--- reference_key: gca-salt title: "GCA --- Salt Typhoon Across the Internet" url: "https://globalcyberalliance.org/new-report-salt-typhoon-across-the-internet/" availability: available capture_method: primary captured_at: 2026-06-23T03:30:43Z document_id: REF-gca-salt --- # GCA --- Salt Typhoon Across the Internet | Field | Value | |-------|-------| | **Reference key** | `gca-salt` | | **Availability** | AVAILABLE | | **Capture method** | `primary` | | **Source type** | remote_url | | **URL / path** | https://globalcyberalliance.org/new-report-salt-typhoon-across-the-internet/ | | **Captured (UTC)** | 2026-06-23T03:30:43Z | | **Content type** | text/html; charset=UTF-8 | | **HTTP status** | 200 | ## Boardroom Citation Context GOV-03 Salt Typhoon persistence; national security context. ## Source Location https://globalcyberalliance.org/new-report-salt-typhoon-across-the-internet/ ## Captured Content ```text New Report: Salt Typhoon Across the Internet - GCA | Global Cyber Alliance Skip to content Search GO English Our Work Our Work Improving Internet Integrity > AIDE > MANRS > Domain Trust > Increasing Cyber Protection & Resilience > GCA Cybersecurity Toolkits > ACT > CyberFlex > Spotlight on AI Artificial Intelligence (AI) brings enormous opportunity---but also new risks that affect us all. Learn more about our work. Learn More > Our Tools Our Tools Use a Tool > ACT > CyberFlex > DMARC > GCA Cybersecurity Toolkits > Internet Pollution Index > MANRS Observatory > Quad9 > GCA Learning > Overview > Guides & Trainings > Featured Tool: CyberFlex Protecting Young Adults from Online Scams and Cybercrime Read More > Get Involved Get Involved Ways to Engage > All Ways to Engage > Our Partners > Premium Partners > GCA Contributors > GCA Collaborators > Our Community Work > Common Good Cyber > Cyber Civil Defense > Nonprofit Cyber > Follow Our Work > View Project Directory > Ways to Engage We work with like-minded organizations that share our vision of a secure, trustworthy Internet that enables social and economic progress for all. Read More > News & Events News & Events News & Press > Articles > Press Releases > Media Inquiries > Research Reports & Publications > Latest Report > More Reports from GCA > Events > All Events > Events Go to our events calendar to learn more about what's happening at GCA. View Events > About Us About Us About GCA > Our Vision > Our Mission > Our Programs > Our History > History > Timeline of Achievements > Team > Staff > Board of Directors > Strategic Advisors > Ambassadors > Careers > View Current Openings > How We Work By mobilizing collective action, we transform fragmented efforts into organized, coherent, and global progress. Read More > DONATE GO Our Work Improving Internet Integrity AIDE > MANRS > Domain Trust > Increasing Cyber Protection & Resilience GCA Cybersecurity Toolkits > ACT > CyberFlex > Our Tools Use a Tool ACT > CyberFlex > DMARC > GCA Cybersecurity Toolkits > Internet Pollution Index > MANRS Observatory > Quad9 > GCA Learning Overview > Guides & Trainings > Get Involved Ways to Engage All Ways to Engage > Our Partners Premium Partners > GCA Contributors > GCA Collaborators > Our Community Work Common Good Cyber > Cyber Civil Defense > Nonprofit Cyber > Follow Our Work View Project Directory > News & Events News & Press Articles > Press Releases > Media Inquiries > Research Reports & Publications Latest Report > More Reports from GCA > Events All Events > About Us About GCA Our Vision > Our Mission > Our Programs > Our History History > Timeline of Achievements > Team Staff > Board of Directors > Strategic Advisors > Ambassadors > Careers View Current Openings > DONATE English Article New Report: Salt Typhoon Across the Internet BY Meghal Donde 9 December 2025 Facebook LinkedIn Twitter Mastodon In September 2024, the FBI and CISA disclosed one of the most significant cyber espionage campaigns targeting U.S. critical infrastructure: Salt Typhoon. This operation compromised major telecommunications providers, breached government wiretapping systems, and established persistent access across global networks. Unlike typical cyberattacks seeking to steal customer data, Salt Typhoon focused on controlling communications infrastructure that billions rely on every day. Salt Typhoon targeted some 80 nations in a sweeping hack of global telecom systems, with at least 600 organizations notified that the hackers had interest in their systems. The Global Cyber Alliances new report, Salt Typhoon Across the Internet: What AIDE Honeypots Reveal About a Persistent State-Linked Campaign , uses AIDE data to demonstrate Salt Typhoons operational characteristics through observable attack patterns spanning 2+ years. Salt Typhoon has been publicly attributed to actors based in China and assessed as state-sponsored; AIDEs findings focus only on behavioral evidence and do not directly attribute the activity to Chinese authorities. Between August 2023 and August 2025, AIDE recorded more than 72 million China-origin attack attempts against decoy systems emulating