China's Salt Typhoon Intensifies Cyber Espionage in East Asia

Executive Summary

In early 2026, China's advanced persistent threat (APT) group, Salt Typhoon, has significantly intensified its cyber espionage operations across East Asia. Operating under the Ministry of State Security (MSS), Salt Typhoon has expanded its focus to include long-term implants, supply chain compromises, and SIGINT-linked intrusions, with a particular emphasis on diplomatic targeting.

Operational Overview

Salt Typhoon's operations are characterized by sophisticated, long-term implants designed to maintain persistent access to targeted networks. These implants are often delivered through supply chain compromises, exploiting vulnerabilities in third-party software and hardware to infiltrate high-value targets. The group's SIGINT capabilities enable the interception and exfiltration of sensitive communications, enhancing their intelligence collection efforts.

Targeted Sectors and Entities

The group's primary targets include critical infrastructure sectors such as telecommunications, energy, and transportation. Notably, in February 2026, Norwegian authorities reported that Salt Typhoon had successfully infiltrated critical infrastructure systems, underscoring the group's global reach and operational sophistication. (itpro.com)

Diplomatic entities have also been a focal point, with Salt Typhoon conducting cyber operations aimed at gathering intelligence on diplomatic communications and strategies. These activities are part of China's broader strategy to enhance its geopolitical influence and counter perceived adversaries.

Technical Capabilities and Tools

Salt Typhoon employs a range of custom-developed tools and malware to execute its operations. These include remote access Trojans (RATs) and data exfiltration tools designed to evade detection and maintain long-term access. The group's use of SIGINT-linked intrusions allows for the interception of communications, providing valuable intelligence on target activities.

Implications and Recommendations

The escalation of Salt Typhoon's cyber espionage activities poses significant risks to national security and economic stability in East Asia. Organizations are advised to implement robust cybersecurity measures, including network segmentation, regular vulnerability assessments, and employee training to recognize phishing attempts. Additionally, enhancing collaboration between public and private sectors is crucial to effectively counteract these sophisticated cyber threats.

Conclusion

Salt Typhoon's intensified operations in East Asia reflect a strategic shift towards more aggressive and comprehensive cyber espionage tactics. The group's focus on long-term implants, supply chain compromises, and SIGINT-linked intrusions, particularly targeting diplomatic entities, underscores the evolving nature of cyber threats in the region. Continuous vigilance and adaptive defense strategies are essential to mitigate the impact of these operations.

Highlights:

• Security expert warns Salt Typhoon is becoming 'more dangerous' after Norwegian authorities lift lid on critical infrastructure hacking campaign, Published on Monday, February 09