Geopolitics › Global issues & flashpoints › US–China strategic rivalry
Cyber conflict (Volt and Salt Typhoon)
Disclosed 2023–24· Conflict or rivalry
Widely agreedMost analysts agree.
State-backed hacking for spying and sabotage, highlighted by the China-linked Volt Typhoon and Salt Typhoon campaigns disclosed in 2023–24.
See it on the Geopolitics map →The picture
US agencies say Volt Typhoon hid inside US power, water, port and pipeline networks, including on Guam, apparently to disrupt them in a crisis such as a Taiwan war, while Salt Typhoon broke into telecom carriers such as AT&T and Verizon to spy and was later found in dozens of countries. China denies both and accuses the US of hacking it. Precedents include Stuxnet against Iran, widely attributed to the US and Israel, and Russia's attacks on Ukraine's grid.
Why it matters
Cyberattacks blur war and peace: they can cripple infrastructure or steal secrets without a shot fired, making attribution and deterrence hard.
Key facts and numbers
Joint advisories from US, British, Australian and other cyber agencies, Microsoft and security-firm reports, and company breach disclosures. Attribution rests on forensics outsiders cannot fully verify.
What to watch
How deep the implants go and whether they have been removed, and what rules, if any, should govern state hacking in peacetime.
Connections (2)
▸Cyber conflict (Volt and Salt Typhoon) targets infrastructure in United StatesWidely agreed
The relationship
US agencies say Chinese state hackers known as Volt Typhoon hid inside US water, power, port and pipeline systems to disrupt them in a crisis such as a Taiwan war, while Salt Typhoon broke into major telecom carriers to spy. China denies it and accuses the US of hacking.
Since when and why
Disclosed by Microsoft and US agencies from May 2023 (Volt Typhoon, including Guam) and late 2024 (Salt Typhoon, including AT&T and Verizon).
How solid?
Joint advisories by CISA, the FBI and NSA with allied agencies, company disclosures and congressional testimony; China's government calls the claims fabricated.
What to watch
How much access remains despite clean-up efforts, and whether such pre-positioning deters or invites escalation in a crisis, are unknown.
▸Cyber conflict (Volt and Salt Typhoon) is attributed by US officials to China (People's Republic of China)Fact
The relationship
US officials and allies attribute two major campaigns to Chinese state hackers: Volt Typhoon, which hid inside US power, water, port and pipeline networks, apparently to disrupt them in a crisis such as a Taiwan war, and Salt Typhoon, which broke into telecom carriers to spy. China denies both and accuses the US of hacking it.
Since when and why
Volt Typhoon was disclosed by Microsoft and Five Eyes agencies in May 2023; Salt Typhoon in late 2024, after breaches at AT&T, Verizon and others.
How we know
Joint advisories by US, UK, Canadian, Australian and New Zealand agencies, company disclosures and FBI statements; the underlying intelligence is largely classified.
What to watch
Whether the intruders have been fully removed, and how far US offensive hacking mirrors China's; Beijing cites alleged NSA attacks on Chinese institutions.