Salt Typhoon

Salt Typhoon, a China-linked Advanced Persistent Threat (APT) group also known as FamousSparrow and GhostEmperor, has been active since at least 2020. The group has conducted cyber-espionage campaigns targeting governments, the tech industry, and most notably, U.S. internet service providers (ISPs). In early 2023, Salt Typhoon's activities were reported, detailing their attacks on ISPs including Verizon, AT&T, and Lumen Technologies. These breaches potentially granted the threat actor access to systems used for lawful wiretapping and other sensitive data. The Salt Typhoon breach exposed significant vulnerabilities in the U.S. cybersecurity framework, highlighting the cost of complacency when prioritizing profits over robust security measures. This brazen assault on America's digital infrastructure, specifically systems integral to surveillance and wiretapping capabilities, underscores the critical failures in the nation's cybersecurity strategy. Their eight-month long cyberespionage operation is currently under investigation by U.S. agencies. China reportedly sponsors two other cyberespionage clusters, Flax Typhoon and Salt Typhoon, which regularly target critical infrastructure entities as part of a broader strategic approach. The Salt Typhoon group targeted surveillance systems used by the U.S. government for investigating crimes and threats to national security. Despite its focus on intelligence gathering rather than crippling infrastructure, the Salt Typhoon campaign represents a systemic vulnerability in America's approach to cybersecurity. It is suggested that the group behind Salt Typhoon may be affiliated with China’s Ministry of State Security, specifically the APT40 group, which specializes in intelligence collection.