more than 200 U.S. organizations compromised, with related activity identified across more than 80 countries.

The Architecture Concentrated the Risk

The Communications Assistance for Law Enforcement Act — CALEA — was signed into law in 1994. It requires covered U.S. telecommunications carriers to maintain capabilities enabling court-authorized wiretaps to be executed and their output delivered to law enforcement in a usable format. Implementations commonly involve three functions: intercept points embedded in carrier switching infrastructure, mediation systems that aggregate the intercepted data and delivery interfaces that transmit the collected output to requesting law enforcement agencies.

Those systems were the high-value target. Public reporting hasn’t established a single architecture across the affected carriers or the exact path Salt Typhoon used to reach lawful intercept information. The government's post-incident guidance nevertheless points to weaknesses in management-plane security: inadequate segmentation, insufficiently isolated out-of-band management, and limited visibility into network-device activity.

Reaching those systems required deep access to carrier networks and navigation of their management architecture. Public reporting documents SNMP-based reconnaissance, configuration collection, valid-account use, and lateral movement across network devices.

The attackers obtained call detail records — timestamps, source, destination, and duration — real-time audio in confirmed cases, and certain information associated with lawful intercept requests. That last category is the most strategically significant. Information revealing law enforcement surveillance targets represents not just individual collection opportunities but a window into U.S. counterintelligence priorities — who the government considers a threat and, by inference, what methodologies and personas may already be burned.

Senator Mark Warner, chair of the Senate Intelligence Committee at the time of disclosure, called it “the worst telecom hack in our nation's history.” His assessment followed a classified briefing, but the public record is sufficient to explain why.

Nine Carriers, Then 200+ Organizations

The White House said at least nine U.S. telecommunications companies had been compromised. Public reporting named AT&T, Verizon, Lumen/CenturyLink, Charter Communications, Consolidated Communications and Windstream among the affected providers. T-Mobile said it detected and stopped related activity before the attackers accessed sensitive customer information. Viasat disclosed unauthorized access through a compromised device but said it found no evidence of customer impact, and public reporting doesn’t establish that the incident reached lawful intercept tools.

The August 27, 2025 joint advisory, co-signed by cybersecurity agencies from Australia, Canada, the Czech Republic, Finland, Germany, Italy, the Netherlands, New Zealand, Poland, Spain and the United Kingdom, disclosed that the scope had expanded well beyond the original nine carriers. The FBI confirmed more than 200 U.S. organizations compromised. The Wall Street Journal and Washington Post separately reported that roughly 600 organizations globally had been notified or identified as subjects of actor interest across more than 80 countries.

The targeting extended beyond telecommunications into government agencies, transportation networks, defense contractors, lodging infrastructure, military networks, technology companies, consulting firms, chemical manufacturers, and non-profit organizations.

Norway became the first European government to publicly confirm an intrusion attributed to Salt Typhoon. Canada's Centre for Cyber Security issued a threat bulletin attributing active targeting of its telecommunications sector to a related PRC-affiliated cluster.

Among confirmed high-value targets were individuals connected to both the Trump and Harris presidential campaigns. Public reporting established access to some call records and private communications during the fall of 2024, but not that all of those staffers' calls were continuously accessible.

Signature TTPs (Mapped to MITRE ATT&CK)

Initial Access

Salt Typhoon enters through the network edge. Its initial access vectors are known, unpatched vulnerabilities in internet-facing routers, VPN concentrators and firewalls operated by carriers and their third-party vendors.

CVEs documented across Salt Typhoon and overlapping PRC campaigns include:

Recorded Future's February 2025 analysis found that RedMike — a cluster that overlaps with the broader Salt Typhoon activity — attempted to compromise more than 1,000 Cisco devices globally, focusing on devices associated with telecommunications providers. These actors operated systematically against unpatched infrastructure at scale.

ATT&CK: T1190 (Exploit Public-Facing Application)

Persistence and Defense Evasion

Once inside, Salt Typhoon and overlapping PRC clusters deploy a layered persistence stack designed to survive network changes and evade endpoint monitoring.

