What Should the US Do About Salt Typhoon? A Closer Look at the Growing Cyber Threat

Salt Typhoon, a Chinese state-sponsored cyber threat actor, has recently captured global attention for its aggressive attacks targeting US telecommunications giants. With an ongoing espionage campaign that has already infiltrated companies like Verizon, AT&T, and Lumen Technologies, the group has successfully accessed sensitive information, including political data from the 2024 presidential campaigns. But what should the US do in response to this emerging cybersecurity crisis? In this article, security experts weigh in on the nature of the threat, potential responses, and how both the government and private companies can better protect themselves.

Salt

The Nature of the Threat: What Makes Salt Typhoon So Dangerous?

Salt Typhoon has made its presence known across the globe, infiltrating major US telecommunications providers and gaining access to highly sensitive data. Their goal appears to be twofold: gathering intelligence for espionage purposes and positioning themselves for future influence over critical infrastructure. The group’s attack tactics are both sophisticated and stealthy, employing methods such as “living off the land” (LoTL) to hide their activities within legitimate network traffic. These techniques make Salt Typhoon particularly difficult to detect and mitigate.

The group has successfully compromised lawful intercept systems, which are used by law enforcement agencies for wiretapping. Although Salt Typhoon may not always be able to decrypt the communications it accesses, the ability to observe who is communicating with whom and when could provide invaluable intelligence, especially when targeting political campaigns. The risk extends beyond mere espionage, with some experts fearing that China’s long-term strategy involves embedding itself within critical US infrastructure to exploit it later for geopolitical purposes.

Key Security Expert Insights

Several security experts weighed in on the extent of the threat posed by Salt Typhoon and discussed potential US responses. Bobby Kuzma, director of offensive cyber operations at ProCircular, emphasized the gravity of the situation, noting that Salt Typhoon’s access to lawful intercept systems gave it the ability to monitor potentially everything traveling over the network. Even if the content of communications remains encrypted, the metadata could provide significant insights into individuals’ activities.

While the threat of espionage is severe, the broader implications of such attacks cannot be overstated. As Austin Berglas, global head of professional services at BlueVoyant, pointed out, China’s ongoing cyber operations in the US are a well-established trend, and the threat isn’t likely to dissipate soon. This ongoing infiltration could potentially escalate into more direct attacks on critical infrastructure, leading to widespread disruptions.

Government Response: What Should the US Do?

There are many potential responses that the US government could pursue, ranging from diplomatic actions to cyber-defense initiatives. Some experts argue that traditional responses, such as sanctions or expelling diplomats, are only temporary fixes and are unlikely to deter state-backed attackers. According to Alon Termin, a red team expert at CYE, the most effective approach is to focus on strengthening cybersecurity regulations for critical infrastructure sectors.

As the Federal Communications Commission (FCC) recently proposed new regulations requiring telecom companies to enhance their cybersecurity risk management plans, there is a growing consensus that bolstering the defenses of vulnerable sectors is paramount. However, these regulations are only effective if they are enforced, and telecom providers must adopt them swiftly.

What Undercode Says: A Deeper Dive into the Threat Landscape

The Salt Typhoon campaign underscores a larger pattern of increasingly sophisticated cyber-attacks against US infrastructure. While traditional espionage has long been a concern, the emergence of cyber warfare has shifted the balance. State-backed actors like Salt Typhoon are not just engaging in espionage but are also positioning themselves within critical sectors, creating a looming risk of systemic disruption.

One of the most alarming aspects of this threat is its persistence. Salt Typhoon has demonstrated remarkable stealth, utilizing existing network tools to mask its activities and avoid detection. As cyber-attacks grow in sophistication, defensive strategies must evolve accordingly. It’s no longer enough to simply rely on traditional security measures; organizations must adopt proactive, layered approaches to identify and mitigate threats early on.

The US government’s focus on building stronger cybersecurity defenses is crucial, but private corporations also have a significant role to play. As Berglas mentioned, the responsibility lies not just with the government but with private entities to better secure their networks and systems. Implementing basic cybersecurity hygiene—such as quick patching, multifactor authentication, and robust asset management—remains critical in the fight against advanced persistent threats (APTs) like Salt Typhoon.

Moreover, as attackers increasingly leverage advanced tools like AI, human intelligence and continuous education of employees will be essential in preventing social engineering and phishing attacks. Shraberg advocates for a combined approach that brings together both technical defenses and the education of individuals to recognize suspicious activities.

Another critical consideration is supply chain security. As Salt Typhoon demonstrated, vulnerabilities in telecommunications providers can lead to far-reaching consequences. Organizations must assess their vendors and partners to ensure that they are not exposing their networks to external threats.

Fact Checker Results: Analyzing the Claims

1. Salt

US response and regulatory measures: The proposed FCC regulations to bolster telecom cybersecurity have been outlined and discussed in recent government hearings, reinforcing the push for stricter oversight of critical sectors.
General impact of Chinese state-sponsored cyber activities: The long-standing nature of China’s cyber operations against the US, including previous espionage campaigns targeting intellectual property and critical infrastructure, is consistent with established patterns of Chinese state-backed hacking, as confirmed by multiple cybersecurity firms.