Canada says telcos were breached in China-linked espionage hacks

The Canadian government and the FBI say they are aware of malicious activity targeting telecommunication companies across Canada, attributing the intrusions to the China-backed hacking group Salt Typhoon.

In a joint advisory out late Friday, the feds said at least one unnamed Canadian telco was hacked in mid-February this year, in which hackers manipulated three Cisco-made routers to allow stealthy traffic collection from its network.

The feds say that separate investigations suggest that Salt Typhoon’s targeting is “broader than just the telecommunications sector.”

Salt Typhoon, active since at least late 2024, previously targeted U.S. phone giants and internet providers, and more recently datacenter hosts, as part of a broad espionage campaign aimed at collecting intelligence on senior U.S. government officials. Salt Typhoon is one of several China-linked hacking groups thought to be preparing for China to launch a potential future invasion of Taiwan by 2027.

The Canadian-FBI joint advisory said the hackers will “almost certainly” persist in targeting Canadian organizations “over the next two years.”