Unpatched Cisco Devices Still Getting Popped by Salt Typhoon

A Chinese cyber espionage group tied to the mass hacking of telecommunications networks continues to hit targets in the U.S. and beyond.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Threat intelligence firm Recorded Future said it’s seen ongoing waves of reconnaissance and hacking focused on exploiting two known vulnerabilities in Cisco devices being used by telecoms and universities. If hackers successfully exploit the devices, they have been adding a privileged user account and using it to configure virtual tunneling on the devices, allowing them to remotely control the equipment.

The cyberattacks tie to a Beijing-backed group, codenamed Salt Typhoon, that U.S. officials said enjoyed “broad and full” access to at least nine American telecoms, as well as telecoms in dozens of other countries. The U.S. Treasury Department last month sanctioned a Chinese government contractor for its involvement in the campaign, traced to a hacking team also tracked as Earth Estries, FamousSparrow, GhostEmperor and UNC2286.

While AT&T and Verizon Communications in late December said they ejected the hackers from their networks, officials said they still have a foothold in some other telecoms’ infrastructure.

In its U.S. attacks, Salt Typhoon appears to have focused on intercepting high-level voice communications – sometimes in real time – involving government officials and political campaign leaders. Officials said the hackers targeted candidates in the 2024 U.S. presidential election and penetrated court-authorized wiretap backdoors, potentially spying on the FBI’s countersurveillance efforts. The hackers reportedly also amassed massive quantities of metadata pertaining to telecoms’ subscribers, much of it focused on individuals around Washington, D.C.

Researchers have found signs the hacking group targets an array of networking equipment with unpatched vulnerabilities, including vulnerabilities in Ivanti, Fortinet, Microsoft and Sophos products (See: Patching Lags for Vulnerabilities Targeted by Salt Typhoon).

Despite public reports spotlighting the group’s attacks and sanctions – in effect, calling out Beijing for its espionage activity – the attackers haven’t gone quiet. Rather, investigators said the hackers appeared to alter their tactics to try and maintain persistence.

A new report from Insikt Group – Recorded Future’s threat research division – says Salt Typhoon, which it tracks as RedMike, has continued to conduct “periodic reconnaissance activity.” The report details six specific days of scanning and exploitation activity, starting Dec. 4, 2024, and continuing through at least Jan. 23. The scans targeted Cisco network devices running IOS XE software that had their web user interface exposed to the internet.

During that timeframe, Insikt Group’s own internet scans identified more than 12,000 Cisco devices that had their web user interfaces so exposed, and it found Chinese attackers appeared to be targeting about 1,000 of them – primarily at telecoms, but also at 13 universities. While all of those devices spanned more than 100 countries, researchers said half of the devices were in the U.S., South America and India, and often connected to telecoms, while 13 of the devices were being used by universities.

University networks tied to attackers’ probes included institutions in the U.S. and Netherlands – including UCLA and the Delft University of Technology – as well as in Argentina, Bangladesh, Indonesia, Mexico, Thailand and Vietnam. While the attackers’ specific motivation isn’t known, based on past attacks tied to such Chinese nation-state groups as APT31, APT40 and APT41, Salt Typhoon may have been attempting to steal research tied to engineering, telecommunications and other types of technology, the researchers said.

As part of the December 2024 and more recent attacks, Salt Typhoon compromised at least seven Cisco network devices tied to telecommunications providers based in the U.S. – including an affiliate of a major British telecom – as well as in South Africa, Italy and Thailand, researchers found. The hacking group has been using generic routing encapsulation tunnels to create point-to-point connections to the equipment, they said. Such functionality is built into Cisco devices.

The GRE tunneling protocol “is commonly used to create virtual private networks, enable interoperability between different network types and transport multicast or non-IP traffic over IP networks,” Insikt Group said. “Threat activity groups use GRE tunnels to maintain persistence by establishing covert communication channels that bypass firewalls and intrusion detection systems. These tunnels also facilitate stealthy data exfiltration by encapsulating stolen data within GRE packets, potentially bypassing network monitoring.”

This Cisco-targeting effort appears to be focused on finding devices that remain unpatched against two vulnerabilities the vendor fixed via October 2023 updates (See: Count of Hacked Cisco IOS XE Devices Unexpectedly Plummets).

The updates fixed a then zero-day flaw in the web management user interface for Cisco IOS XE software, used to run numerous Cisco products, including routers, switches, wireless controllers, access points and more. In October 2023, Cisco assigned CVE-2023-20198 to track the flaw, which it said was being actively exploited by attackers to gain access to devices and create a local user account. The company also patched another vulnerability, designated CVE-2023-20273, being used for the second stage of the attacks to give hackers root-user privileges on devices.

The Salt Typhoon infrastructure appears to be used not only to exploit vulnerable Cisco devices but also as a stepping stone to exploiting further networks. Recorded Future said that in December 2024 it saw the infrastructure being used to target infrastructure operated by Myanmar-based telecommunications provider Mytel, and said attackers may have exploited the company’s corporate email server.

Recorded Future recommends that all organizations using devices that run Cisco IOS XE Software review their logs for signs of compromise, including unknown user accounts, and also ensure they’ve patched all internet-exposed network devices, are watching for unexpected configuration changes as well as the presence of network traffic based on unexpected protocols, potentially including GRE. In addition, “avoid exposing administration interfaces or non-essential services on public-facing appliances directly to the internet, particularly for end-of-life devices,” it said.