Loading signal...
Signal
Submitted
Feb 8, 2026, 18:47 UTC
Norwegian intelligence confirms Chinese Salt Typhoon cyber espionage campaign compromised network devices, with Russia and Iran also posing cyber threats in 2026.
On February 6, 2026, Norway's Police Security Service (PST) disclosed that the Chinese state-sponsored Salt Typhoon cyber espionage campaign had compromised telecommunications and critical infrastructure network devices in Norway. The PST's annual threat assessment described Norway's security situation as the most severe since World War II, pressured by multiple foreign intelligence services, with China leading the cyber threat. The campaign reportedly allowed interception of communications during the 2024 U.S. presidential race. While China dominates, Russia remains the principal threat to Norway overall, conducting espionage, influence campaigns, and covert operations. Iran is anticipated to also carry out espionage and destructive operations. The report calls for enhanced cooperation between public authorities and private sectors to better protect critical infrastructure amid increasingly integrated cyber and traditional espionage threats.
Confidence: High
The article explicitly attributes aggressor activities to Chinese, Russian, and Iranian intelligence services conducting hybrid cyber espionage and influence operations targeting Norway. It also discusses Norwegian authorities' defensive measures and threat assessments, supporting dual classification with high confidence.
Source URL
https://therecord.media/norawy-intelligence-discloses-salt-typhoon-attacks
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "f97179ed-b3bc-45de-acf9-bcc6f4a52f7c",
"url": "https://therecord.media/norawy-intelligence-discloses-salt-typhoon-attacks",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Norway",
"source_reliability": "A",
"info_credibility": "2",
"tags": [
"China",
"Salt Typhoon",
"Norway",
"Russia",
"Iran",
"offensive cyber operations",
"Telecommunications",
"Critical infrastructure"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column",
"Node 3: Political Disruptions"
],
"countries": [
"Norway"
],
"where_text": "Cyberspace",
"headline": "Norwegian intelligence discloses country hit by Salt Typhoon campaign",
"description": "On February 6, 2026, Norway's domestic security agency PST confirmed that the Chinese state-sponsored espionage campaign called Salt Typhoon compromised network devices in Norwegian organizations. The Norwegian Police Security Service's annual threat assessment for 2026 stated that Norway is facing its most serious security situation since World War II due to pressure from multiple foreign intelligence services. Salt Typhoon is a Chinese cyber espionage operation targeting telecommunications and critical infrastructure in Norway. The Chinese intelligence services have improved efforts to collect intelligence and map Norwegian digital infrastructure and are exploiting collaborative research projects to bolster military and security capabilities. The campaign allowed attackers to intercept communications linked to senior political figures during the 2024 U.S. presidential race. PST indicated that while China dominates the cyber threat picture, Russia remains the principal overall threat to Norway, conducting espionage, mapping critical infrastructure, pressuring Ukrainian refugees, covert intelligence with civilian vessels, and sabotage risks. Russian intelligence has monitored military targets and allied activities in Norway for many years. PST expects more Russian cyber operations and influence campaigns in 2026 as part of Moscow's broader intelligence efforts. Iranian intelligence is also expected to conduct espionage and influence operations, potentially targeting Western interests via property damage, assassinations, terrorist acts, or destructive cyber operations. The report emphasizes the need for closer cooperation between authorities and the private sector, particularly critical infrastructure operators, due to the blending of cyber operations with traditional espionage and influence campaigns.",
"summary_short": "Norwegian intelligence confirms Chinese Salt Typhoon cyber espionage campaign compromised network devices, with Russia and Iran also posing cyber threats in 2026.",
"summary_extended": "On February 6, 2026, Norway's Police Security Service (PST) disclosed that the Chinese state-sponsored Salt Typhoon cyber espionage campaign had compromised telecommunications and critical infrastructure network devices in Norway. The PST's annual threat assessment described Norway's security situation as the most severe since World War II, pressured by multiple foreign intelligence services, with China leading the cyber threat. The campaign reportedly allowed interception of communications during the 2024 U.S. presidential race. While China dominates, Russia remains the principal threat to Norway overall, conducting espionage, influence campaigns, and covert operations. Iran is anticipated to also carry out espionage and destructive operations. The report calls for enhanced cooperation between public authorities and private sectors to better protect critical infrastructure amid increasingly integrated cyber and traditional espionage threats.",
"actor_primary": "Salt Typhoon",
"target_primary": null,
"location_text": "Norwegian organizations",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly attributes aggressor activities to Chinese, Russian, and Iranian intelligence services conducting hybrid cyber espionage and influence operations targeting Norway. It also discusses Norwegian authorities' defensive measures and threat assessments, supporting dual classification with high confidence.",
"event_time_utc": "2026-02-06T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "unknown",
"created_at": "2026-02-08T18:47:00.017Z",
"updated_at": "2026-11-04T08:36:03.522Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "unknown",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
A
Info credibility
2
Event time
Feb 6, 2026, 00:00 UTC
Event time confidence
unknown
Location
Norwegian organizations
Primary actor
Salt Typhoon
Country
Norway
Countries
Norway
Tags
China, Salt Typhoon, Norway, Russia, Iran, offensive cyber operations, Telecommunications, Critical infrastructure
Nodes
Node 1: Borders, Node 2: 5th Column, Node 3: Political Disruptions
Signal
Submitted
Feb 8, 2026, 18:47 UTC
Norwegian intelligence confirms Chinese Salt Typhoon cyber espionage campaign compromised network devices, with Russia and Iran also posing cyber threats in 2026.
