Executive Summary

Salt Typhoon was a China-linked cyber-espionage campaign against U.S. telecommunications providers. The incident is dated 2024-09-25 for this report only; this is report metadata/designation, not a source-confirmed forensic breach date. Public reporting first described the broader compromise in September 2024, while later government statements said the campaign had likely operated for one to two years before disclosure (therecord.media ). By December 2024, officials said at least eight U.S. providers had been targeted; a ninth U.S. operator was subsequently identified as affected, although contemporaneous sources use different terms and do not provide a reconciled victim count (techcrunch.com telecompaper.com ). Reported victims included AT&T, Verizon, T-Mobile and Lumen; Charter, Windstream and Consolidated Communications are included in the report’s breach description, but are not identified in the supplied source notes as a complete or independently reconciled victim list. The ninth operator was not named.

U.S. and partner agencies attributed related activity to PRC state-sponsored actors and linked it to Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology, and Sichuan Zhixin Ruijie Network Technology, companies described as providing cyber products or services to Chinese intelligence organizations (cisa.gov nsa.gov ). This is attribution of related activity, not an unqualified finding that every operation described here was conducted by Salt Typhoon or by one of those companies. NJCCIC assessed Salt Typhoon as operating for China’s Ministry of State Security, but the government advisory deliberately used the generic term “APT actors,” said the activity only partially overlaps with commercial Salt Typhoon reporting, and cautioned that commercial labels do not map one-to-one to its clusters (cyber.nj.gov cisa.gov nsa.gov ).

The actors reportedly accessed telecommunications infrastructure associated with law-enforcement surveillance-request data and, in some accounts, surveillance-related systems; collected customer call data and metadata; and accessed private communications involving government and politically prominent individuals. Officials said a large number of Americans’ metadata was taken; congressional testimony separately described more than one million users, but the record does not establish a single authoritative count (therecord.media csis.org congress.gov ). The campaign’s significance was access to carrier control and surveillance-adjacent systems, enabling intelligence collection at population scale. Verizon reported no day-to-day operational impact for its incident; NJCCIC reported no Viasat outage in a separate related account. These reports do not establish the absence of outages across the campaign (verizon.com cyber.nj.gov ).

Providers contained or investigated their environments with federal agencies and private firms. Verizon reported containment confirmed by an independent cybersecurity firm and no continuing activity “for some time”; AT&T reported no nation-state activity “at this time” (verizon.com techcrunch.com ). The FBI sought public information in April 2025 and offered a $10 million reward, while Treasury’s OFAC sanctioned Sichuan Juxinhe on January 17, 2025 for direct involvement with RedMike activity (cybersecuritydive.com https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices ). A multinational advisory issued in August 2025 documented related activity; full scope and initial access remained unresolved (nsa.gov cisa.gov ).

Incident Overview

Chronology

• 2021 onward: The multinational advisory places related malicious operations globally since at least 2021. Separately, researchers estimated that the telecom campaign began up to two years before the November 2024 CSIS entry, and officials later described one-to-two years of activity (cisa.gov csis.org therecord.media ). The report’s designated breach date is 2024-09-25 only; the sources do not independently provide a forensic start date for that specific carrier compromise.

• September–October 2024: Reporting in September identified compromises of major U.S. telecommunications providers. In early October, CISA and the FBI publicly confirmed unauthorized PRC-affiliated access to commercial telecommunications infrastructure (tenable.com ). The sources do not provide a carrier-by-carrier discovery chronology.

• November 2024: CSIS recorded at least eight U.S. providers and telecom providers in more than twenty other countries. It reported theft of customer call data, law-enforcement surveillance-request data, and private communications of people involved in government or political activity; researchers believed the campaign was still infecting networks (csis.org ). Ashurst/Perkins Coie reports that the FBI, CISA and partners announced in November 2024 that PRC-affiliated actors had compromised major global telecommunications providers in a broad cyber-espionage campaign; the supplied article does not provide a precise date for that announcement (ashurstperkinscoie.com ).

