Who is Salt Typhoon Really? Unraveling the Attribution Challenge

How overlapping APT groups and Chinese companies complicate attribution in state cyber operations

Note added May 27, 2026

On May 2, 2026, The Cyber Defense Review published an article, “China’s Cyber Explosives Are in Place. Where’s Our Response?,” written by Rob Joyce, former Acting Homeland Security Adviser on the U.S. National Security Council and retired NSA cybersecurity director. In the article, Joyce argues that China’s cyber campaigns—such as Volt Typhoon and Salt Typhoon—“are not routine espionage, but deliberate preparations for conflict. These operations reflect a coordinated effort to pre-position access across vital systems, enabling the potential disruption of military logistics and civilian infrastructure in the early stages of a crisis.” Joyce’s argument—that Salt Typhoon’s activities were intended to pre-position for conflict—is new to the Natto Team.

As the Natto Team’s previous analysis indicated, Volt Typhoon was known for cyber campaigns focused on developing capabilities and preparing and pre-positioning for possible disruptive and destructive attacks. By contr…