Executive Summary

Between March and December 2024, Salt Typhoon extensively compromised the Army National Guard network of an unidentified U.S. state. A June 11, 2025 Department of Homeland Security Office of Intelligence and Analysis memorandum, obtained through a Freedom of Information Act request and circulated in June, described the incident; public reporting began in July 2025 (bleepingcomputer.com ; nbcnews.com ). The intrusion persisted for approximately nine months, but the sources do not provide an exact discovery date or a separate resolution date (bleepingcomputer.com ).

U.S. reporting attributes the activity to Salt Typhoon, described as a PRC-associated or Chinese state-sponsored cyber-espionage actor. The National Guard Bureau confirmed the compromise, while China’s embassy disputed that the United States had produced “conclusive and reliable evidence” linking the group to the Chinese government (bleepingcomputer.com ; nbcnews.com ).

Reportedly exfiltrated or accessed information included administrator credentials, network configuration, network-traffic diagrams, a map of geographic locations throughout the state, and service-member personally identifiable information. The actor also collected the compromised network’s configuration and data traffic with counterpart networks in every other state and at least four U.S. territories; the sources do not establish that all such counterpart traffic or configuration was exfiltrated (bleepingcomputer.com ; meritalk.com ). No source provides a count of affected people, records, devices, or financial loss. The exposure was significant because credentials and topology data could support follow-on intrusions into other Guard units and state-level cybersecurity partners; DHS warned that successful expansion could undermine local protection of critical infrastructure (bankinfosecurity.com ).

The National Guard Bureau stated that assigned state and federal missions had not been prevented, that security protocols were in place, and that it was coordinating with DHS and other federal partners while investigating the full scope (securityweek.com ). The full scope and eradication status were not publicly disclosed; an expert also questioned how confident the Guard was that all remnants had been neutralized (news.clearancejobs.com ).

Incident Overview

Timeline and disclosure

• January–March 2024: Salt Typhoon exfiltrated configuration files associated with other U.S. government and critical-infrastructure entities, including at least two state agencies. At least one file later informed the compromise of a vulnerable device on another U.S. government network (industrialcyber.co ). This was related Salt Typhoon activity, not established as activity involving the Guard network.
• March–December 2024: The actor extensively compromised the Army National Guard network of an unidentified state. The reported nine-month period is the most specific public duration; one interview characterized it as “close to nine months” and qualified the dates as belief rather than a confirmed forensic interval (bleepingcomputer.com ; federalnewsnetwork.com ).
• Discovery: One expert account says the foothold lasted nine months before detection, but public sources do not identify the discovery date, detection source, or elapsed time from detection to containment; this does not establish an exact nine-month forensic interval (news.clearancejobs.com ).
• June 11, 2025: DHS Office of Intelligence and Analysis issued the memorandum “Salt Typhoon: Data Theft Likely Signals Expanded Targeting.” The memo summarized Department of Defense findings and warned that the compromise could facilitate attacks on other Guard units and state-level cybersecurity partners (commerce.senate.gov ).
• June–July 2025: The memo circulated after being obtained through a FOIA request by Property of the People. NBC News first reported the compromise and other reports followed; these are disclosure dates, not the breach date (nbcnews.com ; dailysecurityreview.com ).

Affected infrastructure and information

Officials said Salt Typhoon targeted multiple Army National Guard networks between March and December 2024, but the extensive-compromise details concern one unnamed state network; the sources do not establish that every targeted network was successfully compromised (meritalk.com ). The directly identified victim was one state’s Army National Guard network; the state and the specific Guard unit were not named. The compromised environment contained or provided access to network configuration and traffic with counterpart networks in every other U.S. state and at least four territories (meritalk.com ). Reported data categories were administrator credentials, network diagrams, traffic or configuration information, a geographic map of locations throughout the state, and service-member PII (bleepingcomputer.com ). The sources do not quantify affected systems, accounts, people, records, or traffic volume (meritalk.com ).

