Spilling Tea on Salt Typhoon: Chinese Hackers Read Your Boss's Email and Nobody Knows How Much They Got

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey listeners, Ting here on your Digital Frontline, and today we’re diving straight into China’s latest moves in the cyber shadows targeting US interests. The big storyline is still the Chinese state‑aligned group Salt Typhoon. According to Government Executive and SecurityWeek, investigators now say Salt Typhoon didn’t just hit US telecom backbones last year; they also burrowed into email systems used by staff on powerful House committees, including Foreign Affairs, Intelligence, and Armed Services. Government Executive reports that investigators still don’t know how many inboxes were fully exfiltrated, which is nation‑state speak for “assume the worst and work backward.” Techdirt frames it bluntly: this was historic, long‑term access into the conversations of US officials, riding on top of negligent telecom security and weak oversight. SecurityWeek’s latest roundup adds more flavor: Chinese operators probing US government email isn’t a one‑off; it’s part of a continuing pattern of espionage that sits alongside mass ransomware and data‑theft campaigns. That’s why Ken Westbrook at the Wilson Center is warning that the US “cyber border” is as real as the physical one, and that cyber‑enabled financial and government data theft has become a quiet national‑security crisis. On the infrastructure side, Cisco Talos just dropped a deep dive into a China‑nexus outfit they track as UAT‑7290. They’re currently focused on telecom and critical infrastructure in South Asia and parts of Europe, but here’s why US defenders should care: Cisco Talos says UAT‑7290 loves edge devices, one‑day exploits, and turning compromised Linux boxes into “Operational Relay Boxes” that other Chinese groups can hijack. That means your random VPN concentrator in Ohio could easily become a hop point in someone else’s espionage chain. Meanwhile, Huntress is calling out a Chinese‑speaking threat actor abusing SonicWall VPNs plus VMware ESXi zero‑days to pivot from a guest VM to full hypervisor control. They say the exploit toolkit looks like it was developed as a zero‑day as far back as early 2024 and only later surfaced publicly, which screams well‑funded, long‑game operator. That same tradecraft used for ransomware can just as easily be used for quiet data theft in federal contractors, cloud providers, and critical infrastructure. So what do you, the CISOs, admins, and “I‑just‑inherited‑this‑network” heroes, do tonight? First, treat email and identity as your blast‑radius center of gravity: enforce phishing‑resistant MFA for all privileged and government‑adjacent accounts, lock down OAuth app consents, and aggressively monitor impossible‑travel and anomalous inbox rules. Second, harden the edge: patch or isolate SonicWall, VMware ESXi, and any internet‑facing VPN or firewall; if you can’t patch, segment it like it owes you money. Turn on detailed logging and ship those logs off‑box so an attacker can’t wipe th This content was created in partnership and with the help of Artificial Intelligence AI.