Shock Infiltration: China-Linked Salt Typhoon Breached US National Guard for 9 Months

A Silent Siege on US Military Networks

A chilling new revelation has emerged in the world of cyberwarfare — a Chinese state-backed hacking group, known as Salt Typhoon, covertly infiltrated the U.S. Army National Guard’s networks for nearly an entire year. Operating undetected from March to December 2023, the cyber-espionage campaign represents one of the most prolonged and potentially damaging breaches of American military infrastructure in recent memory.

The breach, first uncovered through a Department of Homeland Security (DHS) document obtained by NBC News, reveals that Salt Typhoon — an advanced persistent threat (APT) believed to operate under the direction of the Chinese government — gained access to critical National Guard systems. Known for targeting the telecommunications sector, Salt Typhoon had previously breached major companies such as Verizon, T-Mobile, and AT\&T, often exploiting Cisco vulnerabilities.

In this latest breach, the attackers didn’t just tap into a single network. They accessed internal configurations, administrator credentials, and personal identifiable information (PII) of military personnel. Moreover, their surveillance extended beyond the initial target, reaching across networks in every U.S. state and at least four U.S. territories. This sweeping compromise not only jeopardized sensitive information but also risked weakening the defenses of state-level cybersecurity partners — especially those integrated into local fusion centers or involved in direct network defense operations.

Security experts are alarmed, especially due to the prolonged duration of the breach. Erich Kron, a security awareness advocate at KnowBe4, emphasized how nearly a year of undetected access likely gave attackers a deep understanding of National Guard network architecture. He raised concerns that persistent access might have left behind hidden backdoors.

A Department of Defense (DoD) report added further insight: in 2024, Salt Typhoon leveraged its access to steal network diagrams, administrator credentials, geolocation data, and service member PII. According to DHS, the hack had the potential to seriously damage the U.S.’s ability to defend critical infrastructure in the event of conflict with China.

Salt Typhoon’s success underscores serious vulnerabilities in U.S. cyber defenses. With access to nearly 1,500 network configuration files from over 70 U.S. government and infrastructure entities across 12 sectors, this APT has become a formidable digital adversary.

Although DHS didn’t specify the exact CVEs used in the breach, it provided mitigation strategies. These include securing Server Message Block (SMB) traffic, implementing strong encryption, enforcing password rotation, applying least privilege principles, and using role-based access controls — all now imperative for defenders across both federal and state systems.

What Undercode Say:

This cyberattack isn’t just another headline — it’s a siren call for systemic overhaul. Salt Typhoon’s breach of the U.S. National Guard network is more than an espionage operation; it represents a strategic assault on America’s cyber backbone.

Let’s break it down:

First, the timeline alone — nine months of undetected access — highlights glaring deficiencies in cyber surveillance and incident detection capabilities. In military cybersecurity, where minutes can spell disaster, a breach of this length is unacceptable. It speaks to not only a lack of visibility but perhaps a false sense of confidence in existing intrusion detection systems.

Second, the attackers didn’t just gather technical data — they harvested administrator credentials and PII. This hints at possible future identity-based attacks or social engineering campaigns targeting those same individuals or their families. It’s long-term psychological and tactical warfare.

Third, the compromise of state fusion centers is especially dangerous. These centers are vital hubs where law enforcement, cybersecurity experts, and intelligence personnel collaborate to share threat data. A compromised center could allow China to monitor or disrupt U.S. responses in real-time.

And here’s the larger geopolitical play: if tensions escalate between the U.S. and China, Salt Typhoon’s prior access — and potential lingering backdoors — may give Beijing a tactical advantage. From disrupting troop mobilization to sabotaging digital command structures, the possibilities are chilling.

Technically, Salt Typhoon’s use of known vulnerabilities, like those in Cisco devices, reinforces the critical importance of zero-trust architecture. The outdated assumption that internal networks are inherently safe must be abandoned.

In practical terms, public sector IT teams need to rethink every layer of their infrastructure. It’s no longer enough to focus on patch management or access controls — there needs to be active threat hunting, red team simulations, and live telemetry-based anomaly detection.

And most importantly: it’s time to reconsider how federal and state entities coordinate cybersecurity. The decentralized nature of state-level cyber defenses leaves critical gaps — gaps Salt Typhoon exploited. There must be a push for unified federal-state frameworks with shared visibility, response protocols, and integrated threat intelligence.

This wasn’t just a breach; it was a rehearsal for a much bigger act.

🔍 Fact Checker Results:

✅ Verified: Salt Typhoon maintained access to US National Guard networks for nearly a year (March–December 2023), as confirmed via DHS FOIA documents.
✅ Verified: Exfiltration included network diagrams, credentials, and PII across multiple states and territories.
✅ Verified: Prior breaches by Salt Typhoon exploited Cisco vulnerabilities in major telecoms like Verizon and T-Mobile.

📊 Prediction:

The Salt Typhoon operation is just the tip of the iceberg. Expect more revelations in the coming months about other U.S. entities — especially those at the state level — that may have been silently compromised.

Additionally, with geopolitical tensions rising in the Pacific, it’s highly likely China will escalate cyber-espionage campaigns against U.S. military and critical infrastructure. Salt Typhoon and similar groups may already be embedding access to disrupt logistics, communications, or infrastructure in case of open conflict.

Cybersecurity isn’t just about preventing the next breach — it’s now about preparing for a digital first strike.