Salt Typhoon Expands to 80+ Countries with New TernDoor/PeerTime/BruteEntry Implants; South American Telecoms Now Targeted

China-nexus APT Salt Typhoon has significantly expanded its operational footprint in 2026, introducing three new implant families — TernDoor, PeerTime, and BruteEntry — and extending intrusions beyond the original US/European telecom focus to encompass networks in South America, with confirmed compromises now spanning more than 80 countries across telecom, transportation, and government sectors. The group's telecom-focused intrusion methodology enables passive interception of communications at the infrastructure level, with average dwell times measured in months before detection; Singapore's Cyber Security Agency mounted Operation CYBER GUARDIAN in response to related UNC3886 telecom intrusions, deploying over 100 cyber defenders. Defenders operating in telecom environments should prioritize hunting for the new implant families and audit edge device integrity, as Salt Typhoon's persistent access to carrier infrastructure represents an ongoing signals intelligence collection capability with no confirmed full eviction from compromised networks.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.