FBI Appeals for Public Assistance in Countering Salt Typhoon Cyberattacks

FBI asks public for Salt Typhoon tips

At a glance

• Salt Typhoon Threat: The FBI says the PRC-affiliated group Salt Typhoon compromised multiple U.S. telecommunications companies.
• FBI’s Call to Action: On April 24, 2025, the FBI asked the public for information, especially about the individuals behind the campaign.
• Emerging Patterns: The group stole call data logs, some private communications and information tied to court-ordered law enforcement requests.
• Security Measures Needed: A State Department reward of up to $10 million is on offer for qualifying information.

FBI public appeal for Salt Typhoon tips

On April 24, 2025, the FBI issued a public service announcement asking for information about Salt Typhoon, the PRC-affiliated hacking campaign that compromised multiple U.S. telecommunications companies. The bureau said it particularly wants to hear about the specific individuals behind the campaign.

The FBI said its investigation revealed “a broad and significant cyber campaign” that used access to telecom networks to target victims on a global scale. The activity resulted in the theft of call data logs, a limited number of private communications involving identified victims, and the copying of select information subject to court-ordered U.S. law enforcement requests.

Where to send a tip

Tips can go to a local FBI field office or to the FBI’s Internet Crime Complaint Center at ic3.gov. The State Department’s Rewards for Justice program is offering up to $10 million for information about foreign government-linked individuals involved in malicious cyber activity against U.S. critical infrastructure, and it takes tips over Signal and a Tor-based tip line.

The FBI and its partners had already put out statements on Salt Typhoon on October 25 and November 13, 2024, and published hardening guidance for communications infrastructure on December 3, 2024.

How Salt Typhoon gets in

Public reporting on the campaign says the group got into telecom networks through weaknesses in network equipment and then used legitimate credentials to move around. Quietly. That let it stay inside compromised networks for long periods without being noticed.

Telecom and network teams can make that harder. Regular audits of network devices, staff training on protecting credentials and multi-factor authentication on admin access all raise the cost for an intruder.

What defenders can do now

Why go public? Investigators want help naming the people behind the campaign, not just stopping the intrusions, and a tip from an insider or a researcher could move the case forward.

Telecom operators and large enterprises should apply the December 2024 hardening guidance. Watch network devices for odd logins. Share indicators with peers and with the FBI.

Why the appeal matters

Salt Typhoon reached call records and systems tied to lawful intercept requests, which makes it one of the most serious espionage campaigns against U.S. telecoms on record. Anyone with information about the people behind it can report it to the FBI or to Rewards for Justice.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.