30APR

Norway joins the Salt Typhoon victim list

3 min read

08:16UTC

Norway's Police Security Service (PST) confirmed on 23 April that Norway is a Salt Typhoon victim, taking the public country count past nine.

← Back to FIRESTARTER puts Cisco below the patch line Jump to analysis ↓

TechnologyDeveloping

Key takeaway

PST's Salt Typhoon disclosure signals a Nordic-led wave of public attribution to come.

Norway's Police Security Service, PST, publicly confirmed Norway as a victim of the Salt Typhoon telecoms compromise on the day of the sixteen-agency advisory, taking the public country count past nine⁠¹. PST timed the disclosure to the publication of the sixteen-agency joint advisory, using the document as the occasion to surface domestic caseload that had previously sat behind a classification boundary.

Salt Typhoon is the China-nexus actor that CISA and the FBI have tracked across 200+ telecoms operators in 80+ countries since the campaign first surfaced. The Norwegian disclosure does not add a different actor or instrument; it adds a jurisdiction inside a NATO-aligned Five Eyes-adjacent partner. PST is the first non-Five Eyes intelligence service to confirm Salt Typhoon victim status this calendar year.

PST's timing carries the operational signal. Norway is signalling that other participating Five Eyes-adjacents, the Netherlands, Germany, Spain, Sweden, Japan among the sixteen signatories, may follow with their own confirmations now that the headline document is in print. For procurement and risk Teams at telecoms operators across the Nordic and German-speaking markets, the read is that public exposure tracking is about to expand. The same coalition coordination that delivered the E-Note seizure is now being applied to attribution publication, with PST as the leading edge.

Deep Analysis

In plain English

Salt Typhoon is the name for a Chinese hacking campaign targeting telecoms companies, the firms that run phone calls and internet connections, across at least nine countries. PST, Norway's domestic security service, confirmed on 23 April that Norwegian telecoms networks were among the victims. Norway carries NATO Arctic communications through its cables and satellite ground stations, so the hackers may have sought transit data from allied military circuits rather than ordinary Norwegian phone calls.

Deep Analysis

Root Causes

Norway occupies a structurally attractive position for Salt Typhoon's telecoms-exploitation campaign: Telenor operates the Svalbard satellite ground station, the primary civilian satellite communications gateway for Arctic-region traffic, and Norwegian telecoms backhaul carries NATO northern-flank military communications under civilian contracts.

Salt Typhoon's primary intelligence value in a Norwegian network is therefore not Norwegian domestic communications but transit data from Arctic surveillance, submarine cable landing points, and allied military voice and data circuits that share civilian telecoms infrastructure.

The underlying structural cause is the absence of a mandatory disclosure framework for telecoms-sector breaches in Norway equivalent to the NIS2-derived obligations in EU member states. PST's confirmation was a voluntary choice; Norwegian law did not require it. That structural gap means Norway's disclosure signals PST's political judgment, not a legal trigger.

What could happen next?

Consequence
PST's disclosure creates political precedent for the other fourteen advisory signatories to confirm or deny domestic Salt Typhoon victim status; Germany, Japan and Spain are the three with confirmed advisory involvement and no public national confirmation yet.
Short term · 0.75
Risk
Telecoms operators across Nordic and Baltic markets face elevated supervisory scrutiny from national cyber and intelligence agencies now that PST has set the public disclosure bar.
Short term · 0.8
Precedent
The PST timing model, national victim confirmation on the same day as a multilateral advisory, may become a standard diplomatic tool for Five Eyes-adjacent agencies to surface caseload without requiring a standalone national announcement.
Medium term · 0.7

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Following the 2017 NCSC-led APT10 advisory, Japan's Cabinet Cyber Security Centre and Australia's ASD both confirmed domestic victim counts within weeks of the co-signed statement, using the multilateral document as political cover for domestically sensitive disclosures.

PST's 23 April Salt Typhoon confirmation reproduces the same sequencing exactly: the sixteen-agency advisory is published, a Five Eyes-adjacent agency files behind it with domestic caseload. The APT10 sequence produced six additional national confirmations within 90 days of the initial co-sign; the same pattern is the base case here.

Counter-parallel: Germany's Federal Office for the Protection of the Constitution (BfV) confirmed Volt Typhoon targeting of German critical infrastructure in early 2025 but declined to specify victim sectors or provide dwell data, citing ongoing proceedings. BfV signed the 23 April advisory; a Salt Typhoon confirmation without sector detail would follow the BfV pattern rather than the PST pattern, leaving the public country count figure without operational texture.

Consensus view: RAND Europe's cyber and technology policy team assesses that PST's Salt Typhoon disclosure follows a now-established Nordic intelligence transparency pattern: Scandinavian agencies use major multilateral publications as political cover to surface caseload that domestic politics would otherwise require to stay classified.

Sweden's SÄPO followed the same timing logic when confirming APT28 targeting of Swedish institutions alongside the 2024 NCSC-led attribution advisory. PST's press office confirmed the disclosure was timed to coincide with the advisory publication rather than driven by a new detection event.

Counter-view: The Norwegian Institute for Defence Studies (IFS) cautions that PST's confirmation of victim status does not imply Norwegian telecoms operators were primary Salt Typhoon targets. Norway's telecoms infrastructure connects Arctic surveillance and NATO's northern flank communications; Salt Typhoon's primary intelligence objective may have been transit data, not Norwegian domestic communications, making Norway a secondary harvest rather than a targeted campaign.

Key tension: Whether PST's disclosure signals that other non-Five Eyes signatories of the sixteen-agency advisory, particularly Germany, Japan and Spain, will follow with their own national victim confirmations, which would raise the public country count substantially beyond nine.

First Reported In

Update #2 · FIRESTARTER puts Cisco below the patch line

NCSC UK· 30 Apr 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.