Washington, D.C. – In a series of alarming cyber intrusions, the Chinese state-sponsored hacking group Salt Typhoon has successfully breached multiple U.S. telecommunications providers by exploiting unpatched vulnerabilities in Cisco routers. These sophisticated attacks have granted the hackers extensive access to sensitive communications data, underscoring significant vulnerabilities within critical infrastructure.
Salt Typhoon, also known as RedMike, has been actively targeting unpatched Cisco IOS XE network devices. The group has leveraged specific vulnerabilities—CVE-2023-20198, a privilege escalation flaw, and CVE-2023-20273, a Web UI command injection vulnerability—to infiltrate and control network infrastructures. These exploits have enabled persistent access to critical systems, facilitating extensive data exfiltration. Between December 2024 and January 2025, Salt Typhoon compromised at least five telecommunications networks, including two based in the United States. The group’s reach extends beyond U.S. borders, affecting providers in South Africa, Thailand, Italy, and Vietnam, as well as several universities within the U.S. This widespread activity highlights the group’s relentless pursuit of sensitive information across various sectors and regions.
Despite previous exposure and sanctions imposed by U.S. authorities, Salt Typhoon’s operations have not diminished. The group’s ability to adapt and continue its espionage activities poses a significant challenge to cybersecurity defenses worldwide. Their tactics include modifying existing exploits and employing advanced evasion techniques to maintain undetected access to compromised networks. The breaches orchestrated by the Salt Typhoon have severe implications for national security. By infiltrating telecommunications networks, the hackers have the potential to access sensitive communications, including those of government officials and agencies. This level of intrusion compromises confidential information and threatens the integrity of critical infrastructure essential for national defense and public safety.
Responding to these breaches, cybersecurity experts and federal agencies have issued urgent advisories to telecommunications providers, emphasizing the necessity of promptly applying security patches to vulnerable Cisco devices. Regular system audits and robust monitoring tools are recommended to detect and prevent unauthorized access. Additionally, adopting end-to-end encryption for communications can mitigate the risk of data interception by malicious actors.
Cisco Systems has acknowledged the vulnerabilities in its IOS XE software and released updates to address these security flaws. The company strongly advises all users to apply the latest patches and configure devices following best security practices. Cisco emphasizes that maintaining up-to-date systems is crucial in defending against the evolving tactics of sophisticated threat actors like Salt Typhoon. Salt Typhoon’s activities indicate a broader trend of state-sponsored cyber espionage aimed at critical infrastructure. These incidents underscore the pressing need for international collaboration in cybersecurity efforts, developing resilient systems, and establishing comprehensive incident response strategies to counteract such pervasive threats.
These days, more than ever, our essential communication networks are vulnerable. Organizations have a huge responsibility to keep these networks secure and up-to-date, and the recent breaches by Salt Typhoon are a stark reminder of this. Such sophisticated and persistent threats are out there, and the organizations that handle our essential communication networks must do everything they can to prevent them from being successful. To keep these networks safe, organizations must remain vigilant, proactively address security weaknesses, and foster a culture of continuous improvement in cybersecurity practices.