Demodex is a Windows kernel-mode rootkit that hooks kernel functions to hide processes, files and network connections from security software and forensic investigators. It has been recovered in Earth Estries operations from compromised systems and from machines belonging to third-party vendors — in at least one documented case, a primary contractor for a regional carrier, used as a staging point for downstream access.

GhostSpider is a modular in-memory backdoor first documented by Trend Micro in November 2024. It operates without writing to disk, loading encrypted modules from a C2 server into memory on demand and executing only the functionality required for a given task. The modular architecture means different instances of GhostSpider may present entirely different behavioral signatures — one instance might perform only file enumeration; another, only network tunneling. Trend Micro notes that this makes it “much more difficult for defenders and researchers to identify what's what” because no single deployment exposes the full capability set.

Supporting tools in the Earth Estries arsenal include SparrowDoor — remote access and network tunneling — SNAPPYBEE/Deed RAT — long-term access and data exfiltration, shared with other Chinese APT clusters — Masol RAT — a Linux-focused remote access backdoor — CrowDoor — data exfiltration — and TrillClient and ZINGDOOR for additional C2 capability. The group uses Cobalt Strike beacons, the open-source tunneling tool frpc and NeoReGeorg for network proxying. C2 communications are routed through dedicated infrastructure combined with legitimate services including GitHub and cloud storage providers.

Living-off-the-land techniques — PowerShell, WMI, PsExec, Windows service creation — are used heavily for lateral movement and command execution. The most documented persistence command creates a Windows service on a remote target — first documented by Trend Micro's November 2024 Earth Estries analysis. The loader launches Cobalt Strike and masquerades as a VMware authentication service, designed to blend with legitimate VMware-related administrative activity.

ATT&CK (Earth Estries-associated activity): T1014 (Rootkit), T1055 (Process Injection), T1059.001 (PowerShell), T1047 (Windows Management Instrumentation), T1569.002 (Service Execution), T1027 (Obfuscated Files or Information), T1543.003 (Windows Service)

Lateral Movement Across Carrier Infrastructure

The pivot through carrier management networks required navigating network segmentation. The broader PRC activity described in the allied advisory used SNMP for network reconnaissance and management-plane mapping, along with valid credentials obtained during earlier stages of compromise.

ATT&CK: T1021.004 (Remote Services: SSH), T1078 (Valid Accounts), T1040 (Network Sniffing), T1570 (Lateral Tool Transfer)

Exfiltration

Standard exfiltration to external IPs can be detectable through DLP and network-monitoring tools. Recorded Future observed RedMike configure GRE tunnels through compromised telecommunications infrastructure for persistent access and data exfiltration. GRE encapsulates rather than encrypts traffic, but on high-volume networks it can blend into infrastructure-level flows that receive less scrutiny than application-layer connections. MITRE separately documents Salt Typhoon exfiltrating configuration files over FTP and TFTP.

ATT&CK: T1572 (Protocol Tunneling); T1048.003 (Exfiltration Over Unencrypted Non-C2 Protocol — FTP and TFTP)

The Policy Response That Reversed

What followed the public disclosure is just as notable as the campaign itself.

On January 15, 2025, five days before the change in administration, the FCC adopted a Declaratory Ruling under Section 105 of CALEA requiring telecommunications carriers to protect their networks against unlawful access and interception, and separately proposed an annual certification requirement for cybersecurity risk management plans. Two days later, the Treasury Department sanctioned Sichuan Juxinhe Network Technology, a China-based cybersecurity company it said had been directly involved in Salt Typhoon’s exploitation of U.S. telecommunications and internet service provider networks.

