Salt Typhoon’s Army Guard dwell time exposes national security gaps

At a glance

What this is: Swarmnetics reports that Salt Typhoon stayed inside an Army National Guard network for most of 2024, stealing personnel data and using the foothold to reach communications with other Guard networks.

Why it matters: For IAM, PAM, and broader security teams, the case shows how a single persistent compromise can expose trust relationships, lateral movement paths, and monitoring gaps across connected environments.

Context

A long-dwell intrusion is a governance failure as much as a detection failure. When a state-sponsored actor can remain inside a sensitive network for months, the real issue is not only initial access but the inability to constrain movement, validate trust boundaries, and notice that the environment has become unreliable.

This incident also has a clear identity and access angle. The article describes one compromised state network being used to intercept communications with other National Guard networks and US territories, which is a reminder that connected organisations often inherit each other's risk when access paths, authentication trust, and segmentation are not tightly controlled.

In that sense, this was not an isolated lapse. It looks more like a typical exposure pattern for nationally targeted environments that still depend on brittle cross-network trust and insufficiently bounded administrative reach.

Key questions

Q: What breaks when a state-sponsored actor can remain inside a sensitive network for months?

A: What breaks first is the assumption that the environment is observable enough to govern. Long dwell time lets an intruder map trust relationships, learn normal administrative patterns, and move through connected systems without creating the kind of obvious signal many monitoring programmes expect. The practical failure is not only detection latency but loss of control over the security boundary.

Q: Why do cross-network trust relationships increase the damage from a single compromise?

A: Because the compromise stops being local. When one network can inspect, relay, or authenticate into others, the attacker can turn a foothold into a bridge for collection and movement. That is why federated environments need strict boundary review, especially where communications channels and privileged administrative paths span multiple organisations or jurisdictions.

Q: What are the signs that an intrusion has become a containment problem?

A: Look for repeated access to the same sensitive segments, administrative activity that persists far beyond normal response windows, and movement between systems that should not share operational trust. In a national security setting, interception of communications and access to unrelated partner networks are strong indicators that the compromise has extended beyond a single host or team.

Q: Should public-sector teams treat connected defence networks as shared risk domains?

A: Yes. If one environment can expose traffic, identities, or administrative paths in another, then the security posture is already interdependent. Teams should govern those links as shared risk domains, with explicit ownership, tighter segmentation, and agreed containment assumptions. Otherwise, a compromise in one network becomes a strategic problem for the wider mission set.

Technical breakdown

How long dwell time converts initial access into strategic visibility

Persistent access changes the defender's problem from intrusion detection to environmental uncertainty. Once an attacker remains resident for months, they can observe routines, identify trusted accounts, and map relationships between systems without triggering obvious alarms. In national security environments, that matters because the value is often in the communications fabric, not just the host itself. Long dwell time also lets an adversary blend into normal administrative activity and wait for higher-value access paths to emerge.

Practical implication: shorten the window between first access and containment by treating long-resident access as a governance failure, not just an alerting miss.

Why cross-network trust expands the blast radius

Cross-network trust creates a path for a compromise in one environment to influence adjacent ones. If communications, authentication, or routing assumptions allow one foothold to inspect or intercept traffic elsewhere, the breach stops being local. That is especially dangerous in federated public-sector environments where shared monitoring, exchange points, or administrative relationships can become implicit trust bridges. The result is a larger operational footprint than the initial intrusion suggests, and a much harder containment problem.

Practical implication: audit shared trust paths, federation boundaries, and administrative relationships as if any one connected network may already be compromised.

What state-sponsored operators gain from patient living-off-the-land tradecraft

State-sponsored intrusions often avoid noisy malware when persistence can be achieved through existing tools, legitimate credentials, and normal-looking operational behaviour. That approach reduces detection opportunities and makes response harder because defenders see familiar process and access patterns rather than obvious malicious code. In this case, the article suggests a stealthy presence, which is consistent with a living-off-the-land model where the attacker uses legitimate access to harvest data, map connectivity, and shape later-stage objectives.

