The Chinese Espionage Campaign by Salt Typhoon Also Hit Europe

According to the White House, this hacking of telecom operators, far from being limited to the United States, has affected several dozen countries worldwide.

The White House provided an update on December 4, 2024, regarding the extensive hacking campaign targeting telecom operators led by Salt Typhoon, a cybercriminal group likely affiliated with the Chinese state. Anne Neuberger, the Deputy National Security Advisor for Cybersecurity, stated that the intrusion, far from being confined to the United States, had affected “several dozen countries” worldwide.

The Wall Street Journal first revealed the existence of this espionage campaign in mid-October 2024. The publication reported that in the United States, it had targeted AT&T, T-Mobile, Lumen Technologies, and Verizon. By hacking these four operators, Salt Typhoon reportedly gathered information on the activities of U.S. foreign intelligence services.

According to Anne Neuberger, the Chinese cybercriminal group also infiltrated many other telecom operators—four in the United States and others in Europe and the Indo-Pacific region. According to Politico, the campaign compromised at least 80 companies worldwide.

Salt Typhoon, according to U.S. authorities, potentially had access to the communications of millions of Americans but focused its efforts on “specific high-ranking government and political officials,” without exfiltrating classified information. The White House added that the campaign “has been ongoing, likely for one to two years,” implying that it is not yet over.

The CISA, the U.S. equivalent of France’s ANSSI, clarified that Salt Typhoon’s offensive exploited the weak cybersecurity practices of the targeted operators. “Had these companies implemented even minimal protective measures, it would have made access and persistence much riskier, more difficult, and costlier for the Chinese,” concluded the White House.