Loading story…
Officials say the Salt Typhoon espionage campaign against U.S. telecommunications providers continues to shape policy debates, but weak public concern is undermining efforts to impose stronger cybersecurity requirements on the sector. The campaign compromised at least 10 U.S. telecom companies and provided broad access to phone data affecting millions of Americans, yet state and federal officials report that many residents do not view telecom espionage as an urgent threat in the same way they would attacks on power grids or water systems.
Officials and experts argue that the abstract nature of telecom data theft, combined with broader public desensitization to privacy loss, has made it harder to build political momentum for tougher rules. New Jersey officials highlighted the challenge of explaining why Chinese access to call records and related telecom data matters to the public, while security experts warned that the absence of sustained public pressure could stall regulatory action intended to strengthen the cybersecurity posture of U.S. telecommunications infrastructure.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
By March 2026, federal and state officials and cybersecurity experts said public apathy toward the Salt Typhoon telecom intrusions was slowing momentum for stronger U.S. telecom cybersecurity regulations. They contrasted the limited reaction with greater concern over China-linked critical infrastructure threats such as Volt Typhoon.
Federal investigators assessed that Salt Typhoon targeted communications data from roughly 40 phones tied to senior U.S. officials and political figures, including Donald Trump, JD Vance, staffers to Senate Majority Leader Chuck Schumer, and Vice President Kamala Harris's campaign. The disclosure added specific high-profile targeting details beyond the previously reported telecom-provider compromises.
The Biden administration established a multi-agency team to respond to the escalating Chinese espionage campaign targeting U.S. telecommunications companies. Officials treated the intrusions as a major national security issue requiring coordinated federal action.
Chinese state-backed hacking group Salt Typhoon conducted a multi-year espionage campaign that breached at least 10 U.S. telecommunications companies. The intrusions gave the attackers broad access to phone data affecting millions of Americans, with one account describing the impact as reaching nearly all Americans.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
nextgov.com
Open sourcego.theregister.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcepolitico.com
Open sourcewashingtonpost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A senior FBI cyber intelligence official warned that **Salt Typhoon**, a China-linked cyber espionage group tied to the widespread compromise of telecommunications infrastructure disclosed in 2024, remains an active and broad threat to U.S. public- and private-sector organizations. Speaking at *CyberTalks* in Washington, D.C., FBI Deputy Assistant Director Michael Machtinger said organizations that engaged early with the FBI and agencies such as **CISA** were more successful at mitigating the impact of the intrusions, and he emphasized that the campaign largely exploited **basic security weaknesses** rather than relying primarily on zero-days. Machtinger also assessed that Salt Typhoon is likely retaining stolen data “**in perpetuity**” for future surveillance and exploitation, noting uncertainty about how the PRC intends to use the information but expressing confidence it could enable follow-on operations. Reporting highlighted that the group accessed **dozens of telecom providers globally** in a multi-year effort and, in the U.S., targeted sensitive communications by accessing **“lawful intercept”** systems used for court-ordered wiretaps; it remains unconfirmed whether the actors have been fully removed from affected American networks. The FBI official further stated that Salt Typhoon “for certain” stole information from **well over a million Americans directly**, reinforcing the long-term counterintelligence and privacy risk posed by persistent access and large-scale data theft from telecom environments.
Jun 29, 2026
Major U.S. telecommunications providers have formed the **Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC)** to strengthen real-time threat sharing and collective defense after the China-linked **Salt Typhoon** campaign compromised carrier networks in the United States and abroad. The intrusions, described by Sen. Mark Warner as the worst telecom hack in U.S. history, affected multiple major providers including **AT&T, Verizon, Lumen Technologies, T-Mobile**, and others, with investigators saying the activity has been ongoing since at least 2019 and there is still no clear public evidence the threat actors have been fully removed from communications networks. Officials and reporting said the espionage campaign enabled attackers to move between telecom networks, exfiltrate large volumes of data, and in some cases listen to audio calls in real time while targeting high-value intelligence, government, and political communications. Investigators also found breaches of U.S. lawful intercept systems used for court-ordered surveillance, while a separate suspected China-linked compromise of an FBI surveillance system likely exposed phone numbers of monitored targets; the campaign has also been linked to exploitation of vulnerabilities in **Cisco** routers to gain access to telecom infrastructure.
Jun 29, 2026
U.S. policymakers and researchers have highlighted the **Salt Typhoon** compromises of telecommunications providers as a major counterintelligence and cybersecurity concern, with implications extending beyond immediate network intrusion to long-term interception of sensitive communications. A Congressional Research Service brief describes the hacks as significant breaches of telecom infrastructure that could affect government, commercial, and private-sector communications, underscoring the federal response and the strategic risk posed when adversaries gain access to core communications environments. Related research argues that the most dangerous follow-on activity may be **passive collection** of encrypted traffic that victims cannot reliably detect from inside their own networks. The analysis says so-called “harvest now, decrypt later” operations leave no endpoint, network, or logging artifacts when collection occurs off-path over fiber, cellular, radio, or satellite links, meaning conventional tools such as IDS, EDR, SIEM, and DLP cannot confirm such surveillance; instead, organizations with long-lived sensitive data are urged to prioritize **post-quantum cryptography migration**, including `ML-KEM` and hybrid key-establishment approaches, rather than rely on claims of HNDL detection.
Jul 14, 2026