As an update to our September 27 Flash Threat Actor report, more recent developments have revealed that Chinese hacking group Salt Typhoon breached the networks of major U.S. broadband providers, including Verizon, AT&T, and Lumen Technologies. The hackers allegedly accessed systems used by the U.S. federal government for court-authorized wiretaps, potentially maintaining this access for months to collect intelligence. The Wall Street Journal, citing anonymous sources, reported the breach and noted that the hackers might have engaged in extensive data collection from internet service providers serving millions of Americans. Salt Typhoon, also known as Earth Estries and Ghost Emperor, has been active since at least 2019. The group typically targets government entities and telecommunications companies, primarily in Southeast Asia, but has also attacked organizations across multiple countries, including Brazil, Canada, and the UK. The group’s sophisticated methods often involve exploiting vulnerabilities in software, such as the ProxyLogon flaws in Microsoft Exchange Server, and deploying custom backdoors and rootkits. The U.S. government, alongside private sector security experts, is actively investigating the breach’s impact, including the type and volume of data accessed. This incident is part of a broader pattern of cyber espionage by Chinese state-backed actors targeting U.S. and European networking devices and ISPs. Notably, these groups often share infrastructure and tools, indicating coordinated efforts under a common umbrella. Despite the serious implications, Chinese authorities have dismissed the allegations, accusing the U.S. of fabricating narratives to blame China. The ongoing investigation seeks to determine the initial access method used by the hackers, with Cisco routers being one potential vector under scrutiny, though no direct evidence has yet implicated Cisco equipment in the breach. CTIX analysts will continue reporting about ongoing cybersecurity activity amongst threat actors.