• December 2024: White House officials said eight U.S. telecommunications giants and providers in multiple other countries were affected. Anne Neuberger described the campaign as likely one to two years old, and officials said attackers remained in some systems (therecord.media ). On December 27, a ninth operator was reportedly identified as affected; on December 30, AT&T and Verizon publicly acknowledged impact (techcrunch.com ). Verizon said a small number of government or politically involved individuals were targeted and that a small percentage of other customers’ mobile internet and call records were accessed (verizon.com ).

• January 2025: Recorded Future documented a related December 2024–January 2025 campaign against Cisco devices and reported that Treasury’s OFAC sanctioned Sichuan Juxinhe on January 17 for direct involvement with RedMike (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices) . The research observed seven compromised devices communicating with associated infrastructure, but did not establish that those devices represented the full carrier campaign.

• April 2, 2025: A House hearing discussed up to 18 months of undetected access, more than one million publicly associated users, CALEA architecture, and uncertainty about individual notification (congress.gov ).

• April 24–28, 2025: The FBI requested public information about the actors and offered a $10 million reward. Telecom companies were reported to be working with U.S. authorities to investigate and remediate, while the government continued to assess scope (cybersecuritydive.com ).

• August 22–27, 2025: A joint CSA dated August 22 and announced August 27 by NSA, CISA, FBI and international partners described related activity, CVEs, indicators and TTPs (nsa.gov ). The advisory stated that initial access remained a critical information gap and that its generic APT designation only partially overlapped with commercial Salt Typhoon reporting (cisa.gov ).

Scope and organizational response

Public accounts describe affected carrier infrastructure, management systems, traffic paths and subscriber or call-record data. Separately, the CISA advisory describes related activity targeting backbone, provider-edge and customer-edge routers, with collection of subscriber information, traffic, configurations and credentials; because CISA says its generic APT activity only partially overlaps with commercial Salt Typhoon reporting, those detailed TTPs should not be treated as a definitive inventory of every asset in the named carrier campaign (cisa.gov therecord.media ). The complete U.S. victim list, exact affected-user count and affected-record volume remained undisclosed; the ninth operator was not named (telecompaper.com ).

Verizon said it contained the incident, notified targeted customers, coordinated with law enforcement and security partners, and found no reason to believe banking, financial or Social Security information was exposed; those findings apply to Verizon’s account (verizon.com ). AT&T and Verizon said their networks were secured; the independent firm validating Verizon’s statement was not named (techcrunch.com ). Congress subsequently examined CALEA and telecom architecture, while the White House formed a daily Unified Coordination Group and urged carrier cooperation (therecord.media ). The House hearing nevertheless recorded uncertainty about whether more than one million potentially affected users were individually notified (congress.gov ).

Technical Root Cause Analysis

Confirmed and reported entry weaknesses

The strongest technical evidence concerns a related RedMike activity set targeting unpatched, internet-facing Cisco IOS XE devices. Recorded Future assessed that CVE-2023-20198, described in that activity set as a Cisco IOS XE web-UI privilege-escalation vulnerability affecting version 16 and earlier, provided initial access. The actor then used the newly created local account and CVE-2023-20273 to obtain root privileges (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices) . Cybersecurity Dive similarly described CVE-2023-20198 as a web-UI privilege-escalation flaw and CVE-2023-20273 as the related flaw used for root access, while noting that Cisco could not validate Insikt Group’s exploitation reports (cybersecuritydive.com ). This is evidence for a campaign component, not proof that every carrier intrusion used the same chain or version scope.

The multinational advisory identifies the following example vulnerabilities in its related activity:

• CVE-2024-21887: Ivanti Connect Secure/Policy Secure command injection, commonly chained after CVE-2023-46805, an authentication bypass.
• CVE-2024-3400: PAN-OS GlobalProtect arbitrary file creation leading to OS command injection and unauthenticated RCE on affected configurations.
• CVE-2018-0171: Cisco IOS/IOS XE Smart Install RCE.
• CVE-2023-20198 and CVE-2023-20273: Cisco IOS XE web-management authentication bypass and post-authentication command injection/privilege escalation, respectively, in CISA’s characterization (cisa.gov ). Recorded Future characterizes CVE-2023-20198 differently for RedMike, as the initial privilege-escalation vulnerability in that activity set (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices) .

