Loading story…
A Chinese state-sponsored hacking group, identified as Salt Typhoon and linked to China’s Ministry of State Security, breached email systems used by staffers on key U.S. House committees. The targeted committees included the House Select Committee on China, as well as panels overseeing foreign affairs, intelligence, and armed services. The breach, detected in December 2025, exposed sensitive communications and raised concerns about Beijing gaining insights into U.S. policy deliberations, military strategy, and counter-espionage measures. U.S. officials and cybersecurity experts highlighted the operation’s stealth and the ongoing threat posed by Chinese cyber-espionage campaigns against American legislators and government systems.
The incident is part of a broader pattern of Chinese cyber operations targeting U.S. government entities to collect sensitive data. While the Chinese Embassy denied the allegations, the FBI and other agencies have not commented due to ongoing investigations. Previous campaigns by Salt Typhoon included intrusions into major U.S. telecommunications networks, further demonstrating the group’s capabilities and intent. The breach underscores persistent vulnerabilities in government email systems and the escalating cyber tensions between Washington and Beijing.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Following public reporting, the Chinese embassy rejected the allegations and called them unfounded. U.S. officials, including the FBI, did not provide substantive public comment because of the ongoing investigation.
News reports disclosed the incident and identified Salt Typhoon, a group linked by researchers and officials to China's Ministry of State Security, as the suspected actor behind the breach. The reporting highlighted the strategic intelligence value of congressional staff communications related to China policy, foreign affairs, intelligence, and military matters.
The compromise was discovered in December 2025, prompting investigation into the scope and impact of the intrusion on congressional staff networks. Officials indicated the full extent of exposed data remained unclear at the time of detection.
A cyberespionage operation attributed to the Chinese threat actor Salt Typhoon breached email systems used by U.S. congressional staffers supporting the House Select Committee on China and committees overseeing foreign affairs, intelligence, and armed services. The intrusion reportedly exposed sensitive but unclassified communications and metadata, though there was no public evidence that lawmakers' own accounts were accessed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcenextgov.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. officials and cybersecurity experts have highlighted the ongoing threat posed by nation-state actors, particularly the Chinese-linked group known as Salt Typhoon, which has conducted widespread cyber intrusions targeting critical American infrastructure. These campaigns have focused on stealing intellectual property, surveilling government officials, and pre-positioning within essential networks such as airports, hospitals, water treatment facilities, and telecom providers, with the intent to disrupt services or gather intelligence at a time of their choosing. The persistence and sophistication of these operations underscore the urgent need for coordinated defense efforts between government agencies and the private sector, as most critical infrastructure is privately owned or operated. Recent incidents attributed to Salt Typhoon include the compromise of multiple U.S. telecom networks, with attackers maintaining access for nearly a year before detection. These breaches exemplify the evolving nature of hybrid and cross-domain threats, where cyber intrusions can cascade into physical and reputational risks. Security leaders are being urged to adopt new, asymmetric approaches to risk management, breaking down traditional silos and ensuring that intelligence and response capabilities keep pace with the rapidly changing threat landscape.
Jul 12, 2026
China-linked hacking groups were reported to have penetrated a wide range of targets across the United States and allied regions, including manufacturers, U.S. government email systems, internet providers, and major telecommunications networks. Earlier reporting described broad economic espionage aimed at stealing trade secrets from manufacturing sectors in the U.S., Europe, and Asia, while later disclosures said Chinese operators breached U.S. government email accounts through Microsoft cloud infrastructure and infiltrated American internet providers for surveillance. Subsequent investigations tied the telecom intrusions to the **Salt Typhoon** campaign, which officials said exposed sensitive metadata and provided insight into U.S. surveillance targets. U.S. officials characterized the activity, alongside related operations such as **Volt Typhoon**, as one of the most serious cyber threats to American critical infrastructure in recent years. Reporting said investigators believed the attackers may have retained access to at least eight telecom firms, including **Verizon** and **AT&T**, and that the campaign extended to dozens of telecoms and government agencies. In response, the Biden administration moved to bar the remaining U.S. operations of **China Telecom Americas**, citing national security risks and signaling the first public retaliatory step tied to the telecom compromises, even as debate continued over broader sanctions, technology restrictions, and offensive cyber responses.
Jun 29, 2026
Two individuals associated with the Chinese state-sponsored hacking group Salt Typhoon were identified as former participants in the Cisco Networking Academy, raising concerns about the unintended consequences of global IT training programs. These individuals, Yuyang and Qiu Daibing, later became co-owners of companies implicated in Salt Typhoon's operations, which targeted Cisco devices and exploited vulnerabilities to conduct extensive cyberespionage campaigns against Western targets, including U.S. presidential candidates and telecommunications infrastructure. Salt Typhoon's campaign, first publicly reported in September 2024, compromised over 80 telecommunications companies worldwide, enabling the interception of unencrypted calls, texts, and even breaching lawful intercept (CALEA) systems. The operation highlights the risk that foreign training initiatives may inadvertently enhance the offensive cyber capabilities of adversarial states, especially as China moves to reduce reliance on American-made IT products. U.S. government advisories have warned about Salt Typhoon's sophisticated exploitation of Cisco vulnerabilities to obtain credentials and move laterally within targeted networks.
Jun 29, 2026