Norway Reports Salt Typhoon Hackers Targeting Vulnerable Systems

The Norwegian government has revealed that it fell victim to the cyber espionage efforts of the Salt Typhoon group, marking one of the clearest acknowledgments of a broader attack attributed to Chinese state-sponsored actors. This development underscores how the Chinese nation-state cyberespionage campaign is extending its reach beyond U.S. borders, targeting allied infrastructures.

According to an annual threat assessment report by the Norwegian Police Security Service, Salt Typhoon is linked to Chinese private cybersecurity firms and exemplifies an actor that successfully compromised vulnerable network devices within Norwegian organizations. The report emphasizes the increasing role of private contractors in facilitating Chinese cyber operations, which augment the capabilities of state intelligence services.

Norwegian officials emphasized that Chinese cyber operations are poised to be a significant intelligence threat throughout 2026. They warned that these operations have expanded through targeted cyber strategies and human-source recruitment. The assessment indicates that foreign intelligence services are increasingly utilizing cyber tactics to exploit vulnerabilities in network devices such as routers and servers, allowing for ongoing access to critical digital infrastructure.

Prior to this, U.S. officials linked the Salt Typhoon group to various intrusions into federally-managed networks and sensitive telecommunications systems, particularly noted during the 2024 presidential campaign. Initial identification of the group within U.S. federal networks raised alarms about the extensive capabilities of Chinese hackers, who have successfully infiltrated major telecommunication companies and governmental operations.

Experts have alerted that similar campaigns targeting telecommunications are likely to continue, as intelligence access to critical communication infrastructure becomes paramount for China. This is particularly pressing for NATO-aligned countries, where such hostile cyber operations are anticipated to intensify.

The Norwegian security agency has identified a growing trend of state-sponsored cyber activity within its borders. Russia has ramped up its cyber operations in light of geopolitical tensions, while Iranian intelligence focuses on Western interests and dissidents. Cyber operations are critical tools for information collection amidst these threats. The report also indicated that advancements in artificial intelligence could further bolster state-sponsored hacking capabilities.

Furthermore, foreign intelligence services are known to exploit technical and human vulnerabilities through tactics such as social engineering, recruitment campaigns, and long-term access strategies aimed at gathering sensitive information from various public and private entities. Such methodologies are reflective of specific MITRE ATT&CK tactics, including initial access and persistence, which describe how adversaries infiltrate and maintain access within targeted environments.