CISA First Spotted Salt Typhoon Hackers in Federal Networks

The U.S. federal government’s first hint that Chinese hackers penetrated American telecommunications infrastructure came from telemetry on government networks. That allowed threat hunters at the Cybersecurity and Infrastructure Security Agency to quickly provide technical assistance the private sector, said CISA Director Jen Easterly.

The telecom industry and the federal government are months into a concerted effort to eject a Chinese threat actor tracked as Salt Typhoon from domestic telecom networks, a campaign that became public in the weeks before the November 2024 election with news that individual targets included President-elect Donald Trump. Salt Typhoon has been active since August 2019. Verizon and AT&T in late December said they’ve permanently eradicated the Chinese intrusion (see: AT&T and Verizon Say Chinese Hackers Ejected From Networks).

“We saw this before we understood it was Salt Typhoon,” Easterly said at a Wednesday event hosted by the Foundation for Defense of Democracies. CISA and law enforcement partners were able to gain access to copies of data stored on virtual private servers, which led to “cracking open the larger Salt Typhoon.”

CISA itself has declined to provide a timeline of when telecoms will be clear of Salt Typhoon. On Wednesday, Easterly said foreign adversaries like China remain “relentlessly focused on holding our critical infrastructure at risk.” Federal officials have said Salt Typhoon hackers do not appear to have compromised classified information.

“Even as we’ve successfully eradicated numerous Chinese intrusions into critical infrastructure across multiple sectors, we know that what we have found is likely just the tip of the iceberg,” she wrote in a blog post published Wednesday.

CISA published guidance in December urging senior political officials to adopt encrypted communications and other mobile security measures with specific recommendations for iPhone and Android users to help mitigate vulnerabilities. The agency also recently released strengthened visibility and security guidance for communications infrastructure, offering recommendations for network vendors in response to the persistent threat posed by attackers (see: US CISA Endorses Encrypted Apps Amid Chinese Telecom Hack).

“The threats posed by the PRC are real and persistent, and we anticipate they will continue evolving through 2025 and beyond,” Easterly wrote. “But these threats are not insurmountable.”