Salt Typhoon Infiltration of Global ISP Infrastructure: A Massive State-Sponsored Espionage Campaign Uncovered

Executive Summary

Encrygma’s intelligence wing, in collaboration with industry partners, has identified a widespread and highly sophisticated cyber-espionage campaign attributed to the Chinese state-sponsored threat actor known as Salt Typhoon (also tracked as GhostEmperor or FamousSparrow). This campaign, which has reached a critical stage of maturity as of July 2026, specifically targets the core infrastructure of Internet Service Providers (ISPs) across North America, Southeast Asia, and Western Europe. The primary objective appears to be the establishment of long-term, covert access to mirror traffic and intercept sensitive data streams from government and high-value corporate entities.

Threat Analysis

Salt Typhoon has demonstrated an exceptional level of operational security, utilizing a "low and slow" approach to evade traditional detection mechanisms. Unlike typical ransomware or disruptive attacks, this operation is purely intelligence-driven. By infiltrating the administrative layers of ISPs, the actor gains the ability to monitor unencrypted traffic and potentially perform Man-in-the-Middle (MitM) attacks. The threat actor leverages compromised edge devices—specifically focusing on vulnerabilities in high-capacity routers and VPN concentrators—to gain a foothold within the provider's internal management networks. This method bypasses traditional endpoint security, making the intrusion exceptionally difficult to detect at the user level.

Technical Details

The intrusion set begins with the exploitation of zero-day vulnerabilities in network edge appliances. Once inside, Salt Typhoon deploys a custom, modular backdoor known as "SparrowDoor," which allows for remote command execution and file manipulation. A key technical highlight of this campaign is the actor’s use of sophisticated packet-capture tools deployed directly onto ISP core switches. They utilize BGP (Border Gateway Protocol) hijacking techniques to reroute specific traffic blocks through controlled nodes, allowing for deep packet inspection before the traffic reaches its intended destination. The actor also employs "Living-off-the-Land" (LotL) binaries to perform lateral movement, minimizing their footprint by using legitimate administrative tools like PowerShell and WMI to avoid triggering signature-based alerts.

Attribution Assessment

We attribute this activity to Salt Typhoon with high confidence. The TTPs (Tactics, Techniques, and Procedures) align perfectly with previous operations linked to the Chinese Ministry of State Security (MSS). The use of specific obfuscation patterns in the SparrowDoor malware and the targeting of telecommunications infrastructure are hallmarks of this group's mission to support China's strategic intelligence requirements. Furthermore, the command-and-control (C2) infrastructure overlaps with known Chinese-nexus IP ranges and domain registration patterns identified in previous regional campaigns.

Implications

The compromise of ISP infrastructure represents a tier-one national security threat. It undermines the fundamental trust of the digital ecosystem, as it allows a foreign adversary to intercept communications without needing to compromise individual endpoints. For government agencies and strategic industries, this means that even encrypted traffic metadata—such as communication partners, frequency, and timing—is now in the hands of a hostile actor, providing a roadmap for further targeted exploitation and human intelligence operations.

Recommendations

Organizations, particularly those in the telecommunications sector, should immediately implement the following:

1. Conduct an exhaustive audit of all edge networking equipment, ensuring firmware is updated to the latest versions and patches.
2. Implement robust multi-factor authentication (MFA) for all administrative access to core network infrastructure and management consoles.
3. Monitor for unusual BGP announcements or unexpected shifts in traffic routing patterns using external monitoring services.
4. Deploy advanced network detection and response (NDR) solutions to identify lateral movement within management VLANs.
5. Engage in proactive threat hunting focused on identifying the presence of LotL activity and unauthorized packet capture utilities on network devices.