Salt Typhoon Threat Actor Profile: Telecom Intrusions and Lawful Intercept Exposure

Salt Typhoon is a PRC state-backed espionage actor that lives inside the routers, switches and AAA servers that carriers and large enterprises trust most, and it gets there mostly with stolen or weak device credentials rather than new exploits. This profile summarises what government advisories and vendor investigations say about the group, maps its behaviour to MITRE ATT&CK v20, and turns that into detection and hardening work for network, identity and security operations teams. It is written for defenders at telecommunications providers, ISPs and any organisation whose edge or core network devices could be a stepping stone. The incident narrative for the US carrier intrusions is covered in the Salt Typhoon Telecom Intrusions 2025 breach analysis; this page does not repeat it.

Key takeaways

• Device credentials are the main door. Cisco Talos found that in all but one investigated intrusion the actor logged in with legitimate victim credentials, and the joint advisory AA25-239A lists weak Type 7 secrets, default SNMP strings and reused service credentials as recurring enablers.
• Known, patchable edge flaws do the rest. AA25-239A names five CVEs (Ivanti, Palo Alto Networks and Cisco IOS XE and Smart Install), all in the CISA KEV catalog, and states that zero-day use had not been observed.
• The AAA plane is a target in itself. The actor captures TACACS+ traffic on TCP/49, redirects devices to attacker-controlled AAA servers and adds its own accounts and SSH keys, so identity controls for network devices matter as much as patching.
• Persistence is measured in years. Talos recorded one case where access lasted more than three years, and in February 2026 the FBI described the threat as "still very, very much ongoing" across more than 80 countries.
• Detection depends on configuration integrity. Comparing running configurations with a central golden source, alerting on on-box packet captures and watching for logging gaps are the most reliable signals in the advisories.

Who they are (names and aliases)

Salt Typhoon is the Microsoft-style name used by the US government and by MITRE ATT&CK, where the group is tracked as G1045. ATT&CK describes it as a People's Republic of China state-backed actor active since at least 2019 that has compromised network infrastructure at major US telecommunications and internet service providers. The US Treasury used the same start date when it sanctioned Sichuan Juxinhe Network Technology Co., Ltd. on 17 January 2025 for "direct involvement" in exploiting US telecom and ISP companies.

AA25-239A also names three companies it says supply cyber products and services to Chinese intelligence services, including PLA units and the Ministry of State Security: Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology and Sichuan Zhixin Ruijie Network Technology. For how this actor fits alongside other state groups, see the Threat Actor Groups Guide.

Targeting and motivation

The motive is intelligence collection. AA25-239A (version 1.0 published 27 August 2025, version 1.1 on 3 September 2025, co-sealed by 23 agencies in 13 countries) lists telecommunications, government, transportation, lodging and military infrastructure networks, with a focus on backbone, provider edge and customer edge routers. Provider-held data the advisory says is at risk includes subscriber information, user content, customer records and metadata, network diagrams, device configurations, vendor lists and passwords.

• Lawful intercept exposure: The FBI and CISA joint statement of November 2024 said the actors stole customer call records, accessed the private communications of a limited number of people mainly in government or political roles, and copied information subject to US law enforcement requests made under court orders. That last finding is why the campaign is associated with lawful intercept (CALEA) systems. AA25-239A itself does not mention lawful intercept.
• Reported victims: Public reporting (BleepingComputer, June 2025) lists AT&T, Verizon, Lumen, Charter Communications, Consolidated Communications and Windstream, with Viasat confirming a breach and Comcast and Digital Realty described by officials as potentially compromised. Treat these as reported, not as an official complete list.
• Beyond carriers: A DHS memo reported in July 2025 said a US state's Army National Guard network was extensively compromised between March and December 2024, including network maps and data exchanged with counterparts in other states.
• Trusted links: The group pivots from one provider's devices into peers and customers over trusted interconnects (ATT&CK T1199 Trusted Relationship, T1599 Network Boundary Bridging), so a provider's customers inherit its exposure.

Tactics and techniques (MITRE ATT&CK)

The table below is a defender's selection from the ATT&CK v20 entry for G1045, which is sourced largely from AA25-239A and the Talos analysis. It is not exhaustive.

The custom Go utility JumbledPath (ATT&CK S1206) runs packet captures on remote Cisco devices through chains of jump hosts and attempts to clear logs along the path, according to Talos. Defenders should hunt for its effects (unexpected captures, Guest Shell activity, log gaps) rather than file hashes alone.

How they abuse identities and credentials

Salt Typhoon is, in practice, a machine credential problem. Almost every stage depends on a secret held by a device or a service rather than by a person. The table maps each credential type to what the advisories saw and the fix they recommend.

See the Secrets Management Guide for vaulting and rotation patterns, the SSH Key Management Guide for key inventories, and the Privileged Access Management Guide for brokering administrative sessions to network devices.

Notable incidents

The regulatory reversal matters for defenders: in the US there is currently no FCC-specific cyber security mandate tied to this campaign, so hardening rests on voluntary guidance, sector frameworks and contracts. UK providers should read this alongside the UK Telecommunications Security Act Guide.

