Chinese Cybercriminals from Salt Typhoon Infiltrate New Telecom Operators

The group affiliated with Beijing attempted to compromise vulnerable Cisco routers across a thousand devices in a hundred countries, with seven confirmed breaches.

Cybersecurity researchers from Recorded Future’s Insikt division released a report on February 13, 2025, detailing a new campaign by Salt Typhoon against telecom operators. Active since 2019, this cybercriminal group—also known as RedMike—is believed to be affiliated with the Chinese government. It has been linked to the hacking of major U.S. telecom providers Verizon, AT&T, and Lumen Technologies, revealed in late 2024.

According to Insikt, Salt Typhoon attempted to exploit two vulnerabilities in Cisco routers. These flaws, known for two years, allow attackers to gain initial access to a device and subsequently obtain root access, the highest level of control.

Salt Typhoon targeted over 1,000 machines across 100 countries, including 154 in the United States, primarily belonging to telecom operators and, to a lesser extent, universities. Insikt identified seven confirmed breaches, affecting a U.S. subsidiary of a British telecom operator, as well as operators in South Africa, the United States, Italy, and Thailand.