Tenable separately lists CVE-2021-26855 (Microsoft Exchange ProxyLogon), CVE-2022-3236 (Sophos Firewall code injection), CVE-2023-48788 (FortiClientEMS SQL injection), and the two Ivanti vulnerabilities. The CVSSv3 values are CVE-2021-26855 9.8, CVE-2022-3236 9.8, CVE-2023-48788 9.8, CVE-2024-21887 9.1, and CVE-2023-46805 8.2; Tenable’s VPR values are respectively 9.8, 7.4, 9.4, 9.8 and 6.7 in the source’s table (tenable.com ). The sources do not establish which of these vulnerabilities affected the named carriers. They also do not establish Salt Typhoon use of any as a zero-day: four were exploited in the wild as zero-days, but Salt Typhoon’s status is unknown (tenable.com ).

Cisco exploit chain

For CVE-2023-20198, the advisory describes abuse of Cisco Web Services Management Agent endpoints /webui_wsma_Http and /webui_wsma_Https to bypass authentication and create unauthorized administrative accounts. Requests could use double-encoded paths such as /%2577eb%2575i_%2577sma_Http and /%2577eb%2575i_%2577sma_Https; hunting therefore must tolerate case variation and over-encoding (cisa.gov ). Recorded Future describes the next step as issuing a privilege 15 command to create a local user and password, followed by CVE-2023-20273 to reach root (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices) . This is a documented related-campaign chain, not an established report-wide root cause; CISA says initial access remains a critical information gap and the sources do not establish that the named carriers used this chain.

Credential and cryptographic failures

The advisory observed Cisco Type 5 MD5 and Type 7 weak or reversible credentials, including cisco/cisco, being brute-forced or reused. Common SNMP community strings included public and private. In one case, a TACACS+ shared secret was stored with Cisco Type 7 reversible encoding; offline recovery could therefore expose authentication traffic captured from TCP/49 (cisa.gov ). This was not a break of modern cryptography; it was exposure created by reversible credential storage, weak defaults and access to packet captures in the advisory’s related activity.

The architecture also permitted provider-to-provider and provider-to-customer trust paths to be abused. The advisory reports that related actors targeted backbone, provider-edge and customer-edge routers, modified routes, enabled SPAN/RSPAN/ERSPAN mirroring, and established GRE, mGRE or IPsec tunnels. It reports collection of TACACS+, RADIUS, routing, subscriber and configuration data, including authentication traffic (cisa.gov ). CALEA’s evolution from dedicated connections to remotely managed, internet-connected and intermediary-mediated wiretap infrastructure expanded the potential attack surface; congressional testimony characterized that design as an enlarged tampering and surveillance risk, not as forensic proof that every carrier’s CALEA systems were accessed. Amoroso also testified that the intrusion did not use Huawei backdoors or Huawei equipment as an attack component (congress.gov ).

Control failures and mitigating factors

The sources describe exposure of management interfaces, delayed patching, weak or reused credentials, insufficient segmentation, inadequate logging and insufficient monitoring of configuration and routing changes as conditions that could facilitate related activity. Tenable found 91% of nearly 30,000 anonymized ProxyLogon instances unpatched, while more than 92% of over 20,000 devices affected by both Ivanti vulnerabilities were fully remediated in its separate anonymized analysis; these are vendor scan statistics, not measurements of the named carriers (tenable.com ). CISA states that zero-day exploitation had not been observed “to date” in the activity covered by its advisory, and that initial access remained a critical information gap (cisa.gov ). Thus the record supports extensive exploitation of known weaknesses in related activity, but not a single confirmed root cause for the entire breach or a confirmed novel zero-day.

Attack Vector and Methodology

Initial access and foothold

The best-documented access path was exploitation of internet-facing Cisco IOS XE management interfaces in the related RedMike activity set. RedMike attempted exploitation against more than 1,000 devices during six observed dates from December 4, 2024 through January 23, 2025; researchers identified more than 12,000 Cisco devices with web UIs exposed to the internet (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices cybersecuritydive.com ). The actor exploited CVE-2023-20198, created a privileged local account, then used CVE-2023-20273 to obtain root access in that reported activity (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices) .

