Chinese Telecom Hackers Strike Worldwide

The Chinese hackers responsible for breaking into telecom networks across the globe capitalize on already documented vulnerabilities, principally in Cisco routing equipment, warn a slew of national cybersecurity agencies.

See Also: SANS Report, Zero Trust: What You Need to Know to Secure Your Data and Networks

Chinese nation-state hackers commonly tracked as Salt Typhoon penetrated nine U.S. telecoms in a campaign that became public knowledge in December 2024 (see: Feds Identify Ninth Telecom Victim in Salt Typhoon Hack).

A Wednesday advisory from the English-speaking nations that make up the Five Eyes intelligence alliance as well as a medley of European cyber agencies plus Japan say the hackers target telecoms and other sectors such as the lodging and transport sectors to track targets’ “communications and movement around the world.”

An FBI official told The Washington Post that Salt Typhoon hackers have struck at least 200 American organizations and 80 countries. In addition to Cisco switches, hackers have also targeted Ivanti network gateways and the operating system underlying Palo Alto Networks devices, the advisory states.

The hackers are often private sector contractors working for the Ministry of State Security or People’s Liberation Army. Several such companies have been identified by state authorities or had their information leaked onto the internet. The advisory points to Sichuan Juxinhe Network Technology, Huanyu Tianqiong Information Technology and Schuan Zhixin Ruijie Network Technology as three private sector hacking-for-hire firms (see: US Identifies Hacking Firm Behind Salt Typhoon Telecom Hacks).

Chinese hacker access to zero-days has grown substantially as Beijing instituted a mandatory disclosure law and built up a pipeline for cultivating hackler talent. But Sino hackers didn’t need zero-days to break into telecom networks, the advisory says, repeating an assertion made by Cisco itself.

Rather, they use publicly known vulnerabilities with CVE designations already assigned, including CVE-2018-0171, a flaw in the discontinued Cisco Smart Install feature that dates back to 2018 and had been a recurring vector for hackers. Cybersecurity experts including the U.S. Cybersecurity and Infrastructure Security Agency have repeatedly advised Cisco customers to disable the feature, which enables no-touch installation of new Cisco equipment.

Among the techniques that Salt Typhoon hackers use is modifying access control to add their own IP addresses to the lists. One tell-tale sign of Chinese hackers is access-list-20 on the ACL. They open a variety of ports, channeling well-known services such as secure shell or HTTP onto high number ports in a bid to evade detection from monitoring tools that focus on standard port activity.

They use embedded packet capture tools to capture traffic using authentication protocols such as RADIUS and TACACS+. Any enterprise using an outdated version of simple network management protocol might find Chinese hackers using it to alter the configuration of other devices. Of course, the hackers also outright create new user accounts with elevated privileges.

American telecoms have asserted that they ejected Chinese hackers from their networks, a statement met with some skepticism. As the advisory points out, the hacking activity may appear to originate from a local IP address. Salt Typhoon hackers have also taken pains to disable logging or to clear them of indicators.

The FBI told The Washington Post that Chinese hackers haven’t let up the campaign to break into critical infrastructure. “Just because it was secure six months ago does not mean it is now,” an official said.