Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data
Recent intelligence reports have identified intensified cyber-espionage activities by the Chinese state-sponsored group known as Salt Typhoon. This group, aligned with China's Ministry of State Security (MSS), has been active since at least 2019,…
Recent intelligence reports have identified intensified cyber-espionage activities by the Chinese state-sponsored group known as Salt Typhoon. This group, aligned with China's Ministry of State Security (MSS), has been active since at least 2019, targeting global telecommunications infrastructure.
Salt Typhoon exploits network edge devices to establish persistence and exfiltrate sensitive data, including communications metadata and subscriber profiles, from major telecom providers worldwide. The group operates under MSS oversight, using front companies and contractors, such as i-SOON, to obscure its activities. i-SOON provides infrastructure, technical support, and domain registration services that facilitate these operations.
The group's activities have impacted telecommunications networks in the United States, United Kingdom, Taiwan, and European Union states. Salt Typhoon's operations are part of China's broader cyber intelligence architecture, known as the "Typhoon" taxonomy, which includes other clusters such as Ghost Emperor and FamousSparrow.
Salt Typhoon's campaigns utilize custom malware, LOLBINs, and router implants. The group registers domains with fabricated U.S. personas and ProtonMail accounts, a notable operational lapse. Between 2020 and 2025, at least 45 domains were registered using names like Monica Burch and Shawn Francis.
Recent intelligence reports have identified intensified cyber-espionage activities by the Chinese state-sponsored group known as Salt Typhoon.
These domains leverage shared DNS hosts and commercial DV SSL certificates from providers like GoDaddy and Sectigo to enhance credibility. This predictable infrastructure pattern allows for attribution and monitoring by defenders.
Salt Typhoon exemplifies China's contractor-enabled cyber espionage model, blending state tasking with commercial tradecraft. The group's domain management and device implants support intelligence collection and potential wartime communications disruption.
The MSS outsources infrastructure provisioning to companies like Sichuan Juxinhe, achieving scalability and complicating countermeasures. Telecom operators are advised to monitor DNS and SSL activities, deploy anomaly detection, and share threat intelligence.
Enhanced collaboration between industry, academia, and government is essential to refine detection and mitigate Salt Typhoon's access to critical infrastructure. Continued vigilance and infrastructure monitoring remain crucial defenses against this advanced MSS-directed program.
Based on reporting by GBHackers.