Salt Typhoon: A Wake‑Up Call for Telecom Cybersecurity

Salt Typhoon: A Wake‑Up Call for Telecom Cybersecurity

How a Nation‑State Attack Exposed Critical Gaps in 5G and Telecom Security

Back to blog

Executive Summary

In early 2025, the White House confirmed that China‑linked Advanced Persistent Threat (APT) group “Salt Typhoon” breached nine U.S. telecommunications and broadband providers in what officials called a “significant cyber‑espionage campaign.” Investigations revealed that in late 2024, Salt Typhoon exploited Mediation and Delivery Function systems — used for lawful intercept requests under CALEA — to gain covert access to sensitive communications.

Reports indicate possible targeting of high‑profile political campaign staff, underscoring the national security implications of telecom infrastructure vulnerabilities.

Who is Salt Typhoon?

Salt Typhoon is a Chinese state‑linked cyber‑espionage group known for:

  • Target focus: Counterintelligence targets in the U.S. and Canada
  • Attack surface: From edge devices to cloud environments
  • Exploitation methods: Zero‑day and known vulnerabilities in network, security, portal, and VPN devices
  • Custom malware: GhostSpider, SnappyBee, Masol RAT
  • Stealth techniques: DLL hijacking, in‑memory payloads, C2 traffic hidden in HTTP headers/cookies

Why This Matters for Telecom Providers

Governments are now publicly warning about the risk of data exfiltration in 5G networks:

  • U.S. Response: CISA & FCC issued urgent calls for cyber‑hardening, clarifying that CALEA obligations extend to how networks are managed, not just the equipment used.
  • Canadian Response: Bill C‑26 proposes amendments to strengthen telecom cybersecurity, focusing on DNS protection, security testing, network monitoring, and incident response.

The Gap: Doing basic protection is not an option anymore

This incident was a wake‑up call for many telecom providers and governments. In our experience, even the largest enterprises often lack the direction and motivation needed to implement the right controls to reduce the risk posed by advanced and resourceful threat groups.

While ISPs may meet PCI‑DSS, ISO 27001, and SOC 2 compliance requirements, these frameworks typically focus on corporate IT networks — not on the core telecommunications infrastructure such as 5G. This gap leaves critical systems exposed.

At Risk Sentinels, we believe in taking a risk‑based approach across the entire business, rather than focusing solely on compliance checklists. Had service providers adopted this mindset earlier, many of these risks could have been mitigated before causing significant damage to national security.

Risk management — combined with pursuing ISO 27001 certification — helps organizations put the right controls in place and measurably reduce risk. For telecom providers, a risk‑based approach to 5G networks would have highlighted the immense value of data within lawful intercept systems and driven stronger protections.

Risk Sentinels’ Recommended Actions

A risk‑based approach across the entire business — not just compliance checklists — is essential. Key measures include:

  1. Security Hygiene: Replace outdated unsecure management(Telnet, yes they are still using telnet) protocols. If replacement isn’t possible, add layered controls (e.g., network segmentation)
  2. Access Controls: Enforce strict policies, Implement MFA across all systems
  3. Detection & Response: Deploy SIEM playbooks and NDR solutions for closed systems without EDR, Prioritize threat detection for lawful intercept systems
  4. Testing & Validation: Conduct penetration tests every 6-12 months, Remediate critical findings promptly
  5. Leverage Industry Guidance: Follow advisories from T‑ISAC and CSTAC, Integrate best practices into operational processes
  6. Supply Chain Security: Validating firmware/software development and updates from RAN vendors and OSS/BSS vendors using pen test and Third party risk analysis 

Why Partner with Risk Sentinels

  • Proven Expertise: ISO 27001 implementation, 5G network security architecture, supply chain security and penetration testing
  • Specialized Knowledge: Deep understanding of Cybersecurity, 5G networks, Enterprise and telecom‑specific threats
  • Proactive Defense: Experience in development of early‑warning detection systems to identify incidents before they escalate