FlagThis

The Chinese cyber espionage group Salt Typhoon is actively expanding its espionage campaign by compromising additional telecom networks globally between December 2024 and January 2025. They are using a custom malware called JumbledPath to monitor network traffic. They are gaining access primarily through stolen credentials and exploiting a six-year-old vulnerability in Cisco routers.

The Chinese nation-state-backed threat actor Salt Typhoon has been actively targeting telecommunications providers, compromising at least five companies between December and January of 2025. This campaign demonstrates the persistence of the group, despite sanctions. Exploitation attempts involved vulnerabilities in Cisco devices, highlighting the continued need for robust security measures in the telecommunications sector.