Ghost in the Machine: A National Security Briefing on Why Telecoms Can't Remove Salt Typhoon
By CyberDudeBivash • September 27, 2025 National Security Briefing
A persistent and stealthy threat actor, designated Salt Typhoon by Microsoft and linked to the People's Republic of China, has achieved a level of deep, embedded access within global telecommunications infrastructure that defies traditional methods of detection and eradication. This adversary operates as a 'ghost in the machine,' leveraging the systems' own tools and compromising core identity services to become part of the network fabric itself. This is not a problem that can be solved by simply 'cleaning' infected servers. This briefing will explain the technical reasons for this unprecedented persistence, detail the grave implications for national and economic security, and outline the necessary strategic shift from a futile eradication effort to a posture of active resilience built on Zero Trust principles.
Disclosure: This is a strategic briefing for senior leaders in government and industry. It contains affiliate links to technologies and training that are foundational to building a resilient, Zero Trust security posture against state-sponsored threats. Your support through these links helps fund our independent research.
National Resilience & Defense Toolkit
Bottom Line Up Front (BLUF) for Leadership: A highly sophisticated state actor is already inside our critical communications infrastructure. Their methods make them virtually impossible to fully remove. The strategic objective must therefore shift from eradication to containment and resilience. We must learn to operate securely in a compromised environment.
Chapter 1: The Adversary - Salt Typhoon's Strategic Objective of Persistence
Salt Typhoon, a threat group publicly attributed to the People's Republic of China and closely associated with the broader Volt Typhoon campaign, is not engaged in typical cybercrime. Their operations are not driven by financial gain but by the long-term strategic objectives of the state.
Their primary mission within telecommunications networks is to establish **permanent, undetected, and survivable access** to critical infrastructure. This is a deliberate military and intelligence doctrine applied to the cyber domain. The objective is not a quick smash-and-grab for data, but the patient cultivation of a strategic asset.
This "asset" of persistent access serves two main goals:
- Long-Term Espionage: To have a persistent "tap" on the data flows of strategic rivals. This allows for the ongoing collection of intelligence on government, military, and economic activities, providing a significant strategic advantage.
- Pre-positioning for Disruption: To embed capabilities within critical infrastructure that can be activated during a geopolitical crisis. This provides the state with a powerful, non-kinetic option to disrupt an adversary's military command and control, civilian communications, or economic stability.
Understanding this motivation is crucial. The adversary is not looking for a vulnerability they can exploit once. They are looking for systemic weaknesses that allow them to become a permanent, unseen feature of the network architecture.
Chapter 2: The 'Ghost' - The Technical Reasons Eradication is Failing
The term "ghost in the machine" is not hyperbole; it is an accurate technical description of Salt Typhoon's methodology. Their approach is designed to make them indistinguishable from the normal, legitimate operations of the network, rendering traditional "scan and clean" incident response futile. There are four core pillars to their persistence strategy.
1. Deeply Fileless "Living Off the Land" (LotL) Operations
As covered in previous briefings, LotL is a technique where attackers use only the legitimate tools already present on a system. Salt Typhoon are masters of this. They do not drop custom malware files that can be found by antivirus. Instead, they use:
- PowerShell, WMI, and Command Prompt on Windows servers.
- Standard CLI commands on routers, switches, and firewalls.
Because their actions are performed by legitimate, signed operating system components, there is no "malware" to detect or remove. The malicious activity is a phantom composed of legitimate processes. Wiping a server and reinstalling the OS may clean that one machine, but it doesn't remove the actor's knowledge or their access to other systems.
2. Compromise of Core Identity Systems (Domain Controllers)
Salt Typhoon has shown a specific affinity for targeting Active Directory Domain Controllers (DCs). A DC is the heart of a Windows network; it manages all user accounts, passwords, and permissions. It is the ultimate "keys to the kingdom."
By compromising a DC, the attackers can:
- Create Stealth Administrator Accounts: They can forge authentication tickets (a "Golden Ticket" attack) or create new admin accounts that are nearly impossible to distinguish from real ones.
- Achieve Ultimate Persistence: Even if incident responders find and clean 100 compromised servers, an attacker with control of the DC can simply use their stolen admin credentials to log back in and re-infect the network at will.
Until you can be 100% certain that every privileged account in your Active Directory is legitimate and under your control—a monumental task—the ghost can always return.
3. Hijacking of Edge Infrastructure (The SOHO Router Botnet)
One of Salt Typhoon's most innovative and challenging TTPs is their use of a global botnet of compromised Small Office/Home Office (SOHO) routers as their Command and Control (C2) infrastructure.