On February 6, 2026, Norway's Police Security Service (PST) disclosed that the Chinese state-sponsored Salt Typhoon cyber espionage campaign had compromised telecommunications and critical infrastructure network devices in Norway. The PST's annual threat assessment described Norway's security situation as the most severe since World War II, pressured by multiple foreign intelligence services, with China leading the cyber threat. The campaign reportedly allowed interception of communications during the 2024 U.S. presidential race. While China dominates, Russia remains the principal threat to Norway overall, conducting espionage, influence campaigns, and covert operations. Iran is anticipated to also carry out espionage and destructive operations. The report calls for enhanced cooperation between public authorities and private sectors to better protect critical infrastructure amid increasingly integrated cyber and traditional espionage threats.
Confidence: High
The article explicitly attributes aggressor activities to Chinese, Russian, and Iranian intelligence services conducting hybrid cyber espionage and influence operations targeting Norway. It also discusses Norwegian authorities' defensive measures and threat assessments, supporting dual classification with high confidence.
Source URL
https://therecord.media/norawy-intelligence-discloses-salt-typhoon-attacks
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "f97179ed-b3bc-45de-acf9-bcc6f4a52f7c",
"url": "https://therecord.media/norawy-intelligence-discloses-salt-typhoon-attacks",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Norway",
"source_reliability": "A",
"info_credibility": "2",
"tags": [
"China",
"Salt Typhoon",
"Norway",
"Russia",
"Iran",
"offensive cyber operations",
"Telecommunications",
"Critical infrastructure"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column",
"Node 3: Political Disruptions"
],
"countries": [
"Norway"
],
"where_text": "Cyberspace",
"headline": "Norwegian intelligence discloses country hit by Salt Typhoon campaign",
"description": "On February 6, 2026, Norway's domestic security agency PST confirmed that the Chinese state-sponsored espionage campaign called Salt Typhoon compromised network devices in Norwegian organizations. The Norwegian Police Security Service's annual threat assessment for 2026 stated that Norway is facing its most serious security situation since World War II due to pressure from multiple foreign intelligence services. Salt Typhoon is a Chinese cyber espionage operation targeting telecommunications and critical infrastructure in Norway. The Chinese intelligence services have improved efforts to collect intelligence and map Norwegian digital infrastructure and are exploiting collaborative research projects to bolster military and security capabilities. The campaign allowed attackers to intercept communications linked to senior political figures during the 2024 U.S. presidential race. PST indicated that while China dominates the cyber threat picture, Russia remains the principal overall threat to Norway, conducting espionage, mapping critical infrastructure, pressuring Ukrainian refugees, covert intelligence with civilian vessels, and sabotage risks. Russian intelligence has monitored military targets and allied activities in Norway for many years. PST expects more Russian cyber operations and influence campaigns in 2026 as part of Moscow's broader intelligence efforts. Iranian intelligence is also expected to conduct espionage and influence operations, potentially targeting Western interests via property damage, assassinations, terrorist acts, or destructive cyber operations. The report emphasizes the need for closer cooperation between authorities and the private sector, particularly critical infrastructure operators, due to the blending of cyber operations with traditional espionage and influence campaigns.",
"summary_short": "Norwegian intelligence confirms Chinese Salt Typhoon cyber espionage campaign compromised network devices, with Russia and Iran also posing cyber threats in 2026.",
"summary_extended": "On February 6, 2026, Norway's Police Security Service (PST) disclosed that the Chinese state-sponsored Salt Typhoon cyber espionage campaign had compromised telecommunications and critical infrastructure network devices in Norway. The PST's annual threat assessment described Norway's security situation as the most severe since World War II, pressured by multiple foreign intelligence services, with China leading the cyber threat. The campaign reportedly allowed interception of communications during the 2024 U.S. presidential race. While China dominates, Russia remains the principal threat to Norway overall, conducting espionage, influence campaigns, and covert operations. Iran is anticipated to also carry out espionage and destructive operations. The report calls for enhanced cooperation between public authorities and private sectors to better protect critical infrastructure amid increasingly integrated cyber and traditional espionage threats.",
"actor_primary": "Salt Typhoon",
"target_primary": null,
"location_text": "Norwegian organizations",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly attributes aggressor activities to Chinese, Russian, and Iranian intelligence services conducting hybrid cyber espionage and influence operations targeting Norway. It also discusses Norwegian authorities' defensive measures and threat assessments, supporting dual classification with high confidence.",
"event_time_utc": "2026-02-06T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "unknown",
"created_at": "2026-02-08T18:47:00.017Z",
"updated_at": "2026-11-04T08:36:03.522Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "unknown",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
A
Info credibility
2
Event time
Feb 6, 2026, 00:00 UTC
Event time confidence
unknown
Location
Norwegian organizations
Primary actor
Salt Typhoon
Country
Norway
Countries
Norway
Tags
China, Salt Typhoon, Norway, Russia, Iran, offensive cyber operations, Telecommunications, Critical infrastructure
Nodes
Node 1: Borders, Node 2: 5th Column, Node 3: Political Disruptions