What is Salt Typhoon? Everything you need to know about ‘the worst telecom hack in [U.S.] history’

In today’s age of digital everything, it seems hardly a day goes by without news of a new cybersecurity threat. Unfortunately, the ongoing Salt Typhoon hack is much larger and more serious than your average breach. Senate Intelligence Committee chairman Senator Mark R. Warner even labelled the Salt Typhoon attack the “worst telecom hack in [U.S.] history by far,” the hackers gaining access to numerous Americans’ data and monitoring political targets’ communications for years.

Here’s everything you need to know about the 2024 Salt Typhoon hack.

What is Salt Typhoon?

Salt Typhoon is a hacking group which is reportedly sponsored by the Chinese government. Active since 2020, the group has carried out attacks against targets in the U.S. as well as globally.

The group typically uses advanced persistent threat (APT) attacks, covertly gaining access to targeted networks and remaining there undetected for a lengthy period of time. Such methods allow attackers to gather extensive information about their targeted organisation.

Though commonly referred to as Salt Typhoon, the group has also been dubbed GhostEmperor, FamousSparrow, Earth Estries, and UNC2286. The name “Salt Typhoon” was given to it by Microsoft, which uses “Typhoon” to label all nation-state threat actors from China.

What is the Salt Typhoon telecom hack?

On Wednesday, the U.S. government disclosed that at least eight telecommunications businesses have been infiltrated by Salt Typhoon’s hackers, following reports emerging earlier this year of a state-sponsored Chinese cyberattack on internet service providers.

The 2024 Salt Typhoon hack is believed to have actually been ongoing for one or two years, and remains active even now, with Salt Typhoon allegedly still able to access many telecommunication systems. While officials are working on ridding systems of the intruders, the U.S. Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) has said it is “impossible” to tell when all the hackers will be completely evicted.

According to U.S. officials, the Salt Typhoon hack is an espionage campaign sponsored by Chinese authorities. The Chinese government has denied any involvement in the cyberattacks.

“The U.S. needs to stop its own cyberattacks against other countries and refrain from using cyber security to smear and slander China,” a spokesperson from China’s embassy in Washington said in a statement to the Associated Press.

Which U.S. telecoms are impacted by the Salt Typhoon hack?

A full list of organisations impacted by the Salt Typhoon hack has not been released, however we do know that the campaign targeted telecommunications businesses across the globe. Anne Neuberger, U.S. Deputy National Security Advisor for Cyber and Emerging Tech, stated on Wednesday that “dozens of countries” have been affected, with the U.S., Canada, Australia, and New Zealand all confirmed targets.

In the U.S., Salt Typhoon allegedly breached at least eight telecommunications businesses. The Wall Street Journal reports that this list includes:

• Verizon

• AT&T

• T-Mobile

• Lumen Technologies

Am I impacted by the Salt Typhoon hack?

U.S. officials stated that while they believe the Salt Typhoon hack did not affect every American, it has impacted “a large number” of people, most of whom were located in the greater Washington area. The hackers reportedly accessed these individuals’ metadata, such as records of numbers which had contacted each other, but not the content of such communications.

On its own merit, most of this compromised metadata appears to be of little interest to Salt Typhoon. Instead, the hackers are believed to have used such information to identify the communications of particular targeted individuals. Salt Typhoon is alleged to have been searching for corporate intellectual property as well as specific government and political targets, which reportedly included Donald Trump, Senator J.D. Vance, and people from within both Trump and Kamala Harris’ presidential campaigns.

Upon identifying them, the hackers focused on accessing these individuals’ communications, reading texts and listening in to audio calls. As of November, approximately 150 individual targets had been identified and notified, most of them within the Washington, D.C. area.

“The actors stole a large volume of records, including data on where, when, and with whom individuals were communicating,” a Federal Bureau of Investigation (FBI) official told the Washington Post.

Salt Typhoon’s hackers reportedly also accessed the U.S. law enforcement’s system for requesting wiretaps. Though officials told the Washington Post that there’s no evidence the hackers were able to listen in on the network, they may have been able to identify individuals the U.S. government is investigating.

The full scope of the Salt Typhoon hack still isn’t entirely clear. Fortunately, Neuberger has stated that no classified information is believed to have been compromised.

How is the U.S. government responding to the Salt Typhoon hack?

Tweet may have been deleted

Following nows of the Salt Typhoon cyberattack, the U.S. Federal Communications Commission (FCC) has said it is “taking decisive steps to address vulnerabilities in U.S. telecommunications network.” 

Specifically, the FCC has proposed clarifying laws which require telecommunications businesses to secure their networks against hackers. This would make clear that such security measures not only include equipment, but also how the telecommunications carriers manage their networks.

The FCC has also proposed a new annual certification requirement for telecommunications businesses, including certified compliance with new cybersecurity risk management plans.

“While the Commission’s counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, we need to put in place a modern framework to help businesses secure their networks and better prevent and respond to cyberattacks in the future,” said FCC Chairwoman Jessica Rosenworcel.

A Senate Commerce subcommittee will hold a hearing on the Salt Typhoon hack on Dec. 11 to examine security threats and protective measures.