The Federal Bureau of Investigation (FBI) has issued a public alert seeking information on individuals linked to the sophisticated cyber-espionage campaign known as “Salt Typhoon,” attributed to actors affiliated with the People’s Republic of China (PRC).
The campaign has resulted in the compromise of multiple U.S. telecommunications companies, marking one of the most significant breaches of critical infrastructure in recent years.
Scope and Impact of the Breach
Salt Typhoon’s operations, first publicly disclosed in late 2024, have been characterized by their breadth and indiscriminate targeting.
According to the FBI, the attackers infiltrated at least nine major U.S. telecom providers and accessed systems responsible for facilitating lawful intercepts—platforms designed to fulfill court-ordered law enforcement requests for call data and communications.
The campaign enabled the theft of call data logs, unauthorized access to a limited number of private communications, and the copying of select information subject to U.S. legal processes.
A senior FBI official described the breach as “remarkable for its gigantic and seemingly indiscriminate collection of call records and data about American people,” underscoring the attackers’ ambition and the potential long-term impact on privacy and national security.
Notably, the compromised data included information not only on adults but also on minors, raising concerns about the enduring risks posed by such large-scale data exfiltration.
Technical Aspects and Methods
Investigations have revealed that Salt Typhoon leveraged advanced persistent threat (APT) tactics to gain and maintain unauthorized access to telecom networks.
The attackers exploited vulnerabilities in network infrastructure, including Cisco platforms, and targeted systems that manage lawful intercepts, which are typically subject to stringent security controls.
Their ability to bypass these defenses highlights the campaign’s technical sophistication.
In response, the FBI and its partners—including the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and allied cyber defense agencies—have issued joint guidance on “Enhanced Visibility and Hardening” for communications infrastructure.
This guidance emphasizes the need to remove unnecessary internet-facing assets, monitor critical systems, and continuously validate network architecture to mitigate future threats.
Ongoing Investigation and Call for Public Assistance
The FBI, in coordination with other federal agencies, continues to investigate the full scope of Salt Typhoon’s activities.
The campaign remains active, with evidence of ongoing targeting of additional networks worldwide.
Authorities are particularly interested in information that could identify the individuals behind Salt Typhoon or shed light on their methods and infrastructure.
To incentivize public cooperation, the U.S. Department of State’s Rewards for Justice (RFJ) program is offering up to $10 million for information leading to the identification or location of foreign government-linked individuals engaged in malicious cyber activities against U.S. critical infrastructure, in violation of the Computer Fraud and Abuse Act (CFAA).
How to Report Information
Anyone with relevant information is urged to contact their local FBI field office, file a report via the FBI’s Internet Crime Complaint Center (IC3), or submit tips to the RFJ program through secure channels, including Signal and a Tor-based tip line.
Protecting U.S. Critical Infrastructure
The FBI reiterated its commitment to defending the nation’s telecommunications sector, stating, “We are dedicated to identifying, mitigating, and disrupting Salt Typhoon’s malicious cyber activity.”
The agency encourages organizations to review the latest security guidance and to report any suspicious activity promptly.
As the investigation continues, the FBI and its partners remain vigilant, working to strengthen cyber defenses and safeguard the privacy and security of Americans against evolving nation-state threats.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
%20(1).webp?w=1200&resize=1200,0&ssl=1&description=The campaign has resulted in the compromise of multiple U.S. telecommunications companies, marking one of the most breaches of critical infrastructure in recent years.){kind=link}