Threat actors behind the notorious 2024 Salt Typhoon attacks are reportedly back to their old tricks after they are believed to have hacked congressional staff email accounts.

The Financial Times reports that emails belonging to staffers on powerful committees, including House intelligence, foreign affairs, and the armed services, as well as systems used by the House China committee, are thought to have been breached in December 2025.

The hackers are also believed to have intercepted calls from senior U.S. officials in the past few years. During the 2024 breaches, the phones of then-President-elect Donald Trump, Vice President-elect JD Vance, and Vice President Kamala Harris were targeted, while employee workstations in the U.S. Department of the Treasury were infiltrated.

These latest intrusions come amid ever-more strained global tensions following President Trump’s capture of Venezuelan President Nicolás Maduro, with China accusing the U.S. of acting like a “world judge.”

Tensions were already high last year as U.S. lawmakers sought to punish China for the earlier Salt Typhoon attacks by placing sanctions on several firms believed to have participated. Plans for similar sanctions on China's Ministry of State Security intelligence service, which is understood to be orchestrating the Salt Typhoon-scale hits, were dropped over fears of hampering progress made during Trump’s meeting with President Xi Jinping last October.

The China-backed Salt Typhoon hacking group has been actively operating since at least 2019, according to tracking by cybersecurity firm Darktrace. The group employs custom malware to exploit significant vulnerabilities and is believed to have exfiltrated sensitive data from more than 80 countries.

Their main target in its 2024 attacks were telecom providers, with the likes of AT&T, Verizon, and Lumen Technologies among its victims.

Following those attacks, the Biden-era Federal Communications Commission (FCC) moved to force carriers to shore up their defenses. But a little over a year later, the move was scrapped, with FCC Chairman Brendan Carr suggesting it “exceeded the agency’s authority.”

In more recent Salt Typhoon news, it emerged that two of the engineers behind firms believed to have participated in the state-sponsored attacks started out as Cisco Networking Academy trainees.

A SentinelLabs report suggested that Qiu Daibing and Yu Yang went on to found companies that developed technologies and services for the Ministry of State Security and China's People's Liberation Army.

Salt Typhoon is one of many Chinese state-sponsored hacking groups, with another, Volt Typhoon, believed to have targeted U.S. energy, transportation, and communications systems in February 2024.