Organizational and official actions

The National Guard Bureau confirmed the compromise, stated that assigned missions continued, and said it could not provide specific attack or response details. It reported ongoing investigation, security protocols intended to mitigate further risk and contain potential data compromises, and coordination with DHS and other federal partners (bleepingcomputer.com ). DHS said it was analyzing the activity and coordinating with the Guard and partners; neither agency publicly disclosed a completed containment, eradication, recovery, or notification sequence (meritalk.com ).

The public record contains no incident-specific statement from a network vendor or telecommunications provider establishing that GuardNet was the intrusion vector. Nextgov expressly reported that it remained unclear whether GuardNet components were used (nextgov.com ).

Technical Root Cause Analysis

Evidence status

The public record does not establish a complete technical root cause for this intrusion. One NJCCIC account says investigators concluded that entry occurred through a weakly configured remote-access service, followed by lateral spread and control of several privileged accounts (cyber.nj.gov ). Other reporting says the breach method was not disclosed or only attributes the compromise generally to exploitation of CVEs (bleepingcomputer.com ; csoonline.com ). These accounts cannot be reconciled into a confirmed product-level attack chain.

SecurityWeek reports that Salt Typhoon exploited known vulnerabilities in Cisco and Palo Alto Networks edge devices for initial access and lists CVE-2018-0171, CVE-2023-20198, CVE-2023-20273, and CVE-2024-3400 (securityweek.com ). The source does not say which, if any, was used against the Guard network, nor does it identify affected models, software versions, patch state, or CVSS scores. BleepingComputer gives the same historical vulnerability set: Cisco IOS/IOS XE Smart Install remote code execution in CVE-2018-0171; unauthenticated remote access through the Cisco IOS XE web UI in CVE-2023-20198; IOS XE privilege escalation and root command execution in CVE-2023-20273; and unauthenticated command injection in Palo Alto PAN-OS GlobalProtect in CVE-2024-3400 (bleepingcomputer.com ). Those descriptions characterize prior Salt Typhoon activity, not a forensic finding for this incident.

Reconstructed chain

The defensible reconstruction is therefore conditional and does not establish a single chain:

1. NJCCIC reports weakly configured remote access as the Guard case’s entry route. Separately, broader reporting describes Salt Typhoon exploitation of exposed, vulnerable edge devices, but does not tie a listed CVE or edge device to this victim (cyber.nj.gov ; cyber.nj.gov ).
2. NJCCIC reports that the actor spread across the Guard environment and obtained control of several privileged accounts (cyber.nj.gov ). The public material does not identify the authentication protocol, escalation path, host boundaries crossed, or whether MFA was present or bypassed.
3. Sources report collection or access involving configuration, network diagrams, traffic, geographic information, administrator credentials, and service-member PII. They do not establish that these items were collected in the stated order or that collection occurred after privilege escalation; the data included traffic with counterpart Guard networks in every other state and at least four territories (meritalk.com ).
4. DHS assessed that the resulting credential and topology exposure could facilitate follow-on access to other Guard units and state cybersecurity partners. In related activity, at least one stolen configuration file informed compromise of a vulnerable device at another government agency (industrialcyber.co ).

Control and architecture failures

The evidence identifies a reported weakly configured remote-access service and privileged-account control. It also supports potential, rather than proven, gaps in remote-access hardening, privileged-identity governance, configuration protection, and monitoring; the sources do not establish each as a confirmed architectural failure (cyber.nj.gov ). The nine-month reported period may be consistent with monitoring or logging gaps, but that is a hypothesis, not a diagnosis of the Guard’s failed controls. An expert account notes that unmanaged or unmonitored assets are less likely to send logs to a security operations center and may run old firmware or software (federalnewsnetwork.com ).

