Salt Typhoon Targets European Telecom

The Chinese cyberespionage hackers commonly tracked as Salt Typhoon haven’t stopped their campaign against global telecoms, says managed threat detection firm Darktrace.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The first said Monday it spotted threat activity consistent with Salt Typhoon indicators in July hacking an European telecom.

Salt Typhoon – also tracked as Earth Estries, GhostEmperor and UNC2286 – is operated by a clutch of private hacking firms whose clients include multiple Chinese government agencies, according to analysis from earlier this year based on leaked data (see: Chinese Data Leak Reveals Salt Typhoon Contractors).

The group has made telecoms and other digital infrastructure a primary target. The group leapt into public awareness after hacking nine U.S. telecoms in a campaign that became public knowledge in December 2024. An August advisory from the English-speaking nations that make up the Five Eyes intelligence alliance and a clutch of allies warned the group is tracking targets”https://www.govinfosecurity.com/”communications and movement around the world.

Recurring targets include Cisco switches, as well as Ivanti network gateways and the operating system underlying Palo Alto Networks devices, the advisory states.

In the case of the European telecom, the threat actor likely began its hack by exploiting the Citrix NetScaler Gateway, Darktrace wrote. From there, hackers pivoted to Citrix Virtual Delivery Agent hosts in the client’s Machine Creation Services subnet – MCS being a Citrix component for delivering virtual desktops.

Another hallmark of Salt Typhoon is its preference for living off the land techniques that deploy native tools for hacking ends. In this case, hackers uploaded antivirus executable files, indicating “the attacker relied on DLL side-loading via legitimate antivirus software to execute their payloads.”

A backdoor inserted by hackers into the telecom infrastructure used virtual private servers for command and control that communicated over HTTP and, what Darktrace calls, an unidentified TCP-based control. “This dual-channel setup is consistent with Salt Typhoon’s known use of non-standard and layered protocols to evade detection.”

Darktrace didn’t elaborate on the vulnerability that hackers used to break into the Citrix NetScaler Gateway. The company in July published patches for two flaws exploited by hackers tracked as CVE-2025-5777 and CVE-2025-6543. The flaws affected NetScaler ADC and NetScaler Gateway, which when exploited allowed hackers to bypass multifactor authentication, hijack user sessions and gain unauthorized access (see: Attackers Actively Exploit ‘Citrix Bleed 2’ Vulnerability).