DomainTools dissects Salt Typhoon, a Chinese MSS-aligned APT group targeting global telecommunications infrastructure. What makes them special is their hybrid model blending direct state oversight with pseudo-private contractors like i-SOON to obscure attribution while scaling operations. They’ve demonstrated the ability to maintain persistent access for months or years, harvesting communications metadata and lawful intercept data, essentially wiretapping the wiretappers. A joint advisory from 23 agencies in 13 countries ties the activity to three Chinese firms, among them Sichuan Juxinhe, and describes how the actors have backdoored backbone and provider edge routers since at least 2021 using known flaws such as CVE-2018-0171 and CVE-2023-20198, no zero-days required.
