Salt Typhoon Exposed a Visibility Problem: Why Deep Network Observability Matters
Aviz Networks | Threat Intelligence & Network Defense
June 10, 2026
Deep Network Observability
TL;DR
The Salt Typhoon campaign showed that the primary vulnerability was in visibility, not detection. This cyberattack generated data in areas like authentication, lateral movement, admin access, C&C communications, and exfiltration. Aviz Deep Network Observability fills this visibility gap by collecting, optimizing, enriching, and delivering packet-level data to the security toolset organizations already have.
Introduction
A major breach involving the telecommunications network infrastructure was reported by security organizations towards the end of 2024. It involved a prolonged infiltration of critical communications infrastructure conducted by the state-backed threat actor known as Salt Typhoon.
Salt Typhoon relied on exploiting edge infrastructure, password harvesting, command and control communications, laterally moving through administrative sessions, and using the cloud for exfiltrating information. Ransomware was clearly not the intention since there was no financial motivation behind the cyber operation conducted by the attackers.
Salt Typhoon stands out from other state-sponsored operations due to the fact that its actions left a trace behind, yet it remained unnoticed by monitoring teams operating in heavily protected networks for several months. This includes authentication requests, administrative sessions, file transfer, remote execution activities, and exfiltration of information.
This is the lesson learnt from the Salt Typhoon: the difficulty did not lie in discovery but in visibility. This is not an issue unique to the telecoms network only; the same tactics have been used against banks, hospitals, governmental departments, manufacturing firms, and operators of critical infrastructure worldwide. What the Salt Typhoon showed us was just the tip of a larger problem in the industry: that tools can only be as effective as the visibility provided.
What Visibility and Traffic Acquisition Gap Did Salt Typhoon Expose?
Salt Typhoon didn't expose problems with security technologies; it exposed a lack of visibility.
Organizations today are typically equipped with the likes of firewalls, endpoint security, IDS, NDRs, SIEM, and security analytics, which are fully capable of finding out sophisticated attacks. What matters isn't the identification itself, but that those security products have access to the right information about attacks.
Modern attacks move through data centers, hybrid clouds, branch offices, remote edges, and increasingly IT/OT environments. Critical components like network infrastructure, ICS, medical equipment, IoT, and unmanaged devices cannot be equipped with endpoint agents and provide very little security telemetry.
Visibility becomes difficult as organizations spread out and gain coverage of traffic in all of these environments. Security tools are dependent on having access to traffic to detect any attacks. When visibility is inadequate, so are the detections.
Evidence of Salt Typhoon was found throughout all phases of an attack, including credential theft, lateral movement, administrative operations, C2 traffic, and exfiltration. Visibility problems weren't in lacking evidence; it was getting the right information from the sources of an attack.
This is why Deep Network Observability becomes imperative.
The packets are the final authority on what is true. Everything in terms of logging, alerts, detections, investigations, and forensics always goes back to network traffic. By capturing traffic in the distributed environment, optimizing it, and providing context-aware traffic to downstream security solutions, organizations can get significantly better value out of their current security infrastructure investment. The point is not to replace IDS, NDR, SIEM, or security analytics solutions. Instead, it is about ensuring that all these solutions have enough visibility and context for them to be effective.
How Does Aviz Deep Network Observability Create a Packet-Level Evidence Layer?
In order to generate large-scale packet evidence, architecture plays a significant role. Modern businesses produce traffic in hybrid clouds, enterprise data centers, branch office locations, remote edge locations, medical networks, manufacturing operations, and IT/OT systems. To capture and analyze such traffic, merely collecting packets does not suffice.
Aviz Deep Network Observability is built as an intelligent five-stage pipeline:
Aggregate → Optimize → Enrich → Accelerate → Distribute
Traffic is collected from TAPs, SPANs, cloud traffic mirroring, packet brokers, and distributed deployments throughout the environment. The solution then goes on to normalize, filter, de-duplicate, and enrich the traffic via Deep Packet Inspection (DPI), extracting context-aware information from it. Based on open-source white-box switches, commodity x86 hardware, and DPU-acceleration capabilities up to 400G, Aviz turns distributed network traffic into security intelligence. This is less about the packets and more about getting the right traffic with the right context to the right places.
Why Is Aviz Vendor-Agnostic by Design?
The following NDR systems like ExtraHop, Darktrace, and Vector AI, IDS systems like Suricata, as well as security solutions by Palo Alto Networks, Fortinet, Trend Micro, and others can receive traffic that is optimized. At the same time, the enriched metadata will be provided using open formats like JSON and Kafka to the observability and analytics platforms like Splunk, Elastic, Datadog, Dynatrace, New Relic, Kentik, Google Chronicle, Microsoft Sentinel, and many other security data lakes. The existing solutions are being used by organizations. Aviz guarantees that they will receive optimal visibility.
