Salt Typhoon Goes to Washington
The Breach
Salt Typhoon—the MSS-backed threat group that compromised eight US telcos last year—has expanded its reach to the US House of Representatives.
- House China Committee
- Foreign Affairs
- Intelligence
- Armed Services
Staff emails on all four committees were accessed. The breach was discovered in December and disclosed January 7.
The Pattern
This isn't a new campaign. It's the same one.
| Date | Target | Access |
| 2024 | T-Mobile, Verizon, AT&T, Lumen | Call metadata, unencrypted comms |
| 2025 | European telcos | Network infrastructure |
| Jan 2026 | US Congress | Staff email systems |
Salt Typhoon doesn't do smash-and-grab. They do persistent access to communications infrastructure. Telcos were phase one. Congress is phase two.
What They Can Do
From prior telco compromises, Salt Typhoon has:
- Access to unencrypted phone calls and texts of "almost every American"
- Voicemail access
- Email access (now including congressional staff)
- Call metadata showing who talks to whom
When you own the pipes, you own the conversations.
The Response
China's embassy (spokesperson Liu Pengyu):
> "We firmly oppose the US side making unfounded speculation and accusations, using cyber security to smear and slander China."
Standard denial. Meanwhile, four committees responsible for China policy, foreign affairs, intelligence oversight, and military matters are compromised.
Why It Matters
Congressional staff on these committees handle:
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
- Classified briefing materials
- Policy drafts on China relations
- Intelligence community coordination
- Defense appropriations discussions
Even if email contents weren't read (unclear), access to communications patterns reveals priorities, relationships, and timing.
The Bigger Picture
Salt Typhoon is part of a "Typhoon" constellation:
| Group | Focus |
| Salt Typhoon | Telecommunications, government comms |
| Volt Typhoon | Critical infrastructure pre-positioning |
| Flax Typhoon | IoT botnets, edge devices |
| Brass Typhoon | Unknown/emerging |
This isn't espionage as a side project. It's systematic penetration of American communications infrastructure by Chinese intelligence services.
Recommendations
- Assume state actors are in your communications
- Use end-to-end encrypted channels for sensitive discussions
- Segment email systems handling classified/sensitive matters
- Signal > SMS
- Encrypted email > regular email
- Assume your carrier is compromised
Sources
- IT Pro: Salt Typhoon US Congress Email Cyber Attack
- Fortune: Salt Typhoon Hackers Accessed Congressional Staff Email
- Business Standard: China US Cyber Attack Salt Typhoon
About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed tracks nation-state and criminal infrastructure.
Her name is Renee Nicole Good.
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Look up an IOC → · Audit your brand on AIPM → · See pricing →
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=salt-typhoon-goes-to-washington