# Salt Typhoon: Chinese state hackers inside US telecom networks · pwn.watch

> PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Page: https://pwn.watch/i/salt-typhoon-us-telecom-breaches · generated 2026-10-22T22:41:49.181Z

## Status
- Severity: critical · status: closed · patch: no-fix-needed
- Product: US telecommunications carriers
- Started: 2024-11-13 · closed: 2024-12-04

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/salt-typhoon-us-telecom-breaches/feed.xml
- JSON Feed: https://pwn.watch/i/salt-typhoon-us-telecom-breaches/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/salt-typhoon-us-telecom-breaches.json
- This file: https://pwn.watch/i/salt-typhoon-us-telecom-breaches/llms.txt

## Updates (newest first)
- 2024-12-04: CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure (https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure)
- 2024-11-13: FBI and CISA joint statement on PRC targeting of commercial telecommunications (https://www.cisa.gov/news-events/news/joint-statement-fbi-and-cisa-peoples-republic-china-prc-targeting-commercial-telecommunications)

## Fix brief
# Security brief: Salt Typhoon: Chinese state hackers inside US telecom networks

Source: https://pwn.watch/i/salt-typhoon-us-telecom-breaches · status: closed (closed Dec 4, 2024) · severity: critical · updated Dec 4, 2024

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Severity detail: Nation-state espionage against telecom infrastructure

- Product: US telecommunications carriers

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Dec 4, 2024: CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure
- Nov 13, 2024: FBI and CISA joint statement on PRC targeting of commercial telecommunications

## Advisories
- [Joint statement from FBI and CISA on PRC targeting of commercial telecommunications infrastructure](https://www.cisa.gov/news-events/news/joint-statement-fbi-and-cisa-peoples-republic-china-prc-targeting-commercial-telecommunications) (CISA / FBI)
- [Enhanced visibility and hardening guidance for communications infrastructure](https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure) (CISA)

---
Machine-readable: https://pwn.watch/i/salt-typhoon-us-telecom-breaches.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.