Cybersecurity Policy Report, Cyber Firm Finds New Telecom Targeting by Salt Typhoon, (Feb 14, 2025)
A Chinese cyber espionage campaign known as Salt Typhoon has continued targeting telecom networks, most recently by exploiting unpatched devices from Cisco Systems, Inc., according to a report from cybersecurity firm Recorded Future, Inc.
“Between December 2024 and January 2025, Recorded Future’s Insikt Group identified a campaign exploiting unpatched internet-facing Cisco network devices primarily associated with global telecommunications providers,” Recorded Future said in the report published yesterday.
“Victim organizations included a United States-based affiliate of a significant United Kingdom-based telecommunications provider and a South African telecommunications provider,” it said.
“Insikt Group attributes this activity to the Chinese state-sponsored threat activity group tracked by Insikt Group as RedMike, which aligns with the Microsoft-named group Salt Typhoon,” it said.
“RedMike has attempted to exploit more than 1,000 Cisco devices globally. The group likely compiled a list of target devices based on their association with telecommunications providers' networks,” Recorded Future added.
The Salt Typhoon hackers also appear to be broadening their targets to include universities with research programs in telecommunications engineering, Recorded Future said.
“Unpatched public-facing appliances serve as direct entry points into an organization’s infrastructure. Sophisticated Chinese threat activity groups have shifted heavily toward exploiting these devices for initial access over the past five years,” it warned.
“RedMike’s exploitation of telecommunications infrastructure goes beyond technical vulnerabilities and represents a strategic intelligence threat. Persistent access to critical communications networks enables state-backed threat actors to monitor confidential conversations, manipulate data flows, and disrupt services during geopolitical conflicts,” it said.
“Organizations, particularly those in the telecommunications industry, must prioritize remediating exposed network devices, as unpatched systems remain a key initial access vector for Chinese state-sponsored threat activity groups,” it added. “Additionally, governments and cybersecurity entities should improve threat intelligence sharing and impose stricter regulatory compliance for network security.”
News: FederalLegislation InternationalLegislation DataSecurity