Instead of sending commands from a few dedicated servers that can be identified and blocked, they bounce their traffic through thousands of compromised, everyday routers (like Netgear, TP-Link, ASUS) in homes and small businesses around the world. This provides them with:
- Anonymity: Their true location is completely masked.
- Resilience: If defenders block one SOHO router's IP, the attackers have thousands more to use.
- Stealth: The malicious traffic blends in with the noise of normal residential and small business internet traffic, making it incredibly difficult for telcos to identify and block.
4. Deep Embedding in Network Appliance Firmware
The deepest and most persistent form of compromise involves embedding their code not just on servers, but within the firmware of the network devices themselves—the routers, switches, and firewalls that form the backbone of the telecom network.
These devices are often "black boxes" to security teams:
- They typically do not run standard EDR agents.
- Their firmware is rarely subjected to integrity checks.
- A compromise at this level can survive reboots, software patches, and even some hardware replacements.
This is the true ghost in the machine. The malicious code is not a file on a disk; it is part of the device's fundamental operating instructions. Eradicating this requires a complete, hardware-level replacement of vast sections of the network—a task that is often operationally and financially unfeasible.
Chapter 3: The National Security Implications of an Unremovable Threat
The inability to fully eradicate a sophisticated state actor from core telecommunications infrastructure is not merely a technical problem for the provider; it is a direct and enduring threat to national security.
Persistent Espionage at Scale
A permanent "ghost" in the network grants the adversary a level of intelligence insight that was previously unimaginable. It moves beyond discrete data breaches to a state of continuous, pervasive surveillance.
- Economic Security: The adversary can monitor and steal intellectual property, trade negotiation strategies, and sensitive financial data from every major industry in the country, eroding long-term economic competitiveness.
- Governmental Security: Diplomatic, military, and intelligence communications, even those from secure government networks, must transit the same core telecom infrastructure, putting them at risk of interception.
Pre-positioned for Disruption of Critical National Infrastructure (CNI)
This is the most severe risk. The persistence of Salt Typhoon is not just about listening; it's about having their hands on the switches. CNI sectors are completely dependent on telecommunications for their command and control operations:
- Energy Sector: Supervisory Control and Data Acquisition (SCADA) systems that manage power grids and pipelines rely on telco networks for remote operation.
- Financial Sector: The entire financial system, from stock exchanges to ATM networks, runs on data links provided by telcos.
- Transportation Sector: Air traffic control, railway switching, and port management are all coordinated over these networks.
In the event of a major geopolitical conflict, the access that Salt Typhoon has cultivated could be activated to disrupt these essential services, causing widespread societal chaos and crippling a nation's ability to respond.
Strategic Erosion of Trust
Perhaps the most insidious impact is the erosion of trust in our digital foundations. When businesses and government agencies can no longer fundamentally trust that their communications are private or that their infrastructure is secure, it creates a chilling effect. It introduces a level of friction and uncertainty into the economy and national security decision-making, which is a strategic victory for the adversary in itself.
Chapter 4: The Strategic Defense - Shifting from Eradication to Resilience
If we accept that complete eradication of a deeply embedded, state-sponsored threat is not a realistic short-term goal, then our entire security strategy must evolve. We must move from a fragile model based on "keeping them out" to a resilient model based on the assumption that "they are already in." The objective is to make their presence irrelevant by containing their ability to act.
This is the core premise of a **Zero Trust Architecture**.
Pillar 1: Assume Breach & Microsegment Your Network
Zero Trust starts by assuming the network is hostile. The primary defense, therefore, is to eliminate the concept of a trusted internal network.
- Microsegmentation: Your network should be divided into hundreds or thousands of small, isolated zones with strict security controls at the boundary of each. The "ghost" might be on the workstation of an HR employee, but a microsegmentation firewall will block any attempt from that workstation to connect to the control systems of the factory floor. The attacker is contained within a small cage, unable to reach valuable targets. This requires a significant investment in modern networking and security tools, but it is the only way to contain a persistent threat.
Pillar 2: Verify Explicitly - The Primacy of Identity
In a compromised network, identity is the only control plane you can trust.
- Phishing-Resistant Multi-Factor Authentication (MFA): Every single request to access data or an application must be verified with strong MFA. Even if Salt Typhoon controls the network and has stolen a user's password from the Domain Controller, they cannot access the critical application without the user's physical hardware token. This makes securing identity with tools like YubiKeys the single most important defense against this threat.
Pillar 3: End-to-End Encryption (E2EE) - Making Interception Worthless
If you assume your data is being intercepted in transit by a compromised telco, the only way to protect it is to ensure it is encrypted from the moment it leaves your server to the moment it arrives at its destination.
