Salt Typhoon is a China-linked espionage campaign that burrowed into telecom backbones to steal metadata and enable call interception. The 2026 update covers expanded disclosure of its scale, defensive and policy responses, and open questions about its current focus. Early reports described only a handful of U.S.
telecom victims. Federal officials later described a far larger set of victims across many countries. That shift matters for telecom risk, sensitive communications, and breach planning.
Table of Contents
- How widespread was the intrusion?
- How did attackers keep telecom access?
- Where did activity shift in 2026?
- How is Washington responding?
- What should defenders do now?
How widespread was the intrusion?
FBI Assistant Director Brett Leatherman said Salt Typhoon breached at least 200 U.S. companies and organizations in 80 countries. TechCrunch reported that account on Aug. 27, 2025, in its FBI account of at least 200 breached U.S. organizations.
The figure moved the story past a few telecom providers. Named U.S. victims include AT&T, Verizon, T-Mobile US, Lumen, Charter, Cox, Windstream and Consolidated. Intrusions stole call metadata and in some cases intercepted calls involving government and political figures. Metadata shows who called whom, when, and for how long.
How did attackers keep telecom access?
Joint advisory AA25-239A, released Aug. 27, 2025 and revised Sept. 3, 2025, attributes worldwide telecom backbone compromises to PRC state actors. The joint CISA, NSA and FBI guidance is preserved in the CISA advisory AA25-239A on backbone compromise methods.
It points to GRE/IPsec tunnels, Guest Shell staging, and TACACS+/RADIUS credential capture. GRE/IPsec tunnels are encrypted network paths used here to move stolen data quietly. Guest Shell is an on-router staging area for tools and collected files. TACACS+ and RADIUS are login systems that can expose router credentials when compromised.
Where did activity shift in 2026?
ESET, which tracks the actor as FamousSparrow, reported Sept. 17, 2026 that 90% of its targets from mid-2025 into 2026 were in Latin America. The Register covered the finding in its Register report on ESET's Latin America findings. The campaign used a new SparroWocky backdoor against government networks. That regional pivot changes triage for multinational firms and vendors.
Government suppliers, regional carriers, and roaming partners face higher exposure. Contract reviews should cover logging, lawful-intercept controls, and incident notice. ESET also cautions that technical indicators are insufficient to definitively equate FamousSparrow with Salt Typhoon. The Latin America findings therefore cannot alone prove the same PRC campaign continues unchanged. Attribution remains a working judgment, not a device fingerprint.
How is Washington responding?
Sens. Mark Warner and Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act on Sept. 24, 2026. Sen.
Warner's office documented the proposal in its Warner office notice on the voluntary telecom security bill. It creates an NTIA working group for voluntary best practices and third-party certification. The bill carries no mandates or penalties. It followed FCC Chairman Brendan Carr's rollback of prior mandatory telecom cybersecurity rules. Carr argued the FCC had misinterpreted its authority and cited carriers' voluntary patching and information-sharing.
What should defenders do now?
FBI and CISA advised assuming persistence and using end-to-end encrypted messaging while carriers address core flaws. Priority fixes include Cisco IOS XE CVE-2023-20198 and hardened management interfaces exploited for configuration theft. End-to-end encryption keeps message content unreadable even if transport is tapped.
- Use end-to-end encrypted voice and messaging for sensitive talks.
- Assume backbone persistence until carriers confirm cleanup.
- Ask carriers about IOS XE patch status and management-interface controls.
- Limit remote router administration, rotate TACACS+/RADIUS secrets, and review configs for added tunnels or accounts.
You Might Also Like
- Qilin Ransomware Update 2026: Disclosure, Response, and Open Questions
- Government Data Breach News FAQ for September 2026: Source-Checked Answers to Common Questions
- Cybersecurity — Volt Typhoon FAQ: Notifications, Rights, and Protection