Salt Typhon Chinese Group Exploiting 50.000 CISCO IOS XE Network Worldwide

Chinese state-sponsored hacking group known as Salt Typhoon (also tracked as RedMike, FamousSparrow, Ghost Emperor, Earth Estries, and UNC2286) continues its relentless campaign, successfully breaching multiple global telecom providers, including those in the United States. According to a recent report by Recorded Future's Insikt Group, these sophisticated cyber actors are actively exploiting critical vulnerabilities in Cisco IOS XE network devices, underscoring the persistent threats facing critical infrastructure.

Zero-Day Exploits: The Gateway to Telecom Breaches

Insikt Group's threat intelligence division has uncovered that Salt Typhoon is leveraging two key security flaws:

• CVE-2023-20198: A privilege escalation vulnerability allowing attackers to gain elevated access.
• CVE-2023-20273: A Web UI command injection vulnerability enabling remote command execution.

These vulnerabilities, affecting unpatched Cisco IOS XE devices, have served as the primary attack vectors, granting Salt Typhoon access to the networks of numerous telecommunications organizations.

Global Telecoms in the Crosshairs

The impact of these ongoing attacks is widespread, with confirmed breaches at:

• A U.S. Internet Service Provider (ISP)
• A U.S.-based affiliate of a UK telecommunications provider
• A South African telecom provider
• An Italian ISP
• A major Thailand telecommunications provider

These incidents highlight the global reach and indiscriminate nature of Salt Typhoon's operations, posing significant risks to the confidentiality, integrity, and availability of critical communication infrastructure.

Deep Dive: Technical Tactics and Persistent Access

Researchers have observed compromised Cisco devices within victim networks communicating with Salt Typhoon-controlled command and control (C2) servers. The attackers are establishing Generic Routing Encapsulation (GRE) tunnels to maintain persistent access, a technique that allows them to bypass traditional security measures and ensure long-term presence within compromised networks.

Between December 2024 and January 2025, Salt Typhoon's focus was evident in the targeting of over 1,000 Cisco network devices. Notably, more than half of these targeted devices were located in the United States, South America, and India, indicating a strategic focus on specific geographic regions.

Insikt Group's analysis of internet scanning data revealed a concerning landscape: over 12,000 Cisco network devices with exposed web UIs. While Salt Typhoon targeted a significant number, researchers believe the activity was highly focused, representing approximately 8% of exposed devices and strategically selecting targets linked to telecommunications providers.

Echoes of Past Exploits and Urgent Call to Action

These vulnerabilities are not new. Two years prior, these same flaws were exploited in zero-day attacks, compromising over 50,000 Cisco IOS XE devices. These past incidents allowed attackers to deploy backdoor malware through rogue privileged accounts, emphasizing the critical need for proactive security measures. A Five Eyes nations advisory from November 2023 even flagged these vulnerabilities among the top four most frequently exploited in the previous year.

In light of these persistent threats, Insikt Group strongly advises network administrators operating internet-exposed Cisco IOS XE network devices to:

• Immediately apply available security patches. Patching remains the most critical step in mitigating these vulnerabilities.
• Avoid exposing administration interfaces and non-essential services directly to the internet. Minimize the attack surface by limiting external access to critical device management interfaces.

Cisco has also reiterated the importance of patching and security best practices. A Cisco spokesperson stated, "We strongly advise customers to patch known vulnerabilities that have been disclosed and follow industry best practices for securing management protocols."

Broader Campaign and Implications

These breaches are not isolated incidents but rather part of a larger campaign previously confirmed by the FBI and CISA in October. This broader campaign revealed that Chinese state hackers successfully penetrated multiple U.S. telecom carriers, including major players such as AT&T, Verizon, Lumen, Charter Communications, Consolidated Communications, and Windstream, alongside telecom companies in numerous other countries.

The implications of these breaches are severe. Attackers gained access to the "private communications" of a "limited number" of U.S. government officials and even compromised U.S. law enforcement's wiretapping platform, raising significant national security concerns.

Conclusion

The ongoing Salt Typhoon campaign serves as a stark reminder of the persistent and evolving cyber threats targeting the telecommunications sector. DevOps and security teams must prioritize vulnerability management, implement robust security configurations, and maintain constant vigilance to defend against these sophisticated attacks. Proactive patching, network segmentation, and continuous threat monitoring are essential to safeguarding critical infrastructure and ensuring the security of global communications.