The Cyber Safety Review Board, which had been directed to conduct a comprehensive review of the Salt Typhoon campaign, was disbanded on January 20, 2025 — the day Trump took office. Acting DHS Secretary Benjamin Huffman issued a memo terminating all DHS advisory committee memberships, citing the elimination of “misuse of resources.” An unnamed former board member later said the CSRB was less than halfway through its Salt Typhoon investigation. The board had previously delivered actionable post-incident analyses of the Log4Shell vulnerability and the 2023 Microsoft Exchange Online breach. The Salt Typhoon review, which would have represented the most comprehensive public technical accounting of the campaign, was never delivered.

On November 20, 2025, the Trump FCC voted 2-1 to repeal the ruling and abandon the proposal, with Commissioner Anna Gomez dissenting. Gomez warned the FCC was leaving the country “less secure at the very moment when these threats are increasing.”

AT&T and Verizon both retained Mandiant to conduct internal security assessments following disclosure. As of early 2026, both companies had declined to provide those assessments to the Senate Commerce Committee, and Cantwell wrote in February 2026 that both carriers had “apparently intervened to block Mandiant from cooperating” with her requests for the documents. Cantwell stated that experts had given her “no reason to think that the attack has been completely remediated.” The same month, FBI Deputy Assistant Director Michael Machtinger told CyberScoop at the CyberTalks conference that the threat “is still very, very much ongoing.”

The U.S. Department of State's Rewards for Justice program is offering up to $10 million for information on foreign government-linked individuals participating in qualifying malicious cyber activity against U.S. critical infrastructure, including information related to Salt Typhoon.

Detection and Defense Considerations

The initial-access activity documented across Salt Typhoon and overlapping PRC clusters relies heavily on known, patchable vulnerabilities in network edge devices. CVE-2023-20198, CVE-2023-20273, CVE-2018-0171, CVE-2023-46805, CVE-2024-21887 and CVE-2024-3400 all had patches available at or before the time they were exploited. One of the primary defensive leverage is patch management on internet-facing network infrastructure — a control that sounds routine and is consistently deprioritized on carrier and enterprise router and firewall stacks.

The CISA/NSA/FBI joint advisory released August 27, 2025 — co-signed by eleven allied nations’ cybersecurity agencies — identifies several detection priorities: auditing SSH listeners on network devices, monitoring for anomalous GRE tunnel creation, tracking container activity on Linux systems and implementing out-of-band management networks physically separated from the data-flow network. The guidance also recommends reviewing SNMP community strings and disabling Cisco Smart Install where it is not operationally required.

Demodex operates in the Windows kernel, where it can evade many signature-based endpoint tools. Detection may require kernel-aware integrity checks, memory analysis or behavioral monitoring capable of identifying discrepancies between expected and observed system behavior.

The lawful intercept supply chain is an underexamined attack surface. CALEA compliance systems are frequently administered by third-party vendors with their own network access, credentials and patch-management cycles. If those vendors operate internet-facing infrastructure — or if their access credentials can be harvested from the carrier environment — the attack surface for a Salt Typhoon-style pivot extends beyond the carrier's own network boundary. Any organization involved in lawful intercept infrastructure management should be treated as part of the carrier's threat model, not outside it.

Organizations that are not telecoms remain relevant targets if they operate infrastructure that routes or processes communications, or if they hold government contracts that make their systems or personnel of intelligence value to PRC intelligence services. The August 2025 advisory's targeting list — transportation, lodging, military, defense contracting — signals that the broader activity's footprint is considerably wider than its original telecom framing suggested.

The Bottom Line

Salt Typhoon's success did not depend on novel zero-days or unprecedented tradecraft. It required patience, systematic exploitation of unpatched known CVEs, a clear understanding of CALEA architecture and enough dwell time to reach one of the most sensitive layers of carrier infrastructure. The government's own wiretap mandate created the high-value target. Weaknesses in network segmentation and management-plane visibility helped provide the path, although public reporting has not disclosed the exact route into lawful intercept systems. Years of undetected access provided the collection window. The post-disclosure policy trajectory — the FCC ruling rescinded, review board disbanded, carrier assessments withheld from Congress — has left critical questions about remediation and accountability unanswered while the threat remains active.

Sources

#Threat Actor Profiles