Detection and defence

Hunting priorities from AA25-239A

• Configuration drift: Compare running configurations with the approved baseline, focusing on ACLs, local accounts, AAA servers, routing tables, PCAP and SPAN settings, GRE tunnels and loopback addresses.
• Containers on devices: Look for guestshell enable, guestshell run bash, chvrf and NX-OS dohost activity in command accounting logs.
• Unusual services: Management services on non-standard ports (SSH on 22x22 or xxx22 patterns, HTTP(S) on 18xxx), inbound TCP/57722 on IOS XR, and TACACS+ flows to unapproved addresses.
• Data movement: FTP or TFTP from devices to unapproved destinations, and unexplained GRE or IPsec tunnels, especially between autonomous systems.
• Logging gaps: Disabled logging, cleared logs, drops in syslog or AAA volume, and unexpectedly non-empty .bash_history files on device Linux shells (Talos).
• Integrity: Verify firmware images against vendor hashes and check device storage for non-standard files.

See the Network Monitoring and Packet Capture Guide for flow collection design.

Phased hardening plan

1. Week 1, contain exposure: Patch or isolate devices affected by the five AA25-239A CVEs, run no vstack to disable Smart Install, disable ip http server, and remove management interfaces from the internet.
2. Weeks 2 to 4, rotate secrets: Replace Type 5 and Type 7 passwords with Type 8, re-key TACACS+ and RADIUS shared secrets as Type 6, replace SNMP community strings with SNMPv3 users, and rotate RANCID and other service credentials. Rotate in maintenance windows per device group and keep a tested break-glass account so a failed AAA change can be rolled back from the console.
3. Month 2, management plane: Move management into a dedicated VRF or out-of-band network, apply default-deny ACLs and CoPP to VTY and SNMP, block outbound connections from management interfaces, and require MFA on centralised AAA. Pilot on a non-critical region first and measure lockouts before wider rollout.
4. Month 3, visibility: Push configurations from a central source of truth, enable AAA command accounting, forward encrypted logs to an immutable store, and deploy flow exporters at key ingress and egress points.
5. Ongoing: Decommission end-of-life devices (Talos notes even non-critical legacy kit becomes a pivot point), review trusted interconnects with peers and customers, and repeat the AA25-239A hunts quarterly.

Decision guidance

• Large carriers and ISPs: Prioritise backbone and provider edge, AAA server hardening and interconnect monitoring; assume compromise and hunt before rotating, or the actor may observe the rotation.
• Enterprises: Focus on internet-facing VPNs and firewalls (the Ivanti and PAN-OS CVEs) and on the customer edge routers your provider manages; ask providers for their AA25-239A hunt results.
• Small organisations: Patch KEV entries, remove default SNMP strings and Telnet, and rely on vendor-managed logging rather than building a full NetFlow pipeline.

Metrics

• Percentage of network devices with zero Type 5 or Type 7 secrets in configuration.
• Percentage of devices with SNMPv1/v2c disabled.
• Mean time to patch KEV-listed edge vulnerabilities.
• Number of configuration drift events from the golden baseline per month, and time to explain each.
• Percentage of devices sending AAA command accounting and syslog to the immutable store, with alerts on gaps over a set threshold.

Framework mapping

For the wider control set see the Telecom Network Security Guide and the Edge Device Security Guide.

Practitioner checklist

• Confirm every device affected by CVE-2024-21887, CVE-2024-3400, CVE-2023-20198, CVE-2023-20273 and CVE-2018-0171 is patched or isolated.
• Run the AA25-239A hunts (configuration drift, Guest Shell, TCP/57722, TACACS+ to unapproved IPs, GRE between ASNs) before rotating any secrets.
• Eliminate Type 5 and Type 7 secrets; use Type 8 for local accounts and Type 6 for TACACS+ keys.
• Replace SNMPv1/v2c with SNMPv3 authPriv and restrict write access with VACM views.
• Inventory and rotate service credentials used by network management tools such as RANCID.
• Disable Smart Install, Guest Shell, Telnet, HTTP and unused services; allow SSH only on VTY lines.
• Isolate management in a dedicated VRF or out-of-band network with default-deny ACLs and centralised AAA with MFA.
• Alert on AAA server changes, new local accounts, added SSH keys, on-box packet captures and SPAN sessions.
• Send AAA command accounting and syslog to an encrypted, immutable central store and alert on gaps.
• Retire end-of-life network devices and review trusted interconnects with peers and customers.

Standards and references

• NSA, CISA, FBI and partners: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System (AA25-239A)
• CISA: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
• MITRE ATT&CK: Salt Typhoon (G1045)
• Cisco Talos: Weathering the storm, in the midst of a Typhoon
• FBI and CISA: Joint Statement on PRC Targeting of Commercial Telecommunications Infrastructure
• US Treasury: Sanctions on Sichuan Juxinhe Network Technology
• CISA: Known Exploited Vulnerabilities Catalog
• The Register: FCC guts post-Salt Typhoon telco rules

Related NHI Mgmt Group resources: Salt Typhoon Telecom Intrusions 2025 · Telecom Network Security Guide · Telecoms Identity Security Guide · Threat Actor Groups Guide · ITDR Guide