← Articles and guides on fraud, cybersecurity, privacy and AML

Salt and Volt Typhoon: what is known about China's US network hacks

China-linked hackers breached US telecoms and critical infrastructure. What is publicly known about Salt Typhoon and Volt Typhoon: targets, tactics, response.

2026-10-15

Two China-linked hacking campaigns have reshaped how the United States thinks about its networks. Salt Typhoon broke into major telecom carriers and reached the systems used for court-authorized wiretaps. Volt Typhoon quietly embedded itself in power, water, transport and communications networks, in what US agencies describe as preparation for disruption in a crisis. Here is what has been made public.

Salt Typhoon: espionage through the phone network

What happened

The campaign became public in October 2024. US officials and later reporting have named Verizon, AT&T, Lumen, Charter Communications, Consolidated Communications and Windstream among affected carriers; T-Mobile said it was targeted but that hackers did not reach customer calls, texts or voicemail. According to BleepingComputer, the intruders accessed core systems used for lawful intercept requests.

Reporting compiled by TechCrunch says the hacks gave access to call records, text messages and captured audio of senior US officials, which led the FBI to recommend encrypted messaging apps. Nextgov reported that the phones of Donald Trump and JD Vance were among those targeted.

The August 2025 advisory

On August 27, 2025, the FBI, CISA, NSA and the Defense Department's Cyber Crime Center, with agencies from Australia, Canada, the Czech Republic, Finland, Germany, Italy, the Netherlands, New Zealand, Poland, Spain and the UK, published a joint alert. Key points:

The activity has been under way since at least 2019, according to FBI cyber division director Brett Leatherman.
It reached more than 80 countries and at least 200 US organizations, beyond the nine telecom victims previously identified.
The FBI notified at least 600 organizations that the group had shown interest in their systems.
Targets extend beyond telecom to government, transportation, lodging and military infrastructure.
The alert named Chinese companies said to support the operations.

A declassified DHS memo cited by Nextgov said a state's National Guard network was compromised, and that between January and March 2024 the group stole configuration files tied to other government and critical infrastructure entities.

How they got in

The main entry point has been network edge devices, especially Cisco routers. Some exploited flaws date back to 2018 and had patches that many carriers never installed. Abroad, victims or confirmed activity have been reported in Canada, the UK, Norway, the Netherlands, Italy, South Africa and Myanmar, among others, and Trend Micro observed activity in Brazil.

Why lawful intercept matters

US carriers are required by the 1994 Communications Assistance for Law Enforcement Act (CALEA) to build networks that can carry out court-ordered wiretaps. Those systems hold the targets of US surveillance requests. Reaching them gives an adversary insight into who US law enforcement is watching, on top of the content of calls and texts. Several carriers' lawful intercept systems were breached, according to Nextgov, and Viasat was reported compromised in 2025 in a way that gave access to similar tools, according to TechCrunch.

Volt Typhoon: pre-positioning in critical infrastructure

On February 8, 2024, CISA, NSA and the FBI, joined by the Energy Department, EPA, TSA and Five Eyes partners, warned that Volt Typhoon had compromised IT networks in the communications, energy, transportation and water sectors, in the continental US and in territories including Guam.

Purpose: the agencies assessed the group was pre-positioning to disrupt operations, including operational technology, during a major crisis or conflict. The activity does not fit traditional espionage.
Persistence: some intrusions lasted at least five years.
Tactics: "living off the land", using built-in tools and valid accounts to avoid detection, and exploiting internet-facing VPNs, firewalls and routers.

Researchers cited by TechCrunch link Salt Typhoon to a wider cluster of activity aimed at helping China prepare for a possible conflict over Taiwan. Taken together, the two campaigns point to different goals: Salt Typhoon collects intelligence, while Volt Typhoon appears designed to hold infrastructure at risk.

The US response

Date	Action
Feb 2024	Joint advisory on Volt Typhoon
Jan 2025	Treasury's OFAC sanctions Sichuan Juxinhe Network Technology, linked to Salt Typhoon; FCC declaratory ruling says CALEA requires carriers to secure networks
Apr 2025	State Department offers up to $10 million for information on government-linked hackers
Aug 2025	13-country Salt Typhoon advisory
Nov 2025	FCC rescinds the January 2025 ruling and withdraws proposed cyber rules for carriers

The FCC reversal is contested. The agency called the earlier ruling unlawful and ineffective and said carriers had strengthened security voluntarily. Commissioner Anna Gomez, the lone dissent, said the rollback was not a cybersecurity strategy.

What remains unknown

Whether all intruders have been removed from carrier networks. The Register reported in August 2025 that the threat was ongoing.
The full list of victims and of data stolen.
How much Volt Typhoon access remains in place after remediation efforts.

What organizations should do

The advisories converge on a short list:

Patch internet-facing devices first, prioritizing actively exploited vulnerabilities in routers, VPNs and firewalls.
Replace end-of-life equipment that no longer receives updates.
Use phishing-resistant MFA and limit administrative access to network gear.
Centralize and protect logs; living-off-the-land intrusions are only visible through good telemetry.
Hunt for persistence using the indicators published by CISA and partners.

For individuals, the FBI's advice after Salt Typhoon was simple: prefer end-to-end encrypted messaging and calling apps for sensitive conversations.