Organizations should fix next patching of exploited flaws, centralized logging, and hardening of edge and network devices. Salt Typhoon is a PRC state-sponsored espionage campaign that compromised carrier and other networks worldwide to feed intelligence systems. The campaign used overlapping tooling tracked as OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor, according to the CISA/NSA/FBI joint advisory AA25-239A. The FBI assessed more than 80 targeted countries and about 600 notified organizations, including senior figures tied to the Trump, Vance and 2024 Harris campaigns.
Table of Contents
- What did attackers take from carriers?
- What should you fix first?
- How should communications teams harden monitoring?
- What shifts and limits affect your plan?
What did attackers take from carriers?
Attackers breached at least nine U.S. carriers including AT&T, Verizon, T-Mobile, Lumen, Charter, Windstream and Viasat. They stole call records and law-enforcement request data, according to FBI reporting. They also accessed lawful-intercept wiretap systems and private communications of officials.
That access turns normal carrier retention and interception features into espionage sources. The risk is not only data theft. Persistent access to core routing, authentication, and management systems lets attackers return, expand, and intercept again.
What should you fix first?
Joint guidance from CISA and partners tells organizations to fix patching, logging, edge security, exposed management, device hardening, and architecture review, as described in the CISA joint advisory release. Act on those controls before buying new tools.
Start with internet-facing network gear. Remove direct management from the internet, limit privileged access, and verify backups and recovery paths work.
- Patch known exploited vulnerabilities on edge, VPN, firewall, and telecom devices.
- Enable centralized logging and review authentication, config, and access events.
- Secure edge infrastructure and remove needless internet-facing management.
- Harden network devices, enforce strong access controls, and validate architecture.
How should communications teams harden monitoring?
For communications infrastructure, CISA, NSA, FBI, Australia, Canada and New Zealand issued Enhanced Visibility and Hardening Guidance on Dec. 3, 2024. It urges better monitoring, access controls, and device hardening for telecom operators and defenders.
Apply that guidance to visibility gaps first. Centralize syslog, protect log stores, alert on config changes, and audit vendor and remote access. CISA also advised highly targeted senior government and political figures to stop using unencrypted SMS and switch to end-to-end encrypted apps such as Signal. Use that rule for travel, campaign, executive, legal, and incident-response communications.
What shifts and limits affect your plan?
From mid-2025 into 2026 about 90% of observed activity shifted to Latin America, according to ESET research reported in The Register account. Targets included governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru and others. The operation deployed a new SparroWocky backdoor with about 30 commands for profiling, file theft, and screenshots. That toolkit suits long access in government networks with weak edge controls. On Aug.
26, 2026 DOJ and FBI seized domains behind QScan and QTRouter platforms built by PRC group QTFY of Nanjing Xinjiuwei. Investigators said the platforms scanned vulnerable IoT devices and routed attacks, and the seizure made that tooling inoperable. On Nov. 20, 2025 the FCC voted 2-1 to repeal its January 2025 CALEA ruling that required carriers to secure networks against interception, according to The Register report. Treat carrier security as voluntary and confirm protections in contracts and incident plans.
You Might Also Like
- Play Ransomware: What Organizations Should Fix Next
- Legal Aid Agency Data Breach: Why You Should Not Search for Copies of Leaked Case Files
- Government Data Breach News Explained for 2026: Who It Affects, Key Evidence, and What to Do Next