telecommunications networks. Within this broader dataset, AIDE identified patterns consistent with Salt Typhoons tactics, techniques, and procedures (TTPs)---providing an empirical view of the campaigns operational tempo and corroborating indicators described in public advisories by CISA, the FBI, and industry partners. According to CISA and partner nation advisories , Salt Typhoons reach extends beyond telecommunications to government, transportation, lodging, and military infrastructure networks globally . This represents persistent access to critical infrastructure across 80+ countries---not just espionage, but the capability to monitor, disrupt, or manipulate essential services during peacetime or crisis. Call to Action Salt Typhoon is an active, evolving campaign requiring immediate action from infrastructure operators. Critical Priority: Inventory all Internet-facing VPN systems Search logs for suspicious webshell activity patterns (ASP/ASPX/PHP anomalies) Enable comprehensive logging on remote access systems High Priority: Patch Published Vulnerabilities per CISA Advisory AA25-239A Deploy Enhanced Monitoring Enable MFA and Restrict Protocols Strategic Priorities: Deploy out-of-band management networks for isolated administrative access Implement default-deny firewall rules and network segmentation Conduct comprehensive threat hunts using provided IOC patterns Establish baseline monitoring for attack lifecycle indicators observed in AIDE data Join the Fight Against Unwanted Internet Traffic The invisible war against unwanted traffic can only be won collectively, with a shared understanding that a secure and trustworthy Internet is everyones responsibility, from infrastructure operators to everyday Internet users in our digital society. Part of GCAs Internet Integrity Program , the AIDE project has been continuously collecting data on unwanted IP address activity since 2019. This data provides deep insight into the volumes of unwanted traffic and enables precise tracking of emerging global threats. With this data, we continue to analyze Salt Typhoon and other cybercriminal or state-sponsored campaigns that exploit our networks disguised in the pervasive phenomenon of unwanted Internet traffic. To accelerate this work, GCA has launched the AIDE Community . After years of exploring the AIDE repository through a research lens, the community is expanding to include investigators from organizations with the ability to influence the entire Internet ecosystem through collective action. We will soon open our data platform to key actors---network operators, national authorities, and research centers---who can drive change within their areas of responsibility. If your organization can be part of this movement and you would like to join our community, contact us to get started. In the meantime, please explore the full report to learn more about what AIDE data can discover. Download the Report Topics: AIDE Internet Integrity Tags: Salt Typhoon RELATED NEWS Internet Integrity Workshop III: Residential Proxies and Infected Infrastructure The GCA Internet Integrity Program convened the Internet Integrity Workshop III on 18 May 2026 at the Edinburgh... READ MORE > Strengthening the Internets Foundations: Recent Progress Across MANRS, Domain Trust, and AIDE Much of the technology that keeps the Internet functioning safely operates far from public view. Routing systems... READ MORE > GCA at RIPE 92: Tackling Residential Proxy Abuse and Strengthening Internet Integrity As part of our continued work to strengthen Internet Integrity, the Global Cyber Alliance team will participate in... READ MORE > Subscribe to our newsletter to keep up with the latest. SUBSCRIBE IMPROVE YOUR CYBERSECURITY. USE A TOOL. ACT | AIDE | CyberFlex | DMARC | Domain Trust | GCA Cybersecurity Toolkits | MANRS | Quad9 New York | London | Brussels The Global Cyber Alliance (GCA) is a global nonprofit that makes the Internet safer by reducing widespread cyber risk. We bring together partners across sectors to strengthen the Internets core infrastructure and put practical cyber protections in the hands of the organizations and communities most at risk. As the threat landscape evolves at a pace unmatched in speed and scale, GCA is at the forefront, studying the problem, convening the right people and organizations, and delivering solutions that work. [email protected] | +1.646.677.5535 Contact Privacy Policy Terms of Service Intellectual Independence Policy Diversity & Inclusion Statement Artificial Intelligence Policy & Disclosure Our Work Improving Internet Integrity Increasing Cyber Protection & Resilience Our Tools Use a Tool GCA Learning Get Involved Ways to Engage Our Partners Our Community Work Follow Our Work News & Events News & Press Research Reports & Publications Events About Us About GCA Our History Team Careers DONATE GCA is a 501(c)(3) in the U.S. and a nonprofit in the U.K. and Belgium. Copyright 2026 Global Cyber Alliance ``` --- *Archived reference article for AICSR-STUDY-2026-001 footnote corpus.*