Salt Typhoon and Telecom Espionage: The Case for Assuming Breach

In late September 2024, reporting surfaced that a China state-linked group, later widely known as Salt Typhoon, had deeply compromised major broadband and telecommunications providers. The intrusions reportedly reached sensitive systems and lingered undetected for a long time, giving the actors extraordinary visibility into communications infrastructure.

The lesson beyond telecom

Most Canadian organizations are not carriers, but the tradecraft is universal: patient, well-resourced actors get in through an edge device or trusted connection, then move laterally through flat internal networks that assume anyone inside is friendly. This is precisely the scenario Zero Trust is designed to contain.

Assume-breach practices worth adopting

• Segment the network, so a foothold in one zone does not grant free movement to crown-jewel systems.
• Harden and monitor edge devices. Firewalls, VPNs, and routers are primary targets, not neutral plumbing.
• Watch east-west traffic, since lateral movement is invisible when you only monitor the perimeter.

Takeaway: Sophisticated groups succeed by exploiting the assumption that internal equals trusted. The controls that would slow a nation-state are the same ones that stop ordinary ransomware from spreading.