Salt Typhoon vs Volt Typhoon: China’s Two Hacking Campaigns Explained
Salt Typhoon vs Volt Typhoon: what CISA, NSA, FBI and Treasury say each Chinese hacking group targets, why, and how the two campaigns differ.
Salt Typhoon and Volt Typhoon are two names for Chinese state-sponsored hacking activity that U.S. agencies have warned about in public advisories. They are often mentioned together, but the U.S. government describes them as different operations with different targets. This explainer sets out what each group is, what officials say it does and how the two compare.
What is Volt Typhoon?
In a joint advisory released on Feb. 7, 2024, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the FBI said that People’s Republic of China (PRC) state-sponsored actors “are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States.” The advisory (AA24-038A) named the group Volt Typhoon.
According to CISA, the victims were mainly in the communications, energy, transportation systems, and water and wastewater sectors, in the continental United States and its territories, including Guam. The agencies said Volt Typhoon’s targets and behavior were “not consistent with traditional cyber espionage or intelligence gathering operations.” They also said they had seen the actors keep footholds in some victim networks “for at least five years.”
What is Salt Typhoon?
Salt Typhoon is linked to the compromise of telecommunications networks. On Jan. 17, 2025, the Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned Sichuan Juxinhe Network Technology, a company it said had “direct involvement” in the Salt Typhoon group. Treasury said Salt Typhoon had been active since at least 2019 and had “compromised the network infrastructure of multiple major U.S. telecommunication and internet service provider companies.”
A later joint advisory, AA25-239A, said PRC state-sponsored actors were targeting telecommunications, government, transportation, lodging and military infrastructure networks worldwide. It said the actors focus on large backbone routers of major telecommunications providers and “often modify routers to maintain persistent, long-term access.” The advisory said this activity partially overlaps with what industry calls Salt Typhoon and that it had been observed in the United States, Australia, Canada, New Zealand and the United Kingdom, among other places.
That advisory also linked the operations, active since at least 2021, to several China-based companies that it said provide cyber products and services to units of the People’s Liberation Army and the Ministry of State Security. According to the advisory, the stolen data “ultimately can provide Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world.”
Salt Typhoon vs. Volt Typhoon: the key differences
| Volt Typhoon | Salt Typhoon | |
|---|---|---|
| Main targets (per U.S. agencies) | U.S. critical infrastructure: communications, energy, transportation, water | Telecom backbone and edge routers; also government, transportation, lodging and military networks |
| Assessed purpose | Pre-positioning for possible disruption in a crisis | Collecting data that can help intelligence services track communications and movements |
| Key U.S. document | CISA advisory AA24-038A (Feb. 2024) | Treasury sanctions (Jan. 2025); CISA advisory AA25-239A |
In short, U.S. agencies describe Volt Typhoon as a disruption threat and Salt Typhoon as an espionage threat. The U.S. documents cited here do not include a response from the Chinese government.
What it means
Analysis: The two advisories describe risks to different layers of the same system. Telecom intrusions expose who talks to whom, while infrastructure footholds could matter most in a crisis over Taiwan or elsewhere, when power, water and ports carry military weight. Both rest on old, unpatched or end-of-life network equipment, which is why CISA’s first listed step against Volt Typhoon is to patch internet-facing systems, followed by phishing-resistant multifactor authentication and central logging.
For the latest government cyber advisories, see the Peter’s World NSA warnings tracker and the information warfare news hub.
Sources
- CISA: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
- CISA: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide (AA25-239A)
- U.S. Treasury: Treasury Sanctions Company Associated with Salt Typhoon
