Cybersecurity — 2026-04-20
Salt Typhoon assessed to have pivoted to Australia-New Zealand critical infrastructure
Western analysts and Australian government briefings cited this month put
Analysis
Corroborated across three outlets drawing from Western intelligence briefings, with Australian government attribution reported indirectly rather than from ACSC or ASD primary, this marks the first public attribution of MSS tasking against the southern-tier Five Eyes nodes, after an 18-month campaign arc running from US telecoms through European to Pacific targets. The dwell-time-over-destruction pattern is almost certainly an indicator of positioning for a Taiwan-contingency counter-value option rather than active collection; the $10M RFJ bounty raised in April 2025 has not degraded the campaign, pointing to operational elements sitting inside PRC institutional cover rather than freelance infrastructure. The read sharpens or collapses within the next 30 days depending on whether ACSC advisory language shifts from hardening guidance to explicit eviction campaigns, or whether a cross-posted US-UK-AU advisory names specific device classes.
Corroborated across three outlets drawing from Western intelligence briefings, with Australian government attribution reported indirectly rather than from ACSC or ASD primary, this marks the first public attribution of MSS tasking against the southern-tier Five Eyes nodes, after an 18-month campaign arc running from US telecoms through European to Pacific targets. The dwell-time-over-destruction pattern is almost certainly an indicator of positioning for a Taiwan-contingency counter-value option rather than active collection; the $10M RFJ bounty raised in April 2025 has not degraded the campaign, pointing to operational elements sitting inside PRC institutional cover rather than freelance infrastructure. The read sharpens or collapses within the next 30 days depending on whether ACSC advisory language shifts from hardening guidance to explicit eviction campaigns, or whether a cross-posted US-UK-AU advisory names specific device classes.