Figure: Security Onion detects Salt Typhoon-inspired attack activity by receiving optimized packet traffic from the Aviz Deep Network Observability Intelligent Stack.
Network traffic that comes from decentralized systems like hybrid clouds, data centers, remote edge sites, branch offices, and IT/OT networks can be collected, optimized, enhanced, and sent via the Aviz Deep Network Observability (DNO) architecture to downstream security products. In this particular case, Security Onion showcases how the optimized packet traffic collected from Aviz DNO helps security solutions identify Salt Typhoon activities, which involve Cobalt Strike beaconing, SMB lateral movements, DCSync activity, Kerberos exploits, WinRM remote execution, and cloud exfiltration techniques.
Conclusion
A critical point that the Salt Typhoon emphasized goes beyond telecom networks. Modern threats exist in hybrid environments, unmanaged infrastructure, encrypted communications, east-west communications flows, and infrastructure that cannot be observed using conventional security telemetry methods. Businesses are still investing heavily in IDS, NDR, SIEM, endpoint protection, and analytic solutions. These are crucial components of a robust security system. However, all of these efforts depend on visibility. Aviz Deep Network Observability solves this problem by collecting traffic from dispersed networks, improving it, and providing relevant telemetry data to the security and observability systems businesses have chosen for their use cases. The problem is not in the absence of evidence. Threats leave traces, and the problem is how to make those traces accessible to the right technologies.
Frequently Asked Questions
What did Salt Typhoon actually expose about how organisations approach network security?
Salt Typhoon left traces across authentication, lateral movement, admin sessions, C2 communications, and exfiltration. The monitoring teams in heavily protected networks did not catch it for months. The problem was not detection capability. The security tools were capable enough. The problem was that those tools did not have access to the right traffic and context from the right places.
Why do modern security tools miss attacks even when organisations have firewalls, NDR, SIEM, and endpoint protection?
Security products can only detect what they can see. Modern attacks move through hybrid clouds, branch offices, remote edges, ICS, medical equipment, IoT, and unmanaged devices that cannot run endpoint agents. When visibility across those areas is incomplete, the detections are incomplete too regardless of how capable the tools themselves are.
How does Aviz Deep Network Observability collect and process traffic across distributed environments?
Aviz runs a five-stage pipeline: Aggregate, Optimize, Enrich, Accelerate, Distribute. Traffic comes in from TAPs, SPANs, cloud traffic mirroring, packet brokers, and distributed deployments. It gets normalised, filtered, deduplicated, and enriched through DPI before going out to downstream security tools with the right context attached.
What security platforms does Aviz Deep Network Observability feed traffic and metadata into?
Optimised traffic goes to NDR systems like ExtraHop, Darktrace, and Vector AI, IDS systems like Suricata, and security tools from Palo Alto Networks, Fortinet, and Trend Micro. Enriched metadata in JSON and Kafka format feeds Splunk, Elastic, Datadog, Microsoft Sentinel, Google Chronicle, Dynatrace, Kentik, and other security data lakes.
What specific Salt Typhoon attack techniques did Security Onion detect using Aviz DNO traffic?
Security Onion identified Cobalt Strike beaconing, SMB lateral movements, DCSync activity, Kerberos exploits, WinRM remote execution, and cloud exfiltration techniques. All of that came from optimised packet traffic collected and delivered by the Aviz Deep Network Observability stack from decentralised environments including hybrid clouds, data centers, remote edge sites, and IT/OT networks.
Why is the Salt Typhoon lesson relevant for industries beyond telecoms like banking, healthcare, and manufacturing?
The same tactics used against telecom infrastructure have been used against banks, hospitals, government departments, manufacturing firms, and critical infrastructure operators worldwide. Salt Typhoon was just the most visible example of a problem that exists across every industry running hybrid environments with unmanaged devices and distributed infrastructure that conventional security telemetry cannot reach.
Why is Aviz designed to work alongside existing security tools rather than replace them?
Organisations have already invested heavily in IDS, NDR, SIEM, endpoint protection, and analytics platforms. The problem is not that those tools are wrong. The problem is that they are not getting the right visibility and context to be fully effective. Aviz feeds them better traffic data from the places they cannot currently see rather than asking organisations to replace what they already have.
Why are packets described as the final authority on what is true in a network security investigation?
Logs, alerts, detections, investigations, and forensics all ultimately trace back to network traffic. Logs can be incomplete or altered. Endpoint agents miss devices they cannot run on. But packets capture what actually crossed the wire. When security tools have access to that packet-level evidence with the right context attached, they can find what happened even in the environments that everything else missed.
Explore how Aviz Deep Network Observability helps security teams turn distributed network traffic into actionable packet-level evidence for stronger threat detection, faster investigations, and better tool effectiveness.
