Salt Typhoon: what telecom espionage means for your vendor list

About this series

The reach of Salt Typhoon

Starting in late 2024, a series of sophisticated intrusions were identified across major United States telecommunications providers, including AT&T, Verizon, and Lumen Technologies. Security firms and federal authorities attributed this activity to a Chinese state-linked group known as Salt Typhoon. Unlike a typical Ransomware (show definition) attack that seeks to disrupt and extort, Salt Typhoon was designed for stealth and long-term intelligence gathering.

The attackers gained deep access into the core infrastructure of these providers. Most concerning was their ability to reach the systems used for lawful wiretaps, which are mandated by federal law for law enforcement purposes. By infiltrating these systems, the actors could potentially monitor call metadata and even the content of communications for specific targets. For the average business, this meant that their provider—the very foundation of their communications—could no longer be assumed secure.

The hidden access in your infrastructure

Small and mid-sized businesses often assume that their data is safe once it leaves their office network. The Salt Typhoon incident proved that the pipes themselves can be compromised. Your internet service provider, your phone system host, and your IT support firm all hold a level of access that is often invisible to you. If a well-resourced attacker can compromise these vendors, they gain a 'god-eye' view of your business operations without ever touching your actual computers.

This type of supply-chain attack is particularly dangerous because it bypasses traditional perimeter defenses. You might have the best firewall in the world, but if the traffic is being intercepted at the carrier level, that firewall is of little use. Recognizing that your vendors are part of your attack surface is the first step in modernizing your security posture. You must account for the access your vendors have and the data you entrust to them.

Beyond the perimeter: zero-trust vendor access

The response to Salt Typhoon requires a shift toward zero-trust thinking. Traditionally, zero-trust is discussed in the context of employee logins, requiring Multi-factor authentication (MFA) (show definition) and verifying every request. However, this same logic must be applied to vendor access. You should no longer trust a service provider just because they have a long-standing contract or a recognizable brand name. Access should be granted only when necessary and at the lowest level possible.

For businesses that rely on managed service providers (MSPs) or cloud vendors, this means auditing their access regularly. Do they have admin rights they don't need? Are they using their own MFA to protect the tools they use to manage your network? A zero-trust approach assumes that the network is already compromised, which forces you to build defenses that don't rely on the 'trustworthiness' of the infrastructure.

• List every vendor that has direct access to your internal systems or customer data
• Verify that all vendor logins require multi-factor authentication
• Review and remove administrative rights for vendor accounts that do not strictly require them
• Ask your critical vendors for their most recent third-party security audit or compliance report

Encryption and monitoring as defense

Since you cannot always control the security of the telecom providers you use, you must protect the data itself. End-to-end encryption is no longer optional. When data is encrypted from the moment it leaves your device until it reaches its final destination, it becomes much harder for an intercepting party like Salt Typhoon to make use of it. This applies to email, file transfers, and even internal messaging tools.

Monitoring is the second pillar of defense. While state actors are stealthy, they still leave tracks. Using tools like Endpoint detection and response (EDR) (show definition) and having a Security operations center (SOC) (show definition) watch your network allows you to spot anomalies that might indicate a compromised vendor account or an unusual data transfer. The goal is to make the environment so difficult to navigate that even a well-resourced actor finds it easier to move on to a softer target.

Managing the modern vendor list

As we moved through 2025, the advisories from CISA and other agencies made one thing clear: vendor risk management is a permanent business function. It is no longer a one-time task during onboarding. You must continuously evaluate the security posture of your partners. This includes asking tough questions about their own supply chains and where their equipment is manufactured.

For a mid-sized business, this can feel overwhelming. You don't have to be a security expert to manage this risk, but you do need a process. Start by categorizing your vendors by the level of risk they pose. A vendor that hosts your customer database is high risk; a vendor that provides office snacks is low risk. Focus your energy on the top five vendors who could hurt your business the most if they were compromised. Resilience isn't about being perfect; it's about being prepared for the inevitable failure of a trusted partner.