FBI Warns Salt Typhoon Telecom Intrusions Remain an Ongoing Risk

A senior FBI cyber intelligence official warned that Salt Typhoon, a China-linked cyber espionage group tied to the widespread compromise of telecommunications infrastructure disclosed in 2024, remains an active and broad threat to U.S. public- and private-sector organizations. Speaking at CyberTalks in Washington, D.C., FBI Deputy Assistant Director Michael Machtinger said organizations that engaged early with the FBI and agencies such as CISA were more successful at mitigating the impact of the intrusions, and he emphasized that the campaign largely exploited basic security weaknesses rather than relying primarily on zero-days.

Machtinger also assessed that Salt Typhoon is likely retaining stolen data “in perpetuity” for future surveillance and exploitation, noting uncertainty about how the PRC intends to use the information but expressing confidence it could enable follow-on operations. Reporting highlighted that the group accessed dozens of telecom providers globally in a multi-year effort and, in the U.S., targeted sensitive communications by accessing “lawful intercept” systems used for court-ordered wiretaps; it remains unconfirmed whether the actors have been fully removed from affected American networks. The FBI official further stated that Salt Typhoon “for certain” stole information from well over a million Americans directly, reinforcing the long-term counterintelligence and privacy risk posed by persistent access and large-scale data theft from telecom environments.