- Data-in-Transit Encryption: While standard TLS/HTTPS is a good start, a resilient strategy involves layering encryption. This includes using secure VPNs for all site-to-site and remote access traffic, and deploying application-level encryption for the most sensitive data.
Pillar 4: Continuous Monitoring - Hunting for the Ghost's Actions
Since you cannot find the ghost itself, you must hunt for its actions.
- Behavioral Detection (EDR/NDR): Deploy advanced Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) tools. These platforms, like the solutions offered by Kaspersky, use AI and machine learning to baseline normal activity and can detect the subtle, anomalous behaviors of a LotL attack, even when legitimate tools are being used.
Chapter 5: A Call to Action for a Public-Private Defense Partnership
The threat posed by Salt Typhoon to national infrastructure is not a problem that can be solved by any single company or government agency. It is a systemic, national-level risk that requires a coordinated, national-level response. This is a shared responsibility.
For Government and Policymakers
- Set Mandatory Security Standards for CNI: The security of telecommunications should be treated as a matter of national security, with mandatory, auditable cybersecurity standards for all providers.
- Foster Rapid Threat Intelligence Sharing: Declassify and share actionable intelligence about APT TTPs with the private sector at machine speed.
- Fund SOHO Router Cleanup Initiatives: Launch a national-level program, similar to a "cash for clunkers" program, to incentivize the replacement of old, insecure SOHO routers that form the backbone of the adversary's C2 network.
For Telecommunications Providers
- Aggressively Adopt Zero Trust Internally: Telecoms must lead the way by re-architecting their own operational and corporate networks based on Zero Trust principles to contain these threats.
- Increase Transparency: Be more transparent with enterprise and government customers about the threats you are facing and the security services you offer to help them mitigate those threats.
- Invest in Network-Level Behavioral Analytics: Deploy advanced NDR tools that can identify the subtle signs of LotL activity within your core network.
For All Other Enterprises and Critical Infrastructure Sectors
- Treat Your Telco as a Critical, Untrusted Supplier: In your risk management program, formally classify your telecom provider as a critical supplier and assume their network is a hostile environment.
- Accelerate Your Own Zero Trust Journey: Do not wait for your provider to be secure. Your own survival depends on your ability to build a resilient architecture that can operate securely over an untrusted network. This requires executive sponsorship and investment in the technologies and skills, like those taught by Edureka, to make it a reality.
- Demand Security in Your Contracts: Use your purchasing power to demand stronger security clauses, audit rights, and transparency from your service providers.
Chapter 6: Extended FAQ for National Security Leaders
Q: Why can't telcos simply block traffic from the compromised SOHO routers?
A: The scale makes this impossible. There are tens of thousands of these devices in the botnet, and their IP addresses are constantly changing as they are rebooted or assigned new dynamic IPs. Furthermore, these are legitimate residential and small business connections. Blocking them would mean cutting off service to legitimate customers. The attackers have deliberately chosen an infrastructure that is impossible to blacklist without massive collateral damage.
Q: If a telecom provider is compromised, does that mean all data on their network is stolen?
A: Not necessarily. State-sponsored actors are targeted. They are not stealing every piece of data, but are rather looking for specific intelligence. However, the *capability* to intercept a vast amount of data exists once they have compromised the core infrastructure. This is why end-to-end encryption is so critical—it makes their position on the network far less valuable.
Q: How does this threat relate to the physical security of undersea cables and cell towers?
A: It is the digital equivalent. A state can achieve the same disruptive or espionage effects by compromising the software that controls the network as they could by physically cutting a cable. The cyber domain offers a more deniable, less costly, and often more effective means of achieving the same strategic objective.
Q. What is the single most important investment we can make today to improve our resilience against this threat?
A. While a full Zero Trust transformation is the strategic goal, the single most impactful investment you can make *today* is in **Identity and Access Management**. Specifically, deploying phishing-resistant Multi-Factor Authentication (MFA) for every user, starting with your administrators. If the adversary cannot compromise your identities, their ability to move through your environment and access your data is drastically reduced, even if they have a foothold on the underlying network.
Join the CyberDudeBivash Executive ThreatWire
Receive concise, strategic briefings on the cybersecurity threats that impact national and economic security. We translate technical risks into business impact and provide actionable, board-level guidance. Subscribe to stay ahead.
Subscribe on LinkedIn
Related Strategic Briefings from CyberDudeBivash
#CyberDudeBivash #NationalSecurity #SaltTyphoon #VoltTyphoon #APT #ZeroTrust #CISO #CriticalInfrastructure #Telecom #CyberThreat
Comments
Post a Comment