Practical implication: focus detection on anomalous use of legitimate access and movement patterns, not only on malware signatures or exploit artifacts.

Threat narrative

Attacker objective: The attacker sought long-term intelligence access and cross-network leverage inside a sensitive US defence environment.

1. Entry appears to have occurred through compromise of the Army National Guard network, after which the actor maintained a stealthy presence for most of 2024.
2. With that foothold, the actor exfiltrated maps and personnel information while using network visibility to intercept communications across related Guard environments.
3. The objective was broader intelligence collection and positioning for disruption against connected national security and emergency response systems.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Long dwell time is a control failure, not just a detection statistic. When a state-sponsored actor can remain active for nine months in a sensitive environment, the environment has already lost the ability to assert that access is bounded and observable. That is a governance problem because defenders are no longer managing a controlled trust boundary. Practitioners should treat excessive dwell time as evidence that containment design, not just monitoring volume, is failing.

Cross-network exposure is the real strategic risk in this incident. The key issue is not that one network was penetrated, but that the foothold could be used to observe or intercept communications across other Guard networks and US territories. That is a classic blast-radius problem: one compromised node becomes a bridge into a broader trust fabric. Security programmes should therefore measure how far one compromise can travel, not just whether the initial perimeter held.

State-sponsored pressure exposes brittle assumptions about shared identity and administrative trust. Public-sector environments often assume connected systems remain trustworthy enough for routine communications, but this case shows how quickly those assumptions collapse under patient adversary access. The named concept here is the cross-network trust gap: the space between assumed federation and actual containment. Practitioners should treat that gap as a primary governance object, not a side effect of architecture.

National security networks need continuous compromise thinking, not episodic incident response. The article's account points to a threat model where probing, access, and reconnaissance may continue even after visible activity ends. That means controls must assume persistent targeting and repeated re-entry attempts, especially where critical infrastructure, defence, and emergency response are adjacent. The practitioner conclusion is straightforward: design for containment continuity, not one-time cleanup.

What this signals

A nine-month dwell period in a sensitive public-sector network is a reminder that time itself is an attack surface. Once access persists long enough, segmentation, monitoring, and incident response all have to work together or the compromise simply becomes normalised.

Cross-network trust gap: defenders should assume that any shared communications or administrative relationship can become an attacker bridge if one connected environment is compromised. That means governance must measure blast radius across the mission, not only within the breached enclave.

For identity and access programmes, the lesson is that standing administrative reach across partner networks is a structural risk. Where trust spans multiple systems, least privilege is not just about who can log in, but about how far that identity can travel once inside.

For practitioners

• Compress dwell time through containment-first alerting Tune monitoring to escalate sustained access, unusual east-west movement, and repeated access to communications infrastructure as containment events, not routine investigations.
• Map and reduce cross-network trust bridges Inventory every route that allows one connected state or partner network to inspect, relay, or authenticate into another, then rank those paths by blast radius.
• Review administrative reach across federation boundaries Validate which privileged accounts, service paths, and routing relationships can span multiple Guard or partner environments, and remove any standing access that is not operationally required.
• Hunt for legitimate-access misuse rather than only malware Prioritise detections for anomalous use of normal tools, off-hours administrative behaviour, and access patterns that do not match the role or mission profile of the account.

Key takeaways

• Salt Typhoon's Army Guard intrusion shows that long resident access can undermine even high-security environments when trust boundaries are too broad.
• The compromise had operational reach beyond the initial network, including collection of personnel information and interception of communications with other Guard systems.
• Reducing blast radius, tightening federation and administrative trust, and forcing faster containment are the controls most likely to change the outcome.

Key terms

• Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
• Cross-Network Trust Gap: A cross-network trust gap is the space between what connected systems assume about one another and what defenders can actually verify. It appears when federated access, shared communications, or administrative relationships allow compromise in one environment to affect another.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.