| Formation | 2020; 5 years ago (2020) |
|---|---|
| Type | Advanced persistent threat |
| Purpose | Cyber espionage,counterintelligence,data exfiltration |
| Location | |
| Affiliations | Ministry of State Security |
Salt Typhoon is anadvanced persistent threat actor believed to be operated byChina'sMinistry of State Security (MSS) which has conducted high profilecyber espionage campaigns, particularly against theUnited States. The group's operations place an emphasis oncounterintelligence targets in the United States anddata theft of key corporateintellectual property. The group has infiltrated targets in dozens of other countries on nearly every continent.[1] FormerNSA analyst Terry Dunlap has described the group as a "component of China's100-Year Strategy."[2]
Salt Typhoon is widely understood to be operated by China'sMinistry of State Security (MSS), itsforeign intelligence service andsecret police.[3][4] The Chinese embassy denied all allegations, saying it was "unfounded and irresponsible smears and slanders".[5]
According toTrend Micro, the group is a "well-organized group with a clear division of labor" whereby attacks targeting different regions and industries are launched by distinct actors, suggesting the group consists of various teams, "further highlighting the complexity of the group's operations."[6][7]
In late 2024 U.S. officials announced that hackers affiliated with Salt Typhoon had accessed the computer systems of nine U.S.telecommunications companies, later acknowledged to includeVerizon,AT&T,T-Mobile,Spectrum,Lumen,Consolidated Communications, andWindstream.[8][9][10] The attack targeted U.S.broadband networks, particularly core network components, includingrouters manufactured byCisco, which route large portions of the Internet.[3][4] In October 2024, U.S. officials revealed that the group had compromisedinternet service provider (ISP) systems used to fulfillCALEA requests used by U.S. law enforcement and intelligence agencies to conduct court-authorizedwiretapping.[9]
The hackers were able to accessmetadata of users calls andtext messages, including date and time stamps, source and destinationIP addresses, and phone numbers from over a million users; most of which were located in theWashington D.C. metro area. In some cases, the hackers were able to obtain audio recordings of telephone calls made by high profile individuals.[11] Such individuals reportedly included staff of theKamala Harris 2024 presidential campaign, as well as phones belonging toDonald Trump andJD Vance.[12] According to deputy national security advisorAnne Neuberger, a "large number" of the individuals whose data was directly accessed were "government targets of interest."[11]
In September 2024, reports first emerged that a severe cyberattack had compromised U.S. telecommunications systems. US officials stated that the campaign was likely underway for one to two years prior to its discovery, with several dozen countries compromised in the hack, including those in Europe and the Indo-Pacific.[13] The campaign was reportedly "intended as a Chinese espionage program focused on key government officials [and] key corporate [intellectual property]."[3][14]
In March 2025, theUnited States House Committee on Homeland Security requested that theDepartment of Homeland Security turn over documents on the federal government's response to the hacking.[15]
Salt Typhoon reportedly employs aWindows kernel-moderootkit, Demodex (name given byKaspersky Lab[16]), to gain remote control[17] over their targetedservers.[18] They demonstrate a high level of sophistication and useanti-forensic and anti-analysis techniques to evade detection.[18]
According toThe New York Times, Salt Typhoon is unique in focusing primarily oncounterintelligence targets.[19] In addition to U.S. Internet service providers, theSlovak cybersecurity firmESET says Salt Typhoon has previously broken into hotels and government agencies worldwide.[20][21]
Salt Typhoon is the name assigned by Microsoft and is the one most widely used to describe the group.[20] The group has also variously been called:
| Organization |  | |
|---|---|---|
| Ministers | ||
| Major international operations | ||
| Notable works | ||
| Activities by country | ||