Despite high-profile attention and even US sanctions, the group hasn’t stopped or even slowed its operation, including the breach of two more US telecoms.

Threat intelligence firm Recorded Future said it had observed Salt Typhoon breaching 5 telcos between December 2024 and January 2025.

Attacks continued through January, with China-backed hackers targeting devices linked to universities, telecoms, and ISPs, undeterred by significant media coverage and US sanctions.

Salt Typhoon continues its attacks against telecoms, security researchers reveal. According to the report, Salt Typhoon—tracked by Recorded Future as “RedMike”—breached up

Networks in US and beyond compromised by Beijing's super-snoops pulling off priv-esc attacks China's Salt Typhoon spy crew exploited vulnerabilities in Cisco devices to compromise at least seven devices linked to global telecom providers and other orgs,