Small Providers Under Siege: Salt Typhoon Shows No Mercy

Small Providers Under Siege: Salt Typhoon Shows No Mercy

• Salt Typhoon, a China-backed hacking group, has broken into multiple U.S. telecommunications companies.
• Smaller providers often lack the security staff and budgets of the big carriers.
• The FCC has tightened expectations for how carriers protect their networks.
• Basic hygiene, such as patching, strong passwords and MFA, closes many of the doors Salt Typhoon uses.

Introduction: Salt Typhoon’s attacks on telecom networks have mostly made news for hitting the largest U.S. carriers. Smaller communications providers face the same threat with far fewer resources. This article looks at what the group has done, why small providers are exposed, and what they can do about it.

Who Salt Typhoon is

Salt Typhoon is a hacking group sponsored by the People’s Republic of China. In December 2024, the White House’s deputy national security adviser for cyber and emerging technology confirmed that it had infiltrated at least nine U.S. communications companies. In April 2025, the FBI asked the public for tips about the group. Quotes in an earlier version of this article attributed to “Marla Harfsten” and “Steve McLaughlin” could not be verified and have been removed.

Why small providers are exposed

Large carriers have big security teams. Many small and rural providers don’t. Limited technical staff, tight budgets and older equipment are common weaknesses, and a small provider’s network can still connect to bigger ones. As a Womble Bond Dickinson analysis noted in April 2025, all U.S. communications providers are at risk, especially those near U.S. military facilities.

How the group operates

Salt Typhoon has focused on network infrastructure, exploiting known weaknesses in routers and other equipment and using stolen credentials to get in and stay hidden. Once inside, it has gone after sensitive systems, including those used for lawful intercept. An earlier version of this article described customized phishing as a key tactic; that was not supported by public reporting and has been removed.

What providers can do

In January 2025, the FCC issued a ruling that carriers have a legal duty under CALEA to secure their networks against unlawful access, which means basics such as role-based access controls, changing default passwords, strong password rules and multi-factor authentication. Patch known vulnerabilities quickly. Smaller providers can also lean on outside security firms for monitoring and incident response they can’t staff themselves.

A plan for small carriers

Salt Typhoon shows that size doesn’t protect anyone. Small providers should build a cybersecurity and supply chain risk management plan and an incident response plan, aligned with NIST’s Cybersecurity Framework 2.0 or CISA’s performance goals. They should also check their cyber insurance and vendor contracts, since the FCC has proposed rules that would require annual certification of these plans.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.