Salt Typhoon is hacking the world’s phone and internet giants. Here’s everywhere that’s been hit.

In a sweeping cyber operation, the hacking group known as Salt Typhoon has launched one of the most extensive campaigns in recent years, infiltrating numerous major telecommunications and internet firms. This group, believed to be linked to China, has reportedly siphoned off tens of millions of sensitive phone records belonging to high-ranking government officials. Experts suggest that these cyber incursions are part of a broader strategy to bolster China’s military preparedness, particularly with respect to potential conflict over Taiwan, which U.S. officials have termed an "epoch-defining threat." Salt Typhoon's primary focus has been on breaching Cisco routers that serve as entry points into corporate networks. These hacks have enabled the group to manipulate surveillance devices mandated by U.S. law for monitoring communications, thereby gaining access to calls, text messages, and even voice recordings of targeted officials. This has prompted the FBI to advise U.S. citizens to transition to end-to-end encrypted messaging applications to safeguard their communications against foreign surveillance. The group has reportedly compromised at least 200 companies globally, with its list of victims growing longer by the day. Among those affected are significant U.S. telecom firms like AT&T and Verizon, as well as internet service provider CenturyLink (now operating as Lumen). T-Mobile acknowledged that it was targeted but stated that the hackers did not gain access to customer communications. The campaign also breached Viasat, a satellite communications leader, granting hackers access to law enforcement tools used for monitoring. In addition to telecom companies, Salt Typhoon has infiltrated the networks of a U.S. state's National Guard, allowing data theft and access to other states and territories. Researchers from Recorded Future have documented the group's attacks on Cisco devices at educational institutions in countries such as Argentina and Mexico. Furthermore, the Canadian government has confirmed that its primary telecommunications companies were also victims of Salt Typhoon's extensive espionage efforts, noting that the targeting extended beyond the telecom sector. The group’s activities have been spotted across various continents, including Brazil, Myanmar, South Africa, and several Southeast Asian nations. Japan has raised alarms about the threats posed by Salt Typhoon to its networks, while both Australia and New Zealand reported activity within their critical infrastructure sectors. New Zealand also identified incursions within government, transportation, and military networks. Reports indicate that the British government has detected a "cluster of activity" linked to Salt Typhoon, suggesting possible breaches of sensitive government communications. Confirmations of Salt Typhoon-related incidents have also surfaced in Norway, the Netherlands, Italy, Finland, and Poland, indicating the vast and pervasive nature of this cyber threat. As the situation evolves, the ramifications of these breaches could have significant implications for national security and international relations.