In the fall of 2024, US investigators confirmed that Salt Typhoon had penetrated nine major US telecommunications carriers: AT&T, Verizon, T-Mobile, Charter/Spectrum, Lumen Technologies, Consolidated Communications, Windstream, and two others unnamed. Beyond the US, compromised organizations span 80+ countries and 600+ organizations across six continents.

What Salt Typhoon accessed:

Call metadata from 1M+ users. Date/time stamps, source/destination IPs, phone numbers. Concentrated in the Washington DC area, targeting government officials, political figures, and intelligence community personnel.

Real-time call interception. Recorded calls and text messages from fewer than 100 high-profile individuals, including presidential candidates (Trump, Vance) and senior government officials.

FBI wiretap target lists. Nearly complete lists of phone numbers currently under court-authorized surveillance. This is the counterintelligence damage that experts call "catastrophic": a foreign intelligence service now knows exactly who US law enforcement is monitoring.

1,462 network configuration files from approximately 70 government agencies and critical infrastructure organizations across 12 sectors (disclosed June 2025 DHS memo).

National Guard networks compromised for nearly a year (disclosed July 2025).

Initial access: Exploitation of public-facing endpoints, particularly Cisco routers that form the backbone of carrier networks. Also VPN, firewall, and Exchange server vulnerabilities. Spearphishing with malware payloads. Supply chain compromise via firmware updates and telecom equipment. The exact initial entry vector for the major carrier breaches has not been fully disclosed.

Custom tooling: GhostSpider backdoor provides persistent access to compromised telecom infrastructure with modular capabilities for long-term espionage. Purpose-built for telecom network environments.

Network-level operations: Salt Typhoon operates inside core network infrastructure, targeting routers and switches that handle traffic routing, not endpoint servers. They reconfigure network protocols, intercept communications at the transport layer, and access network management systems. This is infrastructure-level compromise, not endpoint compromise.

Dwell time: At least 3 years confirmed in one carrier's network (Cisco report, 2025). The group was present in multiple carriers for well over a year before discovery. Operational since at least 2019 based on earliest known infrastructure.

1. 1. Audit core network device integrity Salt Typhoon targets Cisco routers and core switching infrastructure. Check for: unauthorized configuration changes, unexpected ACLs or route policies, firmware integrity against vendor-published hashes, unauthorized management plane access, and new administrative accounts on network devices. If your core routers have been modified, the attacker controls your traffic. NET: C2 · Cisco IOS integrity verification · Network device configuration management
2. 2. Review lawful intercept and CALEA system access If you operate telecom infrastructure with CALEA obligations: audit all access to lawful intercept systems, review who has queried wiretap provisioning interfaces, and check for unauthorized data exports from intercept databases. These systems are the primary intelligence target, not an incidental one.
3. 3. Check for GhostSpider and related implants Search for: unknown persistent processes on telecom infrastructure hosts, processes establishing long-lived outbound connections to unusual IPs, and binaries with no known provenance in system directories. GhostSpider is purpose-built for telecom environments and may not match generic endpoint malware signatures. HOST: Persistence · HOST: Execution
4. 4. Baseline and monitor network management plane access SSH, SNMP, NETCONF, and any proprietary management interfaces on routers and switches. Any management plane access from an unauthorized source IP, at an unexpected time, or using credentials that don't match your admin accounts should be investigated. Salt Typhoon operates at the network device level, not the server level. NET: SSH/SNMP connection logs · AAA server (TACACS+/RADIUS) audit
5. 5. Audit network configuration export and backup activity The June 2025 DHS disclosure revealed 1,462 stolen network configuration files. Check for: unauthorized TFTP/SCP/SFTP exports of running configs, unexpected access to configuration management databases, and network automation platforms (Ansible, Puppet, Chef) with unauthorized execution history. TFTP/SCP server access logs · Configuration management audit trail
6. 6. Monitor for metadata collection indicators CDR (Call Detail Record) databases, billing systems, and subscriber databases are intelligence targets. Check for: bulk queries against CDR systems, unauthorized access to subscriber lookup interfaces, and data exports from billing/provisioning platforms. Metadata collection is the primary intelligence objective.
7. 7. Check for traffic interception and protocol manipulation Salt Typhoon reconfigures routing to intercept communications. Check for: new or modified port mirror/SPAN configurations, unexpected GRE tunnels or MPLS LSPs, route policy changes that redirect specific traffic, and any encapsulation of traffic that shouldn't be encapsulated. Packet capture at core network boundaries for traffic that's being copied to unexpected destinations. NET: Arkime/Zeek on core network taps · Router SPAN session audit
8. 8. Review VPN and remote access infrastructure Salt Typhoon exploits VPN concentrators, firewalls, and edge devices. Same CVE-class exploitation as Volt Typhoon but targeting telecom-specific infrastructure. Audit patch status of all internet-facing network appliances, check for unauthorized VPN configurations, and verify that management interfaces are not exposed. NET: Initial Access · Edge device firmware validation
9. 9. Check for lateral movement between IT and telecom network segments Telecom operators maintain separate IT (corporate) and telecom (carrier) network segments. Salt Typhoon bridges these. Check for: traffic between segments that bypasses normal demarcation points, credentials valid across both environments, and management system access patterns that cross segment boundaries. HOST: Lateral Movement · Network segmentation validation
10. 10. Coordinate with CISA and sector ISAC Salt Typhoon is an active, ongoing national security investigation. If you identify indicators consistent with this campaign, coordinate with CISA (AA25-239A), the Communications ISAC, and the FBI Cyber Division. This is not an incident you handle alone: the scope is cross-carrier and cross-agency.

Both are PRC-affiliated, both target US critical infrastructure, and both exploit the same detection blind spots (legitimate tools, long dwell times). But they serve different strategic objectives:

Volt Typhoon: Pre-positioning for disruption. Targets energy, water, transportation. Uses zero custom malware (pure LOTL). The objective is to have access ready for activation during a crisis. They want to be able to turn things off.

Salt Typhoon: Intelligence collection. Targets telecommunications. Uses custom malware (GhostSpider) and operates at the network infrastructure level. The objective is to know what the US government is saying, who they're monitoring, and how their communications infrastructure works. They want to listen.

For defenders: Volt Typhoon hunts focus on endpoint behavioral anomalies and authentication baselines. Salt Typhoon hunts focus on network device integrity, management plane access, and traffic routing anomalies. Different detection surfaces for different operational models.

CISA AA25-239A (September 2025): Joint advisory on Salt Typhoon TTPs with MITRE ATT&CK mapping.
FBI Director statement (February 2026): Threat remains "very, very active" in US networks.
DHS memo (June 2025): 1,462 network config files stolen from 70 government agencies across 12 sectors.
NBC News (July 2025): National Guard networks compromised for nearly a year.
Recorded Future (December 2024-January 2025): University telecommunications research programs targeted.

Volt Typhoon (PRC infrastructure targeting, different objective: disruption vs collection)
Air-Gapped OT / ICS (network segmentation principles applicable to telecom/IT separation)
Compromised Credentials (management plane credential compromise)
APT41 (Chinese state-sponsored with different targeting profile)