Cyber War

Information collected during the yearslong Salt Typhoon attack could allow Beijing’s intelligence services to track targets from the United States and dozens of other countries.

China has hacked into American power grids and companies for decades, stealing sensitive files and intellectual property such as chip designs as it seeks to gain an edge over the United States.

But a sweeping cyberattack by a group known as Salt Typhoon is China’s most ambitious yet, experts and officials have concluded after a year of investigating it. It targeted more than 80 countries and may have stolen information from nearly every American, officials said. They see it as evidence that China’s capabilities rival those of the United States and its allies.

The Chinese model is disturbingly efficient.

Welcome to 2025, where China’s cyber strategy is no longer espionage. It’s pre-positioning — the digital equivalent of landmines buried deep in our networks, designed not to explode on contact, but to wait in silence until detonation serves strategic purpose.

In June 2025, the Department of Homeland Security confirmed that Chinese state-sponsored hackers, operating under the codename Salt Typhoon, had spent nine months infiltrating a U.S. state’s Army National Guard network. Not loitering. Not poking. Nesting. They extracted more than 1,400 configuration files, admin credentials, and communication archives tied to secure inter-state systems — a sweep confirmed in the Daily Beast.

America remains ill-prepared for Chinese hackers targeting critical infrastructure.

It’s a crisis that almost no one is talking about. The Chinese Communist Party is now the world’s preeminent practitioner of cyber warfare. Once notoriously loud and clumsy, the CCP’s hackers have become stealthy and sophisticated. They’re intercepting the calls and texts of our leaders and infiltrating servers at our ports, power plants, and water-treatment facilities. Yet hardly anyone seems to care. When Congress held hearings on cybersecurity late last year, only a handful of journalists bothered to cover them.

Chinese government-backed hackers have penetrated deep into U.S. internet service providers in recent months to spy on their users, according to people familiar with the ongoing American response and private security researchers.

The unusually aggressive and sophisticated attacks include access to at least two major providers with millions of customers as well as to several smaller providers, people familiar with the separate campaigns said.

“It is business as usual now for China, but that is dramatically stepped up from where it used to be. It is an order of magnitude worse,” said Brandon Wales, who until earlier this month was executive director of the Cybersecurity and Infrastructure Security Agency, CISA.

… The malware, one congressional official said, was essentially “a ticking time bomb” that could give China the power to interrupt or slow American military deployments or resupply operations by cutting off power, water and communications to U.S. military bases. But its impact could be far broader, because that same infrastructure often supplies the houses and businesses of ordinary Americans, according to U.S. officials.

Suspected state-backed Chinese hackers used a security hole in a popular email security appliance to break into the networks of hundreds of public and private sector organizations globally, nearly a third of them government agencies including foreign ministries, the cybersecurity firm Mandiant said Thursday.

“This is the broadest cyber espionage campaign known to be conducted by a China-nexus threat actor since the mass exploitation of Microsoft Exchange in early 2021,” Charles Carmakal, Mandiant’s chief technical officer, said in a emailed statement. That hack compromised tens of thousands of computers globally.