The Cisco flaws had been disclosed in October 2023 as zero-day vulnerabilities under widespread exploitation, according to Cybersecurity Dive; that describes the vulnerabilities’ disclosure/exploitation status, not whether Salt Typhoon used them as zero-days. CISA separately says zero-day exploitation had not been observed “to date” in the activity covered by its advisory (cybersecuritydive.com cisa.gov ). The broader campaign also used exposed VPNs, firewalls and routers, unpatched CVEs, misconfigurations, compromised passwords and pivots through third-party or contractor systems (cyber.nj.gov ). The government advisory does not identify a single initial-access method for all cases and calls that information a critical gap (cisa.gov ).

Reconnaissance and privilege escalation

Reported reconnaissance included mapping telecommunications and enterprise structures, hardware and software versions, and administrator routines. Recorded Future documents periodic scanning and selection of telecom-associated infrastructure; more than half of the Cisco targets in the RedMike research were in the United States, South America and India, with the remainder distributed across more than 100 countries (cyber.nj.gov https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices ). The sources do not establish that every intrusion began with this sequence.

After obtaining device administration in the CISA advisory’s related activity, operators used local and service credentials, including RANCID credentials, SNMP commands and SSH. On IOS XR they enabled sshd_operns on TCP/57722, created local user cisco with password cisco, added sudo authorization through /etc/sudoers or /etc/sudoers.d/, and obtained host root. The advisory records chmod 4755 /usr/bin/sudo; its purpose was unclear (cisa.gov ).

Persistence, lateral movement and collection

In the CISA advisory’s related activity, persistence was achieved through unauthorized accounts and keys, ACL changes, nonstandard management ports, high-port SSH, IOS XE web UI exposure and GRE tunnels. The observed RedMike Cisco chain added a generic routing encapsulation tunnel for persistent access and exfiltration (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices) . Operators used provider-to-provider and provider-to-customer trust relationships to pivot through compromised routers, and modified static routes and routing behavior in the advisory’s case material (cisa.gov ).

The CISA advisory reports that related actors enabled SPAN/RSPAN/ERSPAN mirroring or Cisco Embedded Packet Capture, targeted TACACS+ and RADIUS traffic, and collected subscriber information, call records, metadata, configurations, inventories, credentials and in-transit traffic. One reported capture targeted TACACS+ TCP/49, used monitor capture mycap ..., wrote tac.pcap, and exported it through FTP/TFTP (cisa.gov ). These details are observed in the advisory’s generic APT activity and should not be treated as definitively used in every named carrier intrusion.

The CISA advisory also reports that, on Cisco IOS XE and NX-OS, related actors used Guest Shell and Linux containers to stage tools, process configurations and PCAPs, move laterally and run Python, including siet.py; operators installed packages with pip or yum and later used guestshell disable or destroy. STOWAWAY supplied encrypted multi-hop relays, shells, file transfer, SOCKS5/HTTP proxying and port mapping (cisa.gov ). Custom web shells, living-off-the-land techniques and legitimate administrative tools reduced visibility in NJCCIC’s general Salt Typhoon assessment (cyber.nj.gov ).

Evasion and exfiltration

In the CISA advisory’s related activity, operators cleared or deleted logs, disabled forwarding, altered stored configurations and made actions appear to originate from local IP addresses. They used VPS infrastructure, compromised intermediate routers, NAT/proxy noise and separate command-and-control channels. GRE, mGRE and IPsec tunnels moved data through trusted network paths; one advisory case reported GRE and MPLS tunnels returning data to China (cisa.gov ).

