# Salt Typhoon cyber espionage campaign

> Live situation record from CLSTR: https://clstr.news/situations/salt-typhoon-cyber-espionage-campaign
> Updated: 2026-09-06T11:45:00.000Z. Sources: 8. Developments: 2.

A large-scale cyber espionage campaign attributed to the Chinese state-sponsored group ‘Salt Typhoon’ has targeted over 200 entities across 80 countries, with a primary focus on United States telecommunications infrastructure.

Investigators believe the campaign, linked to the Chinese Ministry of State Security, aimed to harvest sensitive communications metadata and phone records. The attackers specifically targeted major providers including AT&T, Verizon, Charter, Windstream, and T-Mobile, seeking data from high-profile figures such as senior U.S. government officials and presidential candidates.

In response to the intrusion, T-Mobile security staff identified unusual activity traced to a router at a data center. To isolate the threat and prevent a widespread breach, T-Mobile engineers physically severed the cable connecting the compromised system to the outside world. The breach allowed attackers to access metadata from calls and messages belonging to millions of customers.

## Timeline

### 2026-09-06: Salt Typhoon cyber espionage targets U.S. telecom networks

The ‘Salt Typhoon’ cyber espionage campaign, linked to China, infiltrated nine major U.S. telecom providers to harvest metadata from millions of users and political figures.

2 sources. https://clstr.news/cluster/salt-typhoon-cyber-espionage-targets-us-telecom-networks

### 2026-08-20: T-Mobile engineers physically cut cable to stop Chinese hackers

T-Mobile security staff physically cut a network cable to oust Salt Typhoon, a Chinese state-sponsored hacking group, following a massive espionage campaign targeting U.S. telecommunications infrastructure.

6 sources. https://clstr.news/cluster/t-mobile-engineers-physically-cut-cable-to-stop-chinese-hackers

---
Cite as: Salt Typhoon cyber espionage campaign. CLSTR, https://clstr.news/situations/salt-typhoon-cyber-espionage-campaign