The public evidence does not identify a cryptographic failure, a protocol defect, a code defect, a zero-day, or a specific trust configuration. The interviewee instead assessed that Salt Typhoon often uses vulnerabilities that have existed in the wild for a long time rather than zero-days (federalnewsnetwork.com ). No source provides code, commands, log excerpts, CVSS ratings, product versions, or a confirmed Guard-specific exploit. Consequently, claims that one listed CVE caused the breach would exceed the evidence.

Attack Vector and Methodology

Initial access and foothold

The reported incident-specific entry point is not fully resolved. NJCCIC states that investigators attributed entry to a weakly configured remote-access service; other sources say the initial access method was not disclosed (cyber.nj.gov ; bleepingcomputer.com ). The broader actor profile is exploitation of Internet-facing edge devices such as VPNs, firewalls, routers, and network appliances, including old vulnerabilities and misconfigurations (cyber.nj.gov ). No source identifies the Guard device, exploit, malware, or command-and-control endpoint used to establish the foothold.

Salt Typhoon maintained access from March through December 2024, approximately nine months. The period and duration are supported by the DHS memo reporting, although one expert qualified the dates as “I believe” (bleepingcomputer.com ; federalnewsnetwork.com ).

Lateral movement and privilege

NJCCIC reports that the actor spread across the environment and controlled several privileged accounts (cyber.nj.gov ). The sources do not describe the exact path, protocols, hosts, or commands. More generally, NJCCIC describes Salt Typhoon as harvesting credentials, using legitimate or compromised passwords, and pivoting through compromised third-party or contractor systems; these are actor-level TTPs and are not all confirmed for this Guard intrusion (cyber.nj.gov ). Industrial Cyber separately quotes an official saying Chinese actors used legitimate credentials to maintain persistence in a broader campaign, not necessarily this incident (industrialcyber.co ).

Persistence and evasion

The actor’s broader methodology is stealth-oriented and long-lived. Reporting describes living-off-the-land behavior, use of legitimate or trusted environmental assets, log deletion, encrypted traffic, and deletion of other indicators (cyber.nj.gov ; federalnewsnetwork.com ). A separate expert account says the group combines known tools with custom backdoors and may operate without conventional malware, making detection difficult (news.clearancejobs.com ). These are actor-level TTPs; the public record does not identify which backdoor, tool, log deletion, or encryption behavior occurred in this case.

Collection and exfiltration

Reported activity was consistent with intelligence collection, but the sources do not state that this objective was confirmed through forensic evidence. The actor collected the compromised network’s configuration and data traffic with counterpart networks in every other state and at least four territories. It exfiltrated or obtained administrator credentials, network-traffic diagrams, a state geographic map, and service-member PII (bleepingcomputer.com ). Network diagrams and credentials could support follow-on intrusions; in related Salt Typhoon activity, a stolen configuration file later informed compromise of a vulnerable device at another government agency (industrialcyber.co ).

Infrastructure and detection

Historical Salt Typhoon exploitation used leased IP addresses to mask activity. BleepingComputer lists 43.254.132[.]118, 146.70.24[.]144, 176.111.218[.]190, 113.161.16[.]130, 23.146.242[.]131, and 58.247.195[.]208 as associated with exploitation of the group’s listed vulnerabilities. These six addresses, like the four CVEs, are historical or broader campaign indicators and are not linked to the Guard intrusion; they are not incident-specific IOCs (bleepingcomputer.com ). The public sources do not provide Guard-specific IOCs, hashes, domains, malware, commands, or a detection alert. They report only that the foothold was detected after a period described by an expert as nine months, without identifying how (news.clearancejobs.com ).

Impact Assessment

The compromise exposed a state Army National Guard network for approximately nine months. Reported data included administrator credentials, network configuration, network-traffic diagrams, a geographic map of locations throughout the state, and service-member personally identifiable information (bleepingcomputer.com ). The actor also collected the compromised network’s configuration and data traffic with counterpart networks in every other U.S. state and at least four U.S. territories; the sources do not quantify or fully characterize exfiltration of counterpart data (meritalk.com ).

