A Chinese-backed cyber espionage group known as Salt Typhoon has been linked to one of the largest hacking campaigns targeting U.S. telecommunications and internet providers, with the FBI confirming that at least 200 American companies have been breached.

The revelation underscores mounting concerns over the security of legally mandated surveillance backdoors built into telecom infrastructure.

AI Boom or AI Bubble? Investors Weigh Risks Amid Soaring AI Investments - USA Herald

Salt Typhoon Scale of the Attack

According to FBI Assistant Director Brett Leatherman, Salt Typhoon’s campaign extends far beyond U.S. borders. “This activity is ongoing,” Leatherman told The Washington Post, revealing that the hackers infiltrated networks in 80 countries, exposing the global scope of the campaign.

The attackers previously compromised AT&T, Verizon, and Lumen, while later disclosures confirmed that Charter Communications and Windstream were also targeted. The group infiltrated wiretap systems, which under U.S. law are designed to allow government surveillance of criminal or national security threats. These systems, however, proved to be one of the most vulnerable gateways.

The Risks of Surveillance Backdoors

For years, technologists have warned that legally required surveillance backdoors in telecommunications infrastructure could serve as a ticking time bomb. The Salt Typhoon hacks validate those fears. By gaining access to call records of senior American politicians and officials, the hackers could map out sensitive communications—including who U.S. agencies were monitoring.

“This is the ‘told you so’ moment we always feared,” one cybersecurity expert told reporters. “Backdoors don’t just let the good guys in. They’re open invitations for adversaries.”

FBI’s Advisory and Global Response

In a joint cybersecurity advisory PDF, the FBI and nearly two dozen international agencies warned that Salt Typhoon primarily targets backbone and edge routers in telecom networks.

Once inside, hackers modify routers to maintain persistent, long-term access, siphoning sensitive traffic and leveraging compromised devices to infiltrate additional networks.

The hackers’ activity overlaps with other known cyber threat groups, also tracked under names such as Operator Panda, RedMike, UNC5807, and GhostEmperor.

U.S. Officials Sound the Alarm

The severity of the breaches once prompted the FBI to recommend that Americans switch to encrypted messaging apps to protect calls and texts from interception.

 Leatherman emphasized that the People’s Republic of China (PRC) state-sponsored actors continue to pose a threat across critical infrastructure sectors, including government, transportation, lodging, and even military networks.

“The threat from China is ongoing,” Leatherman reiterated, underscoring the urgent need for stronger cybersecurity measures.

Looking Ahead

The Salt Typhoon revelations highlight the dangers of mandatory surveillance infrastructure and the growing sophistication of Chinese state-sponsored hacking campaigns. With hundreds of U.S. companies and dozens of countries affected, experts warn that the campaign represents not just a breach of privacy but a national security crisis.

For more details, you can read the FBI and international advisory here.