Salt Typhoon Goes to Washington
- Patrick Duggan
- Jan 9
- 2 min read
The Breach
Salt Typhoon—the MSS-backed threat group that compromised eight US telcos last year—has expanded its reach to the US House of Representatives.
House China Committee
Foreign Affairs
Intelligence
Armed Services
Staff emails on all four committees were accessed. The breach was discovered in December and disclosed January 7.
The Pattern
This isn't a new campaign. It's the same one.
Date | Target | Access |
2024 | T-Mobile, Verizon, AT&T, Lumen | Call metadata, unencrypted comms |
2025 | European telcos | Network infrastructure |
Jan 2026 | US Congress | Staff email systems |
Salt Typhoon doesn't do smash-and-grab. They do persistent access to communications infrastructure. Telcos were phase one. Congress is phase two.
What They Can Do
From prior telco compromises, Salt Typhoon has:
Access to unencrypted phone calls and texts of "almost every American"
Voicemail access
Email access (now including congressional staff)
Call metadata showing who talks to whom
When you own the pipes, you own the conversations.
The Response
China's embassy (spokesperson Liu Pengyu): > "We firmly oppose the US side making unfounded speculation and accusations, using cyber security to smear and slander China."
Standard denial. Meanwhile, four committees responsible for China policy, foreign affairs, intelligence oversight, and military matters are compromised.
Why It Matters
Congressional staff on these committees handle:
Classified briefing materials
Policy drafts on China relations
Intelligence community coordination
Defense appropriations discussions
Even if email contents weren't read (unclear), access to communications patterns reveals priorities, relationships, and timing.
The Bigger Picture
Salt Typhoon is part of a "Typhoon" constellation:
Group | Focus |
Salt Typhoon | Telecommunications, government comms |
Volt Typhoon | Critical infrastructure pre-positioning |
Flax Typhoon | IoT botnets, edge devices |
Brass Typhoon | Unknown/emerging |
This isn't espionage as a side project. It's systematic penetration of American communications infrastructure by Chinese intelligence services.
Recommendations
Assume state actors are in your communications
Use end-to-end encrypted channels for sensitive discussions
Segment email systems handling classified/sensitive matters
Signal > SMS
Encrypted email > regular email
Assume your carrier is compromised
Sources
About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed tracks nation-state and criminal infrastructure.
Her name is Renee Nicole Good.
Comments