Salt Typhoon’s Deepest Breach Yet: Why the U.S. Military Now Assumes It’s Compromised

How deeply embedded is China’s cyber espionage infrastructure within the United States? What happens when an adversary not only listens in—but maps, mimics, and manipulates the very systems meant to defend against it?

The U.S. government is now treating this as more than hypothetical. A newly declassified memo from the Department of Homeland Security warns that Salt Typhoon, a Chinese state-sponsored threat group, successfully infiltrated a U.S. Army National Guard network from March to December 2024, collecting administrator credentials, internal architecture, configuration files, and sensitive network traffic data. This compromise is being labeled one of the most serious national security intrusions in recent memory.

“This data also included these networks’ administrator credentials and network diagrams — which could be used to facilitate follow-on Salt Typhoon hacks of these units,” the DoD warned.

The recommendation? All U.S. military forces must now assume their networks are compromised.

Who is Salt Typhoon?

Salt Typhoon is one of China’s most capable cyber units, operating under the Ministry of State Security (MSS)—China’s civilian intelligence agency. Often grouped with APTs (Advanced Persistent Threats), Salt Typhoon functions in tandem with other MSS-backed teams like Volt Typhoon, Brass Typhoon (APT41), and Bamboo Typhoon.

Salt Typhoon is uniquely aggressive. Where Volt Typhoon favors long-term persistence with minimal detection, Salt’s style includes deep infiltration of telecom backbones, compromise of authentication infrastructure, and targeted wiretap exploitation. They don’t just spy—they embed.

The group is believed to be funded directly by MSS regional bureaus, possibly through joint ventures with "private" Chinese security firms like Sichuan Juxinhe Network Technology Co., Ltd, which was sanctioned in early 2025 by the U.S. Department of the Treasury. In this model, cyber mercenaries work under government contract while providing a layer of plausible deniability.

Not Their First Breach—The Telecom Operation

If you’ve followed my previous coverage, you’ll know the National Guard intrusion wasn’t Salt Typhoon’s first major move. Back in 2024, the group compromised the core networks of at least nine U.S. telecom providers. This included AT&T, Verizon, Spectrum, Lumen, and others.

They didn’t just get in—they stayed in. Some implants were live for over a year.

Their tactics:

• Exploiting vulnerabilities in Cisco, Fortinet, and Versa Director infrastructure

• Deploying rootkits that hijacked authentication systems

• Gaining visibility into call metadata and in some cases audio intercepts

• Harvesting credentials tied to surveillance interfaces (e.g., lawful intercept systems)

Salt Typhoon’s telecom breach gave them insight into high-level communications, with some reports pointing to surveillance of key U.S. political figures and campaign staff. This operation has been compared to a modern-day Operation SHAMOON, but quieter, longer-lasting, and aimed directly at U.S. command and control systems.

The Military Intrusion: What Makes This Worse

The latest development—the infiltration of a U.S. National Guard network—is what experts now consider a strategic red line. Not only was Salt Typhoon able to steal administrative access and maps of critical infrastructure interconnectivity (like between state fusion centers and telecom networks), they also remained undetected for nearly a year.

Between 2023 and 2024, Salt Typhoon didn’t limit its focus to military networks. The group also managed to exfiltrate over 1,400 network configuration files tied to around 70 different U.S. government and critical infrastructure organizations. These entities spanned 12 sectors, including energy, communications, transportation, and water systems.

Photo by Brendan Beale on Unsplash

The stolen configuration data poses a serious risk. With this level of technical insight, Salt Typhoon could potentially launch deeper attacks—gaining unauthorized access, manipulating administrator accounts, capturing sensitive data, and moving laterally across interconnected systems. This assessment is supported by both CISA and NSA threat guidance.

What this breach exposes:

• The integration of civilian and military digital infrastructure makes lateral movement easier than previously thought.

• Telecom access + defense network mapping = crisis readiness for China in the event of geopolitical escalation.

• Credential theft across systems could allow the attackers to piggyback into private contractors, energy grids, emergency response systems, and more.

The former CIO of the U.S. Air Force, Gary Barlet, called this breach “a catastrophic failure of trust boundaries,” warning that all U.S. defense systems should now assume “complete compromise and operational degradation” in a future conflict.

Conclusion

Salt Typhoon’s operations mark a significant escalation in state-sponsored cyber threats against the United States. What began as covert surveillance of telecom infrastructure has now extended into the heart of U.S. military and government systems. The group’s ability to persist undetected for months—and in some cases, years—demonstrates not just technical sophistication, but strategic intent.

This is no longer a matter of isolated breaches. Salt Typhoon is executing a long-term campaign aimed at weakening U.S. resilience in the face of geopolitical conflict. Their access to telecom backbones, military architecture, and critical infrastructure gives them the ability to disrupt or degrade response capabilities when it matters most.

As the lines between civilian, corporate, and defense systems continue to blur, the U.S. must treat this threat with the urgency it demands—not as a one-off intrusion, but as an active battlespace in an ongoing cyber war.