While GhostSpider took all the limelight, Salt Typhoon was also spotted using other, never-seen-before variants, including a Linux backdoor called Masol RAT, a rootkit called Demodex, and a backdoor named SnappyBee.

The reach of the China-linked Salt Typhoon gang extends beyond American telecommunications giants, and its arsenal includes several backdoors, including a brand-new malware dubbed GhostSpider, according to Trend Micro researchers.

The Chinese state-sponsored hacking group Salt Typhoon has been observed utilizing a new "GhostSpider" backdoor in attacks against telecommunication service providers.

Salt Typhoon's breach compromises U.S. telecom giants, including T-Mobile, AT&T, and Verizon. The hack exposes vulnerabilities in U.S. wiretapping systems, threatening national security and potentially the data of millions of Americans. T-Mobile claims limited damage, but the full scope of the breach is still unclear.

The Chinese government espionage campaign that has deeply penetrated more than a dozen U.S. telecommunications companies is the “worst telecom hack in our nation’s history — by far,” a senior U.S. senator told The Washington Post in an interview this week.

A recent confirmed T-Mobile hack has been attributed to Salt Typhoon, the Chinese cyber espionage team that also breached Verizon and AT&T earlier in the year. That means the hackers were able to penetrate all three of the country's major mobile carriers in 2024.

T-Mobile says the Chinese "Salt Typhoon" hackers who recently compromised its systems as part of a series of telecom breaches first hacked into some of its routers to explore ways to navigate laterally through the network.

The mobile carrier provided its first detailed rundown of how it stopped hackers from infiltrating its networks.