A newly discovered advanced persistent threat (APT) group, dubbed Salt Typhoon, has been implicated in a series of cyber espionage operations targeting U.S. internet service providers (ISPs). This group, believed to be backed by Beijing, has reportedly compromised several ISPs to establish a persistent presence within their networks. The ultimate aim is to gather sensitive information and potentially prepare for future disruptive cyberattacks. Salt Typhoon, also known as FamousSparrow and GhostEmperor, has a history of targeting high-profile entities in Southeast Asia and other regions. The attacks are part of a broader pattern of Chinese state-sponsored efforts to infiltrate critical infrastructure. Investigators are examining whether the intruders accessed Cisco Systems routers, which are crucial for internet traffic routing. This campaign follows a series of similar intrusions by other Chinese APT groups, such as Flax Typhoon and Volt Typhoon, known for targeting U.S. critical infrastructure, government, and military networks. These groups have been linked to extensive cyber espionage and data theft operations. Salt Typhoon’s recent activities highlight China’s strategic priorities, including reconnaissance and pre-positioning for potential military conflicts. By compromising ISPs, the group could monitor high-value targets, including federal agencies, military contractors, and Fortune 100 companies. This capability aligns with China’s broader goals of controlling regional assets and preparing for possible conflicts, such as over Taiwan. The U.S. government and cybersecurity agencies are actively responding to these threats. Recent actions include the disruption of a 260,000-device botnet controlled by Flax Typhoon and heightened warnings about ongoing Chinese cyber campaigns. CTIX analysts advise organizations to review the latest advisories and implement stringent security practices to protect against these sophisticated cyber threats.