The advisory identifies custom Go SFTP clients for encrypted archives. The following is an abbreviated IOC list: cmd1 has MD5 33e692f435d6cf3c637ba54836c63373, SHA-256 f2bbba1ea0f34b262f158ff31e00d39d89bbc471d04e8fca60a034cabe18e4f4, size 3,358,720 bytes, version V20240816, and build path C:/work/sync_v1/cmd/cmd1/main.go; cmd3 has MD5 eba9ae70d1b22de67b0eba160a6762d8, SHA-256 8b448f47e36909f3a921b4ff803cf3a61985d8a10f0fe594b405b92ed0fc21f1, size 3,506,176 bytes, version v1.0, and build path C:/work/sync/cmd/cmd3/main.go. Their command forms are ./cmd1 <encrypted_configuration_string> and ./cmd3 <encrypted_configuration_string>; the advisory also says cmd1 collects packet captures (cisa.gov ).

Detection and objective

Public reporting reflects multiple government, provider and private-sector investigations rather than a disclosed single detection chain. Verizon said an independent firm confirmed containment, while Cisco said it could not validate the specific Insikt claims despite continuing review (verizon.com cybersecuritydive.com ). The campaign was reported to involve reconnaissance and edge-device compromise, trusted-network access, and collection or potential access to communications metadata, customer call data, lawful-surveillance-request data and selected private communications (csis.org therecord.media ).

For detection and response, CISA advises hunting WSMA endpoints /webui_wsma_Http and /webui_wsma_Https, including case variations and over-encoded paths; auditing TCP/57722, TACACS+ TCP/49, high-port SSH, ACLs often named access-list 20, tunnels, Guest Shell activity and unexpected XR sudo accounts. Before disabling suspicious activity, responders should capture live processes, sockets and on-box files, coordinate containment sequencing because partial actions can alert actors and conceal access elsewhere, and protect hunting details because actors may monitor administrator devices or accounts (cisa.gov ).

Impact Assessment

Affected infrastructure and data

The campaign was publicly reported to involve at least eight U.S. providers by December 2024, with a ninth U.S. operator subsequently identified as affected; providers in more than twenty other countries were also reported affected (csis.org telecompaper.com ). These are contemporaneous public estimates with different meanings: The Record described eight U.S. telecommunications giants, Telecompaper described a ninth affected operator, and TechCrunch described a ninth victim. They are not a reconciled victim count. Public reporting named Verizon, AT&T, T-Mobile and Lumen among the U.S. victims, while the breach description additionally identifies Charter, Windstream and Consolidated Communications; the supplied sources do not provide a consistently defined complete list (therecord.media telecompaper.com techcrunch.com ).

Reported impacts included stolen customer call data and law-enforcement surveillance-request data, and private communications involving government or politically active individuals (csis.org ). NJCCIC says investigators found access in some cases to surveillance-related systems; the hearing discussed CALEA architecture and potential attack-surface risk. These accounts do not establish that every named carrier’s CALEA or surveillance systems were accessed (cyber.nj.gov congress.gov ). Officials also reported that a large number of Americans’ metadata was taken, potentially enabling selection of individuals for access to calls (therecord.media ). Congressional testimony described more than one million users, but did not establish a forensic count of affected people or communications (congress.gov ). These figures are estimates or public characterizations, not a reconciled record count.

Operational, customer and national-security effects

The intrusion was primarily an intelligence-collection event. The Record reported interception of correspondence of senior officials in both presidential campaigns, including President-elect Donald Trump and JD Vance, and separately reported access to communications of some senior U.S. government and political officials (therecord.media ). These reports should not be generalized to all campaign staff or treated as a single quantified content-access finding. Verizon said a small number of government or politically involved individuals were targeted and that a small percentage of other customers’ mobile internet and call records were accessed; it said those other customers were not believed to be targeted (verizon.com ). Officials reported that they did not believe classified communications had been compromised (therecord.media ).

The cited sources do not report a carrier outage, destructive action, financial loss or confirmed misuse of the collected data across the campaign. Separately, Verizon reported no day-to-day operational impact for its incident and NJCCIC reported no Viasat outage in a related account (verizon.com cyber.nj.gov ). Verizon also said it had no reason to believe banking or financial information, or Social Security numbers, were exposed; that negative finding applies to Verizon’s account, not the entire campaign (verizon.com ). The strategic consequence was reported loss of confidentiality in a critical communications layer and exposure of lawful-intercept-related information. Congressional testimony warned that CALEA-related capabilities could enable unauthorized surveillance at scale, while effective end-to-end encryption can prevent infrastructure compromise from disclosing message content (congress.gov ).

