The Register: More victims of China’s Salt Typhoon crew emerge: Telcos, unis hit via Cisco bugs

Feb 13, 2025

—

Source URL: https://www.theregister.com/2025/02/13/salt_typhoon_pwned_7_more/
Source: The Register
Title: More victims of China’s Salt Typhoon crew emerge: Telcos, unis hit via Cisco bugs

Feedly Summary: Networks in US and beyond compromised by Beijing’s super-snoops pulling off priv-esc attacks
China’s Salt Typhoon spy crew exploited vulnerabilities in Cisco devices to compromise at least seven devices linked to global telecom providers and other orgs, in addition to its previous victim count.…

AI Summary and Description: Yes

Summary: The text outlines a significant cybersecurity breach by China’s Salt Typhoon espionage group, which targeted Cisco devices linked to multiple telecommunications providers and universities globally. The vulnerabilities exploited for these intrusions highlight critical security gaps in infrastructure and emphasize the urgent need for enhanced network security measures.

Detailed Description: The report presents a recent espionage campaign conducted by the Salt Typhoon group that successfully compromised various Cisco devices. Key aspects of the incident include:

– **Vulnerabilities Exploited**: The group exploited the critical vulnerabilities CVE-2023-20198 and CVE-2023-20273, highlighting the need for organizations to stay vigilant about patching their systems promptly.
– CVE-2023-20198: A privilege escalation vulnerability in Cisco IOS XE software’s web user interface.
– CVE-2023-20273: Another privilege escalation flaw that allowed attackers to gain root privileges.

– **Scope of Compromise**: The campaign impacted at least seven devices across various global telecom services, including:
– US internet service and telecommunications providers
– A major UK-based telecom affiliate
– Telecom firms in South Africa and Thailand
– A notable attempt to access research at universities in the US and other countries.

– **Target List Compilation**: The attackers appear to have meticulously selected targets based on their association with telecommunications networks, indicating a strategic approach to their espionage activities.

– **Enhanced Security Needs**: The incident underscores the imperative for enhanced cybersecurity measures within critical infrastructure sectors. Security professionals are urged to tighten network defenses and utilize strong encryption methods to protect sensitive communications.

– **International Response**: Following the breach, sanctions were imposed by the US on a Chinese cyberscurity company linked to Salt Typhoon, pointing to increasing tensions over state-sponsored cyber threats. Collