China-Linked Salt Typhoon Group Continues To Breach Telecoms
The name “Salt Typhoon” came to the fore last year after a campaign of attacks on the US telecommunications infrastructure. The hacks affected some of the country’s major telecoms. The FBI warned that they did not know how long it would take to completely oust the hackers. Now, security researchers have revealed that Salt Typhoon continues to carry out attacks.
It has been a few weeks since we heard anything about Salt Typhoon. However, it seems that this was not due to a halt in their operations. On the contrary, they seem to have continued to be quite active in their “work,” or at least that is what Recorded Future, a threat intelligence firm, has detected.
Salt Typhoon continues its attacks against telecoms, security researchers reveal
According to the report, Salt Typhoon—tracked by Recorded Future as “RedMike”—breached up to five telecoms between December 2024 and January 2025. The cybersecurity firm has not revealed the names of the companies affected by the attacks. However, they said that a US subsidiary of a UK telecom was on the list. An American ISP and companies of Italian, South African, and Thai origin were also breached.
Interestingly, Salt Typhoon did not leverage Chinese telecom equipment for the attack. The group reportedly exploited vulnerabilities present in unpatched Cisco equipment running Cisco IOS XE. The hackers reportedly attempted to breach more than 1,000 Cisco devices worldwide. So, not even government efforts to replace Huawei and ZTE network equipment in local telecom networks would have prevented the incident.
Investigators say Salt Typhoon also conducted reconnaissance on the infrastructure of Myanmar-based Mytel. In addition, the hackers have reportedly targeted major educational institutions in the US. The list includes the University of California and Utah Tech. Recorded Future believes the group “possibly targeted these universities to access research in areas related to telecommunications, engineering, and technology.”
Sanctions against companies allegedly related to the group have not been effective
US authorities have tracked down a company apparently linked to Salt Typhoon. In January, Sichuan Juxinhe Network Technology received sanctions from the United States. However, it seems that this has not been enough to stop the hacking group’s activities. Sanctions were also imposed on Integrity Technology Group for alleged links to Flax Typhoon, another Chinese group that carried out botnet-based attacks.
Recorded Future expects Salt Typhoon to continue trying to breach US telecoms in the future. So, companies should be prepared for any potential incidents. Last year, the group managed to infiltrate the infrastructure of AT&T and Verizon. The main goal was to try to obtain confidential data from the then-presidential candidates and their work team—something they did not succeed in. They also intercepted data potentially related to Chinese targets from US surveillance.
