Norway Says Salt Typhoon Hackers Hit Vulnerable Systems

The Norwegian government said it was among the targets of Salt Typhoon, offering one of the clearest public acknowledgements yet from a European government that the Chinese nation-state cyberespionage campaign spread beyond the U.S. and into allied infrastructure.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

An annual threat assessment by Norwegian Police Security Service described Salt Typhoon as a Chinese cyberthreat actor linked to private Chinese cybersecurity firms and “an example of an actor who has compromised vulnerable network devices in Norwegian organizations.”

Salt Typhoon reflects “the central role of private contractors in Chinese cyber operations” and “how they help enhance the capacity of Chinese security and intelligence services,” the report added.

Norwegian officials said Chinese cyber operations are expected to remain one of the country’s most significant intelligence threats in 2026, with security services warning that Chinese intelligence organizations have expanded their operational capacity through cyber operations and human-source recruitment. The report describes cyber operations as a primary method used by foreign intelligence services in Norway. State-backed actors increasingly exploit vulnerabilities in routers, servers and other network devices to gain persistent access to digital infrastructure.

U.S. officials previously linked Salt Typhoon to a series of intrusions into federal networks and sensitive telecommunications infrastructure during the 2024 presidential campaign. The Cybersecurity and Infrastructure Security Agency first identified the group in U.S. federal networks, officials later told lawmakers, with recent reports continuing to reveal the vast scope and extent Chinese hackers were capable of breaching major telecom firms and government operations (see: Salt Typhoon Hackers Hit Congressional Emails in New Breach).

Security experts have warned that similar telecom-focused espionage operations could continue as China seeks intelligence access to communications infrastructure and critical digital systems used by governments and industry, particularly across NATO-aligned countries (see: Experts Warn Congress Another Salt Typhoon Attack Is Coming).

The Norwegian security agency said multiple state actors are expanding their intelligence operations inside the country. Russia has increased cyber and influence activity tied to the war in Ukraine. Iranian intelligence operations target dissidents and Western interests. Cyber operations are a central tool for intelligence collection amid those threats, the report said, noting that artificial intelligence is expected to strengthen state-sponsored hacking capabilities in the coming year.

The assessment also detailed how foreign intelligence services exploit both technical vulnerabilities and human weaknesses through social engineering, recruitment campaigns and long-term access operations designed to collect sensitive information from public and private organizations.