Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data

Chinese state-sponsored cyber threat group Salt Typhoon has intensified its long-term espionage operations targeting global telecommunications infrastructure. This activity is linked to the Ministry of State Security (MSS) and has been ongoing since at least 2019. Salt Typhoon systematically exploits network edge devices to establish persistence and exfiltrate sensitive communications metadata, VoIP configurations, lawful intercept data, and subscriber profiles from major telecom providers and critical infrastructure sectors worldwide.

The group operates under direct MSS oversight, utilizing a hybrid ecosystem of front companies and state-linked contractors like i-SOON (Anxun Information Technology Co., Ltd.) to obscure attribution. Public indictments and intelligence advisories have revealed that Salt Typhoon maintains operational ties to i-SOON, which provides leased infrastructure, technical support, and domain registration pipelines that facilitate offensive cyber operations.

Salt Typhoon's targeting profile includes the United States, United Kingdom, Taiwan, and European Union states, with confirmed breaches at over a dozen U.S. telecom firms, multiple National Guard networks, and allied communications providers. Within China’s broader cyber intelligence architecture, Salt Typhoon is part of the "Typhoon" taxonomy introduced by Microsoft, overlapping with other clusters such as Ghost Emperor, FamousSparrow, Earth Estrie, and UNC2286.

Salt Typhoon employs bespoke malware, living-off-the-land binaries (LOLBINs), and stealthy router implants. The group represents a state-directed cyber espionage program embedded within the operational apparatus of the People’s Republic of China (PRC). Tradecraft analysis shows consistent use of publicly trackable domains registered with fabricated U.S. personas and ProtonMail email accounts. Between 2020 and 2025, the group registered at least 45 domains using names like Monica Burch, Shawn Francis, and Larry Smith, often listing addresses in Miami or Illinois.

These domains resolve to shared DNS hosts such as value-domain.com and OrderBox, leveraging commercial DV SSL certificates issued by GoDaddy and Sectigo to appear legitimate. DNS clustering and SSL certificate overlaps expose repeatable infrastructure patterns, enabling defenders to use passive DNS clustering, certificate monitoring, and registrar telemetry to disrupt future operations before they mature into active intrusions.

Salt Typhoon exemplifies China’s evolving contractor-enabled cyber espionage model, blending state tasking with semi-private commercial tradecraft. The group’s industrialized domain management and persistent edge device implants support dual-use objectives: day-to-day intelligence collection and contingency planning for potential wartime communications disruption. By outsourcing infrastructure provisioning to front companies, the MSS achieves scalability and plausible deniability, complicating legal and diplomatic countermeasures.

For telecom operators and government defenders, key measures include baselining passive DNS and certificate telemetry for early detection of fabricated personas, monitoring ProtonMail-based registrations linked to network equipment update services, deploying anomaly detection on router and VPN gateway firmware behavior, and sharing threat intelligence on known Salt Typhoon indicators of compromise (IOCs) across Five Eyes and allied networks.

Enhanced cooperation between industry, academia, and government can further refine detection signatures and mitigate the group’s long-dwell access to critical communications infrastructure. Salt Typhoon’s blend of operational sophistication and repeatable tradecraft highlights the tension between scalability and stealth in modern state-sponsored cyber operations. Continued vigilance, infrastructure monitoring, and collaborative threat hunting represent the best defense against this advanced MSS-directed espionage program.

Based on reporting by GBHackers.