Legal, regulatory and reputational consequences

The campaign triggered federal and multinational investigations, congressional scrutiny and a White House Unified Coordination Group that met daily (therecord.media ). The FBI requested public tips and offered a $10 million reward in April 2025 (cybersecuritydive.com ). Treasury’s OFAC sanctioned Sichuan Juxinhe on January 17, 2025; Recorded Future describes the sanction as based on direct involvement with RedMike activity and exploitation of U.S. telecommunications and ISP companies, not as a source-established finding covering every Salt Typhoon operation (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices) . Providers faced notification and public-assurance issues: Verizon said targeted customers were notified, while the House hearing recorded uncertainty about whether more than one million potentially affected users were individually notified (verizon.com congress.gov ). The incident also intensified criticism that telecom architecture and regulation prioritized efficiency over security (therecord.media ).

Recommendations and Prevention

The following source-backed controls are separated from analyst-derived engineering proposals. The sources do not establish that any one control would have prevented this incident.

Prioritize management-plane isolation and edge-device remediation

Place router, firewall, IOS XE web UI, SNMP and SSH management interfaces in dedicated out-of-band networks or VRFs with default-deny ACLs, no direct internet exposure and tightly controlled administrative egress. CISA recommends dedicated management planes, restricted egress, SSHv2, HTTPS-only management, SNMPv3, disabling unused ports and protocols, and replacing unsupported devices (cisa.gov ).

Maintain an authoritative inventory of internet-facing edge devices, map each to vendor-supported software, and enforce remediation deadlines for known exploited vulnerabilities. Prioritize Cisco IOS XE CVE-2023-20198 and CVE-2023-20273 in the related RedMike activity, Cisco Smart Install exposure and other edge CVEs identified by CISA; remove or isolate devices that cannot be patched. Recorded Future and Cybersecurity Dive recommend prioritizing exposed devices, patching the Cisco flaws, monitoring configuration changes and avoiding public administration interfaces (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices cybersecuritydive.com ). Tenable’s anonymized data found 91% of nearly 30,000 ProxyLogon instances unpatched; that statistic illustrates delayed patching but is not carrier-specific (tenable.com ). These measures would likely reduce exposure but would not address stolen credentials or a trusted, already-compromised management path.

Strengthen privileged identity and credential protection

Require strong authentication for privileged and service-management paths, rotate credentials after suspected exposure, prohibit default accounts, and use public-key authentication where appropriate. CISA specifically recommends Type 8 credentials and Type 6 encrypted secrets rather than Type 7/Type 5, while cautioning defenders to disable unused protocols and protect AAA (cisa.gov ). Apply this guidance according to the supported credential use case; Type 8 and Type 6 are not interchangeable replacements for every authentication mechanism. Hardware-backed MFA and per-command AAA accounting are additional report recommendations, not controls specifically prescribed by the cited sources. They would likely limit some credential-based paths but would not stop an unauthenticated web-UI flaw before account creation.

Treat routing, mirroring and egress as security-sensitive state

Continuously monitor configuration, route, ACL, SPAN/RSPAN/ERSPAN, packet-capture, tunnel, AAA and high-port changes. Default-deny router egress and explicitly authorize GRE, IPsec, FTP/TFTP, SFTP and provider-to-provider paths; alert on unauthorized TCP/49, TCP/57722, high-port SSH and new router-to-router logons. CISA recommends immutable centralized logging, AAA command accounting, routing authentication, strict BGP filtering and prefix limits, protected VPN IKE settings, and hunting for tunnels, captures, Guest Shell activity, unexpected XR sudo accounts, ACL denies, VTY outbound connections and Smart Install exposure (cisa.gov ). CISA also recommends disabling unnecessary Guest Shell, auditing TCP/57722 and disabling HTTP where not required (cisa.gov ). Signed configuration pipelines and cryptographic attestation are analyst-derived proposals; they may strengthen change control but are not source-stated findings or recommendations.

