Canada says telcos were breached in China-linked espionage hacks

Canada’s telecommunications sector has fallen victim to sophisticated cyber intrusions, with the Canadian government and the U.S. Federal Bureau of Investigation (FBI) jointly confirming malicious activity targeting telcos across the nation. These breaches are firmly attributed to “Salt Typhoon,” a formidable China-backed hacking group known for its global cyber espionage campaigns.

In a detailed joint advisory issued late Friday, authorities disclosed that at least one unnamed Canadian telecommunications company experienced a significant breach in mid-February of this year. The attackers skillfully manipulated three Cisco-made routers within the telco’s infrastructure, enabling stealthy traffic collection and data exfiltration from its network. This incident highlights a growing concern over state-sponsored cyber threats to critical national infrastructure.

Investigations reveal that Salt Typhoon’s malicious targeting extends beyond the telecommunications sector. This prolific group, active since at least late 2024, has previously demonstrated its capabilities by infiltrating U.S. phone giants, internet providers, and more recently, datacenter hosts. Their overarching objective appears to be a broad espionage campaign aimed at acquiring intelligence on senior U.S. government officials, signaling a strategic and persistent threat to Western nations.

Security experts believe Salt Typhoon is one of several China-linked hacking collectives actively preparing for a potential future invasion of Taiwan by 2027. This broader geopolitical context underscores the gravity of these cyber incursions, which are not merely opportunistic but are likely part of a long-term strategic play to potentially disrupt critical communications infrastructure.

The joint advisory from Canadian and FBI authorities delivers a stark warning: Salt Typhoon is “almost certainly” expected to continue targeting Canadian organizations vigorously over the next two years. This forecast necessitates heightened vigilance and robust cybersecurity measures across all critical sectors to counter the evolving threat landscape and protect national security.