The FBI and allied international intelligence agencies have declared the Salt Typhoon cyber campaign a national defense crisis after uncovering widespread infiltration of global telecommunications networks by Chinese state-backed hackers.
In one of the most sweeping espionage operations ever exposed, Salt Typhoon actors compromised the core routers and management planes that carry the world’s internet traffic. Sensitive data belonging to millions of Americans was stolen, communications were surveilled and the integrity of global networks was quietly undermined across at least 80 countries.
“This is not just a cyber intrusion. This is the weaponization of our communications infrastructure,” said one senior intelligence official involved in the investigation.
The FBI, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Department of Defense Cyber Crime Center, joined by international partners from across Europe, North America, Japan, Australia and other allies, released a joint advisory on August 27, 2025. The advisory included detailed technical guidance to help network defenders identify and eradicate the threat. This was not a routine bulletin. It was a declaration that telecommunications networks have become battlegrounds in a larger contest for national security.
What Salt Typhoon Did
Salt Typhoon’s methods reveal a chilling level of patience and sophistication, a sure signature of Chinese state-backed hackers. They are trained for the long game, a strategy ingrained in the People’s Republic of China’s security apparatus. This was not a hit-and-run hack. It was a methodical espionage campaign.
1. Initial Entry
- Operators gained access by exploiting widely known vulnerabilities in networking equipment, including Ivanti Connect Secure (CVE-2024-21887), Palo Alto PAN-OS (CVE-2024-3400) and Cisco IOS XE (CVE-2023-20198 chained with CVE-2023-20273).
- Investigators found no evidence of zero-day exploits. The attackers succeeded because organizations failed to patch. Negligence, not novelty, opened the door.
- Patience is the hallmark of Chinese operators, but the other side of this story is the lackadaisical attitude toward security that remains all too common among Western IT managers.
2. Persistence At The Core
- Once inside, Salt Typhoon operators altered access control lists, created privileged accounts and enabled remote management on unusual high ports.
- They activated hidden services such as the IOS XR SSH listener on port 57722, giving them stealthy long-term access.
- These actions allowed them to maintain persistence while hiding in plain sight for months or even years.
3. Collection And Lateral Movement
- The attackers mirrored traffic through SPAN, RSPAN and ERSPAN to quietly monitor communications.
- They harvested administrator credentials via TACACS+ packets.
- They pivoted across provider-to-provider links into downstream networks, then exfiltrated data through GRE and IPsec tunnels carefully designed to blend with legitimate traffic.
4. Purpose
- The campaign did not focus on quick financial gain. Instead, Salt Typhoon targeted telecom carriers, government systems, transportation hubs, lodging networks and even military infrastructure.
- The goal was clear: enable continuous surveillance of people, communications and movements across the globe.
The FBI has already notified hundreds of U.S. victims. The campaign’s footprint spans more than 80 countries, making Salt Typhoon one of the most consequential espionage operations ever revealed.
How The FBI And Allies Are Responding
The joint advisory issued on August 27 is a battle plan for defenders. It contains highly specific indicators, hunting techniques and mitigation steps designed to help organizations detect and evict Salt Typhoon operators.
- Detection And Hunting: Organizations are instructed to monitor for telltale patterns such as high-port SSH services ending in “22,” double-encoded requests targeting Cisco IOS XE and packet captures with suspicious names like “tac.pcap.” Administrators are also warned to look for unexplained tunnels, redirections of TACACS+ traffic, or the sudden creation of privileged accounts.
- Indicators And Rules: The advisory provides a robust set of indicators of compromise, including IP addresses dating back to 2021, YARA rules for Salt Typhoon’s custom tools and Snort rules tied to malicious privilege escalation attempts. This level of public technical detail is rare and underscores the seriousness of the campaign.
- Mitigation Guidance: Defenders are urged to act comprehensively. Recommendations include isolating management planes on dedicated networks, enforcing strong authentication protocols, mandating public-key login for administrators and conducting evictions as coordinated operations. Partial remediation is strongly discouraged because it risks tipping off intruders without fully removing them.
A Global Coalition
Equally important is who stood behind this announcement. In addition to the FBI, NSA and CISA, the advisory was co-signed by intelligence and cybersecurity agencies from across North America, Europe, Australia and Asia. This coalition included partners such as Australia, Canada, Japan, the United Kingdom, Germany and others.
It represents one of the broadest international responses to a cyber campaign in history. A senior European intelligence official said it plainly: “This was not just an attack on the United States. This was an attack on global trust in our communications systems.”
Why This Is A National Defense Crisis And Why Standards Help
Telecommunications networks are not just commercial assets. They are the arteries of modern economies and the nervous system of national defense. They are also one of the 16 critical infrastructure sectors that U.S. regulators have slated for increased cybersecurity standardization.
The Department of Defense is already taking the lead. Beginning in October, all new defense solicitations will require Cybersecurity Maturity Model Certification compliance. Other critical sectors are likely to follow quickly. The logic is simple: if adversaries can invisibly monitor traffic, harvest administrator credentials, and redirect data flows, they do not just steal information. They reshape the battlespace itself.
The advisory leaves no doubt that Salt Typhoon is linked to Chinese intelligence services. These activities were supported by technology firms that provide direct capabilities to the People’s Liberation Army and the Ministry of State Security. This was not cybercrime for profit. It was state-directed espionage designed to shift the balance of power.
For the United States, the implications are clear. This is why the Department of Defense is raising requirements across its supply base. The CMMC framework and compliance requirment are not red tape. It is a survival mechanism. The same techniques that compromised telecom networks can and will be used against defense contractors and their subcontractors unless standards are enforced and verified.
What Leaders Must Do Now
The lesson of Salt Typhoon is that delay is deadly. Executives, CISOs and network operators must treat this as a call to arms.
- Patch Exploited Vulnerabilities: Ivanti 2024-21887, Palo Alto PAN-OS 2024-3400, Cisco IOS XE 2023-20198 and 2023-20273 must be addressed immediately. Disable Smart Install and upgrade to supported releases.
- Isolate Management Planes: Restrict SSH, HTTPS, SNMP, TACACS+ and RADIUS to hardened management networks with explicit access controls.
- Eliminate Weak Credentials: Enforce SNMPv3, mandate multifactor authentication, require public-key login for administrators and remove defaults.
- Hunt For Anomalies: Investigate high-port SSH services, unexplained mirroring sessions, or any evidence of packet captures like “tac.pcap.” Treat these as critical.
- Plan Evictions: Assume multiple backdoors. Collect evidence, coordinate actions and eradicate simultaneously. Anything less signals awareness without achieving security.
What Individuals Can Do
While individuals cannot reconfigure backbone routers, they can shrink their personal risk surface. Set account PINs and port-out locks with carriers. Enable multifactor authentication across all accounts and avoid relying solely on SMS for MFA. Activate SIM-swap protections where available. Monitor for suspicious activity.
For those working in the defense sector, the personal responsibility is greater. Push your organization to confirm CMMC readiness now. Waiting for an audit or a breach is not an option.
The Time To Act Is Now
Salt Typhoon is a declaration from Beijing that the battle for cyberspace is global, relentless and deeply tied to national defense. It is not about a single intrusion. It is about the quiet weaponization of the internet itself.
The FBI and its partners have now illuminated the threat and provided the tools to fight it. The responsibility falls on leaders to act. Those who delay will find their networks turned into someone else’s surveillance system. Those who act swiftly will help preserve not only their enterprises but the security of their nations.
