Chinese salt typhoon hackers continue to violate telecom companies despite US sanctions
Security researchers say Salt Typhoon, a hacking group linked to the Chinese government, continues to compromise telecommunications providers. Recent sanctions imposed by the US government In a group.
In a report shared with TechCrunch, Threat Intelligence Firm said Future had observed it. Salted typhoon – The company tracks it as “Redmike” – Violating five telecommunications companies between December 2024 and January 2025.
Salt Timone was released last September after it was revealed that the group could infiltrate several US phone and internet giants, including AT&T and Verizon, and access private communications from senior US government officials and politicians. I made a headline.
Salt typhoons too Hacked by the system Law enforcement agencies may use it for court-authorized collections of customer data to access sensitive data, such as the identity of Chinese targets in US surveillance.
The recorded future refused to name the latest victims of the salt typhoon, but said it includes a US-based affiliate of a prominent UK telecommunications provider. US internet service providers and telecommunications companies in Italy, South Africa and Thailand.
Hackers carried out reconnaissance (the practice of secretly discovering and collecting information about systems) on multiple infrastructure assets run by Mytel, a Myanmar-based telecommunications provider.
To carry out these attacks, Salt Typhoon leverages two vulnerabilities (tracked as CVE-20232-0198 and CVE-2023-20273) to enable Cisco devices running Cisco iOS XE software. It was infringed. The hacking group has attempted to compromise on more than 1,000 Cisco devices globally, focusing on devices related to the network of communication providers.
Recorded Future also observed salt typhoon targeting devices related to universities, including the University of California and Utatech. The researchers said the hacking group “probably targeted these universities to access research in areas related to telecommunications, engineering and technology.”
The US government has authorized businesses associated with the group. January, US Treasury Department – That itself was targeted by Chinese government hackers. Recently – Sichuan Juxinhe said it has approved a China-based cybersecurity company known as Network Technology.
Recorded Future researchers hope that despite this behavior, Salt Typhoon will continue to target telecommunications providers in the US and elsewhere.