Canada’s cybersecurity agency reported that hackers likely linked to the Chinese government were behind recent attacks on the country’s telecommunications infrastructure.

Three network devices registered to a Canadian company were compromised.

The agency, along with the US FBI, issued a joint bulletin urging Canadian organizations to strengthen cybersecurity against a group known as Salt Typhoon.

Salt Typhoon, allegedly connected to the Chinese government, is targeting telecom companies and may affect other sectors.

The agency warned that the group is expected to continue its attempts to infiltrate Canadian organizations, especially telecom providers, over the next two years.

Beijing has denied previous allegations of involvement.

🔗 Source: Bloomberg

🧠 Food for thought

1️⃣ Telecommunications targeting represents a strategic intelligence-gathering approach

Salt Typhoon’s focus on telecom infrastructure reveals a sophisticated intelligence-gathering strategy rather than immediate disruptive intentions.

The Canadian Centre for Cyber Security specifically noted that securing telecommunications networks is crucial because they represent “high-value targets for threat actors seeking to conduct espionage” 1.

This approach mirrors the tactics of Volt Typhoon, another PRC-linked group, which has been observed maintaining persistent access to compromised networks for extended periods, primarily for intelligence collection 2.

By compromising telecom providers, attackers gain potential visibility into communications data across multiple sectors simultaneously, making it an efficient approach to wide-scale surveillance.

The Cyber Centre’s warning that these actors will “almost certainly” continue targeting Canadian telecom providers over the next two years suggests this is part of a long-term intelligence strategy rather than a one-time attack 1.

2️⃣ Technical exploitation patterns show increasing sophistication in targeting network infrastructure

Salt Typhoon’s campaign demonstrates the growing technical sophistication of state-backed actors targeting specific vulnerabilities in networking equipment.