Sequence threat hunting and incident response carefully

Before disabling suspicious activity, capture live processes, sockets and on-box files; coordinate containment because partial actions can alert actors and lead them to conceal access elsewhere; then eradicate access comprehensively. Protect hunting and response details because actors may monitor mail servers or administrator devices and accounts. These sequencing recommendations come from CISA and NSA guidance (cisa.gov nsa.gov ). Hunt WSMA endpoint variants, access-list 20 and related ACL changes, high-port SSH patterns, TCP/49, TCP/57722, tunnels, SPAN/RSPAN/ERSPAN, Guest Shell cleanup, PCAPs, FTP/TFTP, unexpected XR sudo accounts and router-to-router logons (cisa.gov ).

Protect sensitive communications and isolate surveillance functions

Use effective end-to-end encrypted communications for sensitive information. Recorded Future and congressional testimony support encryption as a way to protect message content from infrastructure compromise, while the hearing warns that endpoints remain vulnerable; encryption does not prevent collection of call metadata, subscriber data or lawful-intercept request records (https://www.recordedfuture.com/research/redmike-salt-typhoon-exploits-vulnerable-devices congress.gov ).

The hearing supports infrastructure redesign, rejecting cryptographic backdoors, information sharing, regulatory simplification and active defense. Separately, the report recommends isolating CALEA-related or other lawful-intercept functions in least-privilege mediation zones with independent identity, approval and audit paths, dual authorization and cryptographic separation of content and metadata. Those design details are analyst-derived recommendations, not specific controls stated by the hearing. They respond to the hearing’s architectural assessment that moving wiretap connections from dedicated links to remotely managed internet connections and intermediaries weakened earlier safeguards (congress.gov ).

Conclusion

The public record supports a serious, multinational telecommunications espionage campaign involving access to carrier infrastructure, customer call data, surveillance-request data and communications of selected government or politically involved individuals. It does not provide a reconciled victim list, affected-user count or universal finding that every named carrier’s lawful-intercept systems were accessed. Verizon’s negative findings and containment statements apply to Verizon’s account, while broader public reports describe continuing uncertainty about scope and notification.

The most defensible prevention priorities are to remove internet exposure from management planes, patch and retire unsupported edge devices, protect privileged credentials, authenticate and monitor routing and configuration state, preserve independent logs, and use end-to-end encryption for sensitive content. Organizations should follow CISA’s live-artifact capture and coordinated-containment guidance before taking visible response actions, and should share compromise details with appropriate authorities (cisa.gov ).

The final evidentiary limitation is material: CISA says initial access remains a critical information gap, and the advisory’s generic APT activity only partially overlaps with commercial Salt Typhoon reporting. Accordingly, its detailed Guest Shell, IOS XR, tunnel, packet-capture and SFTP observations should be used as related-activity hunting leads, not assumed to be forensic facts about every carrier intrusion. The record distinguishes observed, reported and assessed activity from recommendations; that distinction should remain explicit in future investigations (cisa.gov nsa.gov ).

• Countering Chinese State-Sponsored Actors Compromise U.S. Telecommunications and Government Networks
• NSA and Others Provide Guidance to Counter China State-Sponsored Actors Targeting Telecommunications Providers
• Verizon provides update on Salt Typhoon matter
• At least 8 US telcos, dozens of countries impacted by Salt Typhoon breaches, White House says
• RedMike (Salt Typhoon) Targets Cisco Telecom Networks
• US identifies ninth telecom operator impacted by Salt Typhoon
• Salt Typhoon: Securing America's Telecommunications from Cybersecurity Threats
• Salt Typhoon - NJCCIC
• FBI seeks public tips about Salt Typhoon
• AT&T and Verizon say networks are secure after being breached by China-linked Salt Typhoon group
• Salt Typhoon: An Analysis of Vulnerabilities Exploited by This State-Sponsored Actor
• China-backed hackers continue cyberattacks on telecom companies
• Significant Cyber Incidents
• Salt Typhoon Cyberattacks: Updated Threat Assessment and Recommended Mitigations