The National Guard Bureau stated that the attack did not prevent the Guard from accomplishing assigned state or federal missions (nbcnews.com ). That statement addresses reported mission continuity, not confidentiality or future integrity and availability risk. No source reports downtime, destruction, manipulation, casualties, financial loss, or a confirmed count of affected systems, accounts, service members, records, or PII fields (securityweek.com ).

Collateral and national-security impact

The principal documented concern was enablement of future access. DHS assessed that the compromise likely provided data useful for hacking other states’ Guard units and possibly many state-level cybersecurity partners (bankinfosecurity.com ). Credentials and topology could expose state cyber-defense posture and personnel work locations. Federal News Network’s expert discussion further explains that detailed diagrams may reveal device roles, communications, and network choke points; the choke-point implication is expert analysis, not a confirmed Guard-specific consequence (bankinfosecurity.com ; federalnewsnetwork.com ). In 14 states, Guard units are integrated with fusion centers that share threat information; in at least one state, a Guard unit directly provides network-defense services (meritalk.com ). DHS warned that compromise of partners could hamstring their ability to defend critical infrastructure during a crisis or conflict (industrialcyber.co ).

Broader campaign context—not the Guard incident’s affected-record count: DHS reporting attributed 1,462 stolen network configuration files to approximately 70 U.S. government and critical-infrastructure entities across 12 sectors in 2023 and 2024 (securityweek.com ). At least one related configuration file informed a later government-network device compromise, but the sources do not establish that the file came from the Guard compromise or that this was a downstream effect of it (industrialcyber.co ).

Longer-term consequences

The full scope remained under investigation, and public reporting does not establish that every other state or territory network was compromised as a result of this incident (meritalk.com ). Broader reporting describes Salt Typhoon as capable of long persistence, including a Cisco report’s example of access lasting up to three years; that is actor-level context and is not evidence that this Guard intrusion lasted that long (nbcnews.com ). The sources identify no Guard-specific legal penalty or regulatory fine; the principal documented institutional consequence was continuing federal investigation and coordination with DHS and other partners (bleepingcomputer.com ).

Evidence status

Recommendations and Prevention

The following combines source-backed recommendations with separately labeled analyst advice. It does not represent reported remediation completed by the National Guard.

1. Apply source-backed vulnerability and edge-device controls

Patch the listed historical vulnerabilities where applicable, disable unnecessary services, segment SMB traffic, implement SMB signing, and enforce access controls (bleepingcomputer.com ). Maintain an inventory of VPNs, routers, firewalls, and embedded network devices, track firmware support, and address unmanaged or unmonitored devices; Federal News Network emphasizes patch currency and ignored embedded devices (federalnewsnetwork.com ). The four CVEs are historical Salt Typhoon exploitation information and are not established as the Guard exploit.

2. Harden remote access and identities

NJCCIC recommends layered defenses, MFA, review of recent account activity after suspected intrusion, credential updates, and review of router and firewall rules for unauthorized changes. It also recommends monitoring suspicious authentication attempts, unscheduled configuration changes, and anomalous traffic, segmenting environments, and coordinating with sector ISACs and NJCCIC (cyber.nj.gov ). As analyst advice beyond those source recommendations, organizations could use phishing-resistant hardware-backed authentication, just-in-time privilege, credential vaulting, and independently authenticated security zones. These implementation choices are not reported actions or requirements from the cited breach sources.

3. Block exposed services and protect communications

DHS recommendations reported by BankInfoSecurity include blocking SMB exposure, enabling secure sign-ins, using strong encryption, and enforcing least-privilege access (bankinfosecurity.com ). These controls directly address the reported risk from exposed services, stolen credentials and network information. Additional deny-by-default egress or cross-boundary authorization is analyst advice, not a source-reported DHS requirement.

4. Improve auditing, monitoring and segmentation

DHS recommended hardening network devices and maintaining proper auditing and logging of network activity; NJCCIC recommended monitoring authentication, configuration changes and anomalous traffic (bleepingcomputer.com ; cyber.nj.gov ). Federal News Network notes that unmanaged assets may not send logs to a SOC and that actors may delete logs (federalnewsnetwork.com ). As analyst advice, organizations may centralize tamper-resistant telemetry, restrict configuration export and control collection egress; immutable logs and automated isolation are proposed controls, not reported source recommendations.

5. Adopt Zero Trust and breach containment

MeriTalk reports a private-sector recommendation to accelerate Zero Trust and go further with a breach-containment strategy so services and data remain secure when an attacker has compromised one network segment (meritalk.com ). As analyst incident-response advice, a suspected foothold should prompt review and rotation of privileged credentials, trusted rebuilding of affected edge devices, hunting across connected environments, and repeated validation after recovery. No supplied source reports that these steps were taken in this incident. Continuous examination rather than periodic review is also recommended by the expert quoted by ClearanceJobs (news.clearancejobs.com ).

Conclusion

U.S. reporting describes a PRC-associated Salt Typhoon actor, with attribution disputed by China, extensively compromising one unnamed state’s Army National Guard network between March and December 2024. The reported exposure included administrator credentials, network diagrams, geographic information, service-member PII, and collection of configuration and traffic involving counterpart networks; the sources do not establish that all counterpart data was exfiltrated or that other Guard networks were successfully compromised (nbcnews.com ; bleepingcomputer.com ).

The evidence status is mixed. NJCCIC reports weakly configured remote access and privileged-account control for the Guard case, while other sources do not disclose the initial method. Historical CVEs, IP addresses and broader Salt Typhoon TTPs should not be treated as Guard-specific indicators. The principal documented implication is that stolen credentials and topology could facilitate follow-on intrusions; related configuration-file compromises are not established as downstream effects of this Guard incident.

The National Guard reported continuing missions, investigation, containment protocols and coordination with DHS, but the full scope and eradication status were not publicly confirmed (securityweek.com ). Source-backed prevention measures include patching and hardening edge devices, disabling unnecessary services, SMB protections, secure sign-ins, strong encryption, least privilege, MFA, segmentation, monitoring, credential and rule review, and coordination with sector partners. Zero Trust and breach containment are additional recommendations reported by MeriTalk; the more specific implementation controls in this report are labeled analyst advice rather than completed remediation.

• National Guard was hacked by China's 'Salt Typhoon' ...
• Salt Typhoon - NJCCIC - NJ.gov
• DHS: Salt Typhoon hackers breached Army National Guard, exposing ...
• DHS, National Guard Confirm Salt Typhoon Attacks on Guard Networks
• How Salt Typhoon breached the National Guard
• Chinese hackers breached National Guard to steal network configurations
• Salt Typhoon hacks into National Guard systems a 'serious ...
• Salt Typhoon Hit National Guard Network in 'Extensive' Hack
• Salt Typhoon hacked the US National Guard for 9 months, and accessed networks in every state
• Salt Typhoon hackers compromise a state's Army National Guard network
• Cantwell Seeks Digital Forensics Expert's Assessments of AT&T and Verizon Network Security After Chinese Salt Typhoon Hack
• China's Salt Typhoon Hacked US National Guard - SecurityWeek
• China's 'Salt Typhoon' Hacker Group Lurked Inside U.S. National Guard Network for Nearly a Year
• Reconfiguring U.S. Cyber Strategy in the Wake of Salt Typhoon
• National Guard Data Breach Exposes Ongoing Threat of State-Sponsored ...
• Chinese State-Backed Hackers Breach U.S. Army National Guard Network in Espionage Campaign
• Defense Industrial Base Sector Threat Analysis Report | NJCCIC