Australian cybersecurity authorities have assessed that the state-linked hacking group known as Salt Typhoon has almost certainly gained access to parts of the country’s critical infrastructure, raising fresh concerns about the resilience of essential services.

The assessment reflects growing confidence among security officials that the highly sophisticated group has been operating within Australian networks as part of a broader campaign targeting strategic systems in multiple countries.

Salt Typhoon is believed to specialise in long-term, covert access rather than immediate disruption, focusing on intelligence collection and the ability to move laterally across complex networks.

Officials familiar with the investigation said the group’s methods are consistent with advanced state-backed cyber operations, including the exploitation of trusted service providers and previously unknown vulnerabilities.

While no major outages have been publicly attributed to the activity, the presence of the group inside sensitive systems is viewed as a serious risk.

Australian authorities have been working with industry operators to identify and contain potential intrusions, with a particular focus on telecommunications, energy and transport networks.

The government has emphasised that there is no evidence at this stage of widespread service disruption, but acknowledged that determining the full extent of any compromise is challenging given the stealthy nature of the activity.

The assessment comes amid heightened global concern about cyber operations linked to China, which Beijing routinely rejects, describing such claims as politically motivated and lacking evidence.

Australian officials have maintained that their approach is based on technical analysis and intelligence sharing with partners, and have reiterated the need for vigilance, stronger cyber defences and closer cooperation between government and industry as cyber threats continue to evolve.