UK Sanctions Salt Typhoon Hackers Tied to Telco Breaches
Five years ago, in 2021, two major telecommunication companies, AT&T and Verizon, were among the victims of the worst global hack in US history. The attack allowed the group known as Salt Typhoon to gain access to systems that track user communications and movements.
Flash forward to 2026 and the UK has sanctioned two Chinese firms linked to a cyber operation targeting global infrastructure, with telecommunications networks high on the list.
The campaign is linked to China’s intelligence services and involves a range of state-backed hacking collectives.
Salt Typhoon refers to a group of hacking units that have operated globally since at least 2020. Western intelligence agencies say the group has compromised public and private networks, such as those supporting government, military and telecoms sectors. These include fixed-line networks, mobile infrastructure and systems used for lawful interception.
Hackers also breached US wiretapping infrastructure, which is used to monitor the communications of high-level officials, with President Donald Trump and Vice President JD Vance among those exposed.
The actors involved include groups known by aliases such as Operator Panda, GhostEmperor, RedMike, UNC5807 and Earth Estries. While each group works independently, they are believed to support China’s wider cyber intelligence strategy.
Their core tactic is to exploit known flaws, using CVEs – common vulnerabilities and exposures – rather than relying on undisclosed software bugs.
Telecoms links trigger UK sanctions
The UK Government’s response follows a detailed advisory report published by a coalition of cybersecurity agencies from the UK, US and Germany.
The report outlines how Salt Typhoon targets critical infrastructure, including telecoms operators, using persistent access to monitor traffic and extract sensitive data.
As a result, the UK announced sanctions against two Chinese companies: Sichuan Anxun Information Technology Co Ltd, also called i-Soon, and Integrity Technology Group Incorporated, known as Integrity Tech.
According to UK officials, i-Soon supports other attackers and is involved in breaches affecting more than 80 networks globally. These include telecoms systems used by commercial operators and governments.
Integrity Tech is accused of controlling covert networks and offering technical support to malicious cyber actors. The UK states that Integrity Tech also compromises British public sector IT systems, including telecoms infrastructure used for internal communications.
UK Foreign Secretary Yvette Cooper says the companies carry out “vast and indiscriminate cyber activities against the UK and its allies". She confirmed the government will take action to secure national telecoms systems from foreign interference.
China denies allegations as tension builds
While the UK has found no evidence of zero day vulnerabilities being used in Salt Typhoon operations, the pattern of behaviour across multiple regions has led to a diplomatic fallout.
The UK’s partners have taken similar steps. In early 2025, the US Government sanctioned Integrity Tech for its role in global espionage affecting sectors such as telecoms, defence and logistics.
China has rejected the allegations outright. Foreign Ministry spokesperson Guo Jiakun said: “We firmly oppose spreading disinformation out of political agenda. China strongly deplores and firmly rejects the UK’s political manipulation under the pretext of cybersecurity.”
He added that China “stands against hacking and fights such activities in accordance with the law,” and accused the UK of damaging diplomatic relations by imposing unilateral sanctions.
The Salt Typhoon campaign exposes deep fractures in cyber relations between the UK and China, with telecoms infrastructure emerging as a strategic battleground in digital geopolitics.