Salt Typhoon — actor profile

Actor profile· ACT-007

Files naming the group

Sectors in the corpus

Jurisdictions

2024

Earliest file

Campaign timeline10 files

JUL 2026Telecom carriers, multiple26-0715More than 600 organisations across 80 countries since 2019, including US carriers and the lawful-intercept systems they run. The metadata was always the point.NOV 2025Telecom subscribers25-1112Content tells you what a known person said. Metadata tells you who the people are — and it is the one that scales.AUG 2025Global infrastructure operators25-0827Lodging looks out of place on that sector list. It is not — hotels, transport and telecom metadata resolve a person’s movement over time.JUL 2025Multiple sectors25-0725A hotel record is the join key that turns location-adjacent data into confirmed physical presence. No DPIA has a field for that.JUN 2025Viasat25-0623Nobody attacks a satellite. Every practical route to a constellation runs through a building with a remote management link.MAR 2025US telecommunications carriers25-0304The vulnerability was not a defect in the implementation. It was the specification — and the thirty-year exceptional-access debate now has an empirical entry.FEB 2025Telecommunications firms25-0213Sanctions work against organisations that need the financial system. A state intelligence service has no revenue to interdict.DEC 2024US telecommunications carriers24-1203Advice to change your own behaviour is what a defender issues when it cannot change the thing that is broken.OCT 2024Lawful-intercept systems24-1006Nothing in the design distinguishes a lawful request from an unlawful one. That distinction lives entirely in the process wrapped around it.OCT 2024US telecommunications carriers24-1004There is no moment at which the attacker chooses to be seen — which is the moment most of this database is built around.

Attribution note

Attribution to a state is reported by governments and vendors and is not established by this desk. The corpus grades attribution separately from events throughout, and the events here — long access to carrier infrastructure — are far better evidenced than the naming.

MITRE ATT&CK

G1045 · Salt TyphoonGroup

ATT&CK lists no associated aliases for this group, which is unusual and useful: for once the name in this corpus and the name in the registry are the same object.

Sectors targeted

Telecom10

All 10 files in the database →

Defender notes

• Lawful-intercept systems are a target because they are required to exist and required to work.

• Carrier metadata describes who spoke to whom, which no notification regime treats as sensitive.

• Eviction timelines in this cluster are measured in months, not days.

ForensicPost

Independent reporting on digital forensics and incident response.

SectionsBreaches Ransomware Nation-state Cloud

DataCase files Data export Actor index Glossary Methodology

ContactSecure tips Corrections The desk Ethics