Communications infrastructure security: Threats and defenses

Communications infrastructure is the network of wireline, wireless, satellite, broadcast, and internet systems that nearly every other U.S. critical infrastructure sector depends on to operate. Since at least 2021, the China-linked threat group Salt Typhoon has breached telecommunications providers and other organizations in more than 80 countries, and in February 2026 the FBI described the threat as “still very, very much ongoing.”

The Communications Sector is one of the four foundational sectors. It spans multiple domains, including mobile broadband, cloud computing, broadcasting, and the networks that carry internet and other information systems. These systems are partially illustrated here: 

Communications Sector interdependencies

The Communications Sector has extensive interconnections with virtually all other critical infrastructure. The table below shows how communications infrastructure supports, and depends on, the other three foundational sectors::

These interdependencies create a complex risk landscape, where a disruption in the Communications Sector can cascade across multiple other sectors. CISA also identifies close links between communications and the Information Technology, Financial Services and Emergency Services sectors, which rely on communications networks for transactions, public alerts and 9-1-1 calls.

How U.S. policy defines the Communications Sector

The Communications Sector is nearly unrecognizable to those who first defined it 30 years ago. The 1996 Executive Order 13010 (EO 13010) identified telecommunications as one of eight sectors vital to the defense and economic security of the United States. EO 13010 recognized both physical threats and cyberthreats and provided the first formal definition of critical infrastructure. At the time, the telecommunications sector focused on traditional telephone systems and networks.

The 1998 Presidential Decision Directive 63 (PDD-63) expanded the scope of cyberthreats, increased the number of critical infrastructure sectors, and assigned federal agencies to lead government efforts in each sector. PDD-63 also updated the terminology, creating a Communications Sector that included emerging technologies and new information systems.

Two later directives brought the framework up to date. Presidential Policy Directive 21 (PPD-21), issued in 2013, identified communications as critical because it provides an "enabling function" across all critical infrastructure sectors.

In April 2024, National Security Memorandum 22 (NSM-22) superseded PPD-21. NSM-22 kept the 16 critical infrastructure sectors, named CISA as the national coordinator for critical infrastructure security, and replaced sector-specific plans with sector risk management plans. A March 2025 executive order directed a review of federal critical infrastructure policy, including NSM-22, so further changes are possible.

Who owns and secures communications infrastructure

Ownership of the assets in the communications sector involves a mix of private companies, public entities, and hybrid structures, with hundreds of companies operating within several industries.  

The private sector owns most U.S. communications assets, and because owners and operators are responsible for securing their own assets, the private sector is responsible for securing most of the communications infrastructure in the United States.

Private sector owners

Public corporations: Verizon Communications Inc. owns and manages an extensive network of cellular towers, fiber-optic cables, and other critical communications assets.

Private companies: Diamond Communications owns and manages over 4,000 tenanted wireless communication sites, distributed antenna properties, and other assets.

Public sector owners

The U.S. Department of Defense (DoD) owns and operates multiple communications systems, including the Defense Information Systems Network (DISN), the Joint Worldwide Intelligence Communication System (JWICS), and the Defense Communications and Army Transmission Systems (DCATS). The DoD is one of the largest public sector owners of critical infrastructure in the United States.

Hybrid and public-private partnerships

The Maine Connectivity Authority is an example of a hybrid structure in the Communications Sector. The state-created authority exists to expand broadband service to rural areas and other underserved communities in Maine, and it partners with multiple private companies to deliver that service.

The Eastern Shore of Virginia Broadband Authority is a public-private partnership between Accomack and Northampton counties. The authority built a middle-mile broadband backbone through the two rural counties and made it available to local communities and private service providers.

CISA’s role as Sector Risk Management Agency

Every critical infrastructure sector has a Sector Risk Management Agency (SRMA) and a sector plan meant to help owners and operators manage current risks. The U.S. Department of Homeland Security (DHS) is the SRMA for the Communications Sector, and the Cybersecurity and Infrastructure Security Agency (CISA) performs those duties. Under NSM-22, the plan formerly called the Communications Sector-Specific Plan is now the Communications Sector Risk Management Plan. Developing the plan is mandatory for the SRMA, but following its guidance is almost always voluntary for the private sector and other non-federal entities.

GAO findings and CISA’s response

In November 2021, the U.S. Government Accountability Office (GAO) published a 43-page report on CISA's support for the Communications Sector. GAO identified three gaps:

• CISA had not assessed how effective its support for the Communications Sector was, and it had no metrics or feedback mechanisms in place.
• CISA had not completed a capability assessment for its role as federal coordinator for communications incident response and recovery, known as Emergency Support Function #2 (ESF #2).
• CISA had not updated the 2015 Communications Sector-Specific Plan to reflect new and emerging threats, such as risks to the communications technology supply chain and disruptions to position, navigation and timing (PNT) services. DHS guidance recommends updating these plans every four years.

CISA has since addressed all three, and GAO now lists every recommendation as Closed – Implemented. CISA finalized an updated ESF #2 concept of operations in May 2025.

In August and September 2025, CISA and industry stakeholders completed a revised plan, now called the Communications Sector Risk Management Plan, which GAO found addresses new and emerging threats.

In August 2026, CISA documented the surveys and performance metrics it uses to measure the effectiveness of its Communications Sector support.

Common challenges across the sector

Other Communications Sector challenges mirror those in many industries: mission-critical legacy systems that are outdated and unsupported, supply chain vulnerabilities under third-party control, and infrastructure fragmentation that creates inconsistent security practices between providers. Salt Typhoon showed how attackers exploit exactly these weaknesses.

Salt Typhoon attacks on telecommunications providers

Salt Typhoon is a threat actor affiliated with the People's Republic of China (PRC) that has compromised telecommunications providers in the United States and around the world. The U.S. Treasury says Salt Typhoon has been active since at least 2019, and a 2025 joint cybersecurity advisory traces the current global campaign to at least 2021.

In November 2024, the FBI and CISA confirmed that PRC-affiliated actors had stolen customer call records, compromised the private communications of a limited number of people mostly involved in government or political activity, and copied information subject to U.S. law enforcement requests made under court orders. By December 2024, officials had confirmed that at least nine U.S. communications providers were compromised.

The scale has grown since then. In August 2025, the FBI said Salt Typhoon had affected about 200 U.S. organizations, with victims in more than 80 countries. The same month, agencies from 13 countries, including the NSA, CISA and FBI, published joint advisory AA25-239A, which describes Salt Typhoon targeting telecommunications, government, transportation, lodging and military networks worldwide.

Salt Typhoon timeline

• November 13, 2024: The FBI and CISA issue a joint statement on PRC targeting of commercial telecommunications infrastructure.
• December 18, 2024: CISA publishes mobile communications best practices for highly targeted individuals.
• January 16, 2025: The Federal Communications Commission (FCC) issues a declaratory ruling under the Communications Assistance for Law Enforcement Act (CALEA) requiring carriers to secure their networks.
• January 17, 2025: The Treasury Department sanctions Sichuan Juxinhe Network Technology for direct involvement in the Salt Typhoon intrusions.
• August 27, 2025: U.S. and international agencies publish joint advisory AA25-239A.
• November 20, 2025: The FCC rescinds the January 2025 ruling.
• February 19, 2026: An FBI cyber intelligence official says the Salt Typhoon threat is "still very, very much ongoing."
• September 24, 2026: Senators introduce the Telecommunications Cybersecurity and Resilience Act.

Salt Typhoon tactics and exploited vulnerabilities

Joint advisory AA25-239A notes that Salt Typhoon activity partially overlaps with groups tracked by industry as OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor. Salt Typhoon focuses on large backbone routers at major telecommunications providers, along with provider edge and customer edge routers, and uses compromised devices to pivot into other networks. Salt Typhoon also targets lawful intercept systems, the equipment carriers use to fulfill court-ordered surveillance requests.

Salt Typhoon does not rely on unknown flaws. According to the advisory, "exploitation of zero-day vulnerabilities has not been observed to date." Salt Typhoon succeeds by exploiting publicly known vulnerabilities and other avoidable weaknesses in network edge devices. The advisory prioritizes these CVEs:

• CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure, commonly chained with CVE-2023-46805 (authentication bypass)
• CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect
• CVE-2023-20198 and CVE-2023-20273 in Cisco IOS XE, commonly chained to gain root access
• CVE-2018-0171 in the Cisco IOS and IOS XE Smart Install feature

Once inside, Salt Typhoon modifies router configurations, creates local accounts, runs management services on non-standard ports, and moves data out through GRE and IPsec tunnels. Salt Typhoon has also used custom malware such as GhostSpider to maintain persistent access.

The FBI has said phishing and vulnerable legacy systems remain the most common ways attackers gain access, and that zero-days were "not what we saw in Salt Typhoon." Communications infrastructure operators should assume that even the most sophisticated threat groups will use these proven methods.

Other nation-state threats to communications infrastructure

Two other PRC-affiliated groups have been linked to attacks on the Communications Sector. Volt Typhoon and APT41 have infiltrated seemingly secure systems, often through unpatched or previously unknown vulnerabilities.

Russian threat actors also target communications infrastructure. Sandworm (GRU Unit 74455) has concentrated on telecommunications and internet providers in Ukraine, while APT29 (also known as Cozy Bear and Midnight Blizzard) conducts attacks against infrastructure companies in many Western nations.

Several groups affiliated with the Democratic People's Republic of Korea (DPRK, or North Korea) have been implicated in attacks on U.S. communications. DPRK groups such as Andariel (APT45), Kimsuky (APT43) and the Lazarus Group have infiltrated U.S. critical infrastructure to support the North Korean regime. Mandiant researchers have published an illustration of the relationships between DPRK threat actors and the Kim Jong Un regime:

Nation-state groups targeting communications infrastructure are motivated by espionage, strategic positioning, and financial gain.

The full cost of these attacks is hard to calculate, but it includes financial losses, exposure of sensitive data and operational disruptions that extend costs well beyond incident recovery. As the FBI has noted, stolen data can also be retained indefinitely and combined with other intelligence.

The U.S. policy response since Salt Typhoon

Federal policy on telecommunications cybersecurity has shifted several times since Salt Typhoon became public. In January 2025, the FCC ruled that CALEA requires carriers to secure their networks and proposed annual certification of cybersecurity risk management plans.

In November 2025, the FCC rescinded that ruling in a 2-1 vote, concluding it had misread its legal authority, and pointed instead to voluntary commitments from carriers to accelerate patching, review access controls, improve threat hunting, disable unnecessary outbound connections and share more information with the federal government.

In September 2026, Senators Mark Warner and Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act. The bill would have a working group within the National Telecommunications and Information Administration (NTIA) develop telecom-specific security practices within 18 months, with a voluntary process for independently assessing whether companies adopt them.

Guidance for communications infrastructure operators

Communications infrastructure operators should follow CISA's enhanced visibility and hardening guidance and the mitigations in joint advisory AA25-239A. Key practices include:

• Patch edge devices first. Prioritize the CVEs listed in AA25-239A on routers, firewalls and VPN gateways, and keep network device operating systems on vendor-recommended versions.
• Isolate device management. Place management services such as SSH, HTTPS and SNMP on a dedicated out-of-band management network, and allow access only from approved management stations.
• Turn off what you don't use. Disable unused ports and protocols, Cisco Smart Install, and web management interfaces that aren't required. Replace Telnet, HTTP and SNMPv1/v2 with SSH, HTTPS and SNMPv3.
• Harden authentication. Change all default credentials, require public-key authentication for administrative roles where feasible, and use phishing-resistant multifactor authentication.
• Segment networks to limit lateral movement and isolate critical systems and sensitive data.
• Log and hunt. Forward device logs to a central system and monitor for configuration changes, new local accounts, unexpected GRE or IPsec tunnels, and management services on non-standard ports.
• Train staff. Phishing remains one of the most common ways attackers gain access, so educate staff on how to identify phishing attempts and why security procedures matter.
• Plan for incidents. Maintain an incident response plan, conduct regular security assessments, and engage the FBI and CISA early. The FBI says organizations that engaged early were the most successful at mitigating Salt Typhoon intrusions.
• Manage third-party risk. Assess and monitor the security practices of vendors and suppliers with access to systems and data.

Guidance for the public

The most important responsibility for individuals is to protect their credentials and identity. Use strong, unique passwords and multifactor authentication, preferably a phishing-resistant method rather than codes sent by SMS. Be wary of phishing attempts, suspicious links and unexpected downloads, and be mindful of sharing personal information on social media.

CISA's mobile communications guidance, written in response to Salt Typhoon, also recommends using end-to-end encrypted messaging apps and keeping devices and apps updated. The guidance is aimed at highly targeted individuals in government and politics, but the same practices protect anyone. Using secure Wi-Fi connections and protecting access to personal devices are also critical measures.

Securing communications infrastructure together

Critical infrastructure is a national security issue, and communications infrastructure underpins all of it. Each operator in the Communications Sector must encourage a culture of security awareness and practice good cyber hygiene, and stakeholders should make full use of their partnerships and support systems. Securing communications infrastructure requires a collaborative approach involving government, industry and the public.