Loading story…
Norwegian authorities publicly attributed a series of intrusions and espionage activity against multiple Norwegian organizations to Salt Typhoon, a China-linked threat actor assessed to be operating on behalf of Chinese government interests. Norway’s Police Security Service (PST) said the actor gained access by compromising vulnerable network devices, marking one of the clearest acknowledgements from a European government that the campaign has extended beyond previously reported activity in North America.
Norway’s assessment described Salt Typhoon as an example of how private Chinese cybersecurity contractors can augment Chinese security and intelligence services, and warned that Chinese cyber operations will remain a major intelligence threat to Norway in 2026. Reporting also tied Salt Typhoon to a broader pattern of stealthy targeting of critical infrastructure, including past allegations of compromises of telecommunications providers in the U.S. and Canada where communications of senior politicians were reportedly intercepted, increasing pressure on telecom operators to harden network security.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
In its threat assessment, Norway’s Police Security Service said Chinese cyber operations would remain one of the country’s most significant intelligence threats in 2026. The assessment highlighted growing use of exploited routers, servers, and other network devices for persistent access, and linked Salt Typhoon to private Chinese cybersecurity firms.
Norway publicly disclosed that the China-linked Salt Typhoon cyberespionage group compromised multiple Norwegian organizations by exploiting vulnerable network devices. The attribution came from Norway’s Police Security Service, which said the activity was part of espionage operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Norway’s Police Security Service (PST) reported that the China-linked espionage actor tracked as **Salt Typhoon** compromised *vulnerable network devices* at multiple Norwegian organizations, marking Norway as the latest country to publicly confirm Salt Typhoon-related intrusions. The disclosure appeared in PST’s 2026 annual threat assessment, which characterized Norway’s security environment as exceptionally severe and highlighted foreign intelligence pressure. PST assessed that China’s primary intelligence threat to Norway is in the cyber domain and warned that Chinese services are expected to continue mapping Norwegian digital infrastructure and collecting intelligence, alongside other hybrid tactics. Reporting also reiterated allied government assessments that **Salt Typhoon** has historically focused on telecommunications and other critical infrastructure internationally, including incidents in North America where U.S. officials said the campaign enabled interception of communications tied to senior political figures.
Jun 29, 2026
Salt Typhoon, a Chinese state-linked advanced persistent threat (APT) group, attempted to infiltrate a European telecommunications organization by exploiting a vulnerability in a Citrix NetScaler Gateway appliance. The attack was first detected by Darktrace in July 2025, when threat activity consistent with Salt Typhoon’s known tactics, techniques, and procedures (TTPs) was observed. The group, also known as Earth Estries, GhostEmperor, and UNC2286, has a history of targeting telecoms and digital infrastructure globally, with previous campaigns against U.S. telecoms and ongoing interest in European targets. Initial access was achieved through the exploitation of the Citrix NetScaler Gateway, a method frequently used by Salt Typhoon to compromise network equipment. After breaching the gateway, the attackers moved laterally within the organization, targeting Citrix Virtual Delivery Agent hosts in the Machine Creation Services (MCS) subnet. The group deployed the SNAPPYBEE (also known as Deed RAT) backdoor, a tool commonly shared among Chinese APT groups, to establish command and control (C2) within the compromised environment. The C2 infrastructure utilized LightNode VPS endpoints and communicated over both HTTP and an unidentified TCP-based protocol, demonstrating the group’s use of non-standard and layered protocols to evade detection. To maintain stealth and persistence, Salt Typhoon employed DLL sideloading techniques, delivering malicious DLLs alongside legitimate antivirus executables such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This allowed the attackers to execute their payloads under the guise of trusted software, bypassing traditional security controls. The group’s tactics included abusing legitimate software for stealth and execution, a hallmark of their operations. Darktrace analysts noted that the pattern of activity closely matched Salt Typhoon’s previous campaigns, reinforcing attribution to the group. The intrusion was detected before the attackers could achieve deeper compromise or exfiltrate sensitive data, highlighting the importance of proactive threat detection. The incident underscores the persistent threat posed by Chinese cyberespionage actors to the telecommunications sector, particularly through the exploitation of known vulnerabilities in widely used network appliances. The Five Eyes intelligence alliance and other international partners have previously warned about Salt Typhoon’s global targeting of communications infrastructure. The group’s operations are believed to be conducted by private hacking firms contracted by Chinese government agencies, as revealed by earlier data leaks. The attempted breach demonstrates the evolving sophistication of state-sponsored cyber operations and the need for robust security measures in critical infrastructure sectors. The use of advanced lateral movement, stealthy persistence mechanisms, and shared malware tools reflects the group’s technical capabilities. The incident also highlights the value of threat intelligence sharing and rapid response in mitigating nation-state cyber threats. Ongoing monitoring and patching of network equipment vulnerabilities remain essential defenses against such targeted attacks. The European telecom’s timely detection and response prevented further escalation and potential operational impact. This event adds to the growing body of evidence regarding Salt Typhoon’s focus on global telecommunications espionage.
Jun 29, 2026
U.S. officials and cybersecurity experts have highlighted the ongoing threat posed by nation-state actors, particularly the Chinese-linked group known as Salt Typhoon, which has conducted widespread cyber intrusions targeting critical American infrastructure. These campaigns have focused on stealing intellectual property, surveilling government officials, and pre-positioning within essential networks such as airports, hospitals, water treatment facilities, and telecom providers, with the intent to disrupt services or gather intelligence at a time of their choosing. The persistence and sophistication of these operations underscore the urgent need for coordinated defense efforts between government agencies and the private sector, as most critical infrastructure is privately owned or operated. Recent incidents attributed to Salt Typhoon include the compromise of multiple U.S. telecom networks, with attackers maintaining access for nearly a year before detection. These breaches exemplify the evolving nature of hybrid and cross-domain threats, where cyber intrusions can cascade into physical and reputational risks. Security leaders are being urged to adopt new, asymmetric approaches to risk management, breaking down traditional silos and ensuring that intelligence and response capabilities keep pace with the rapidly changing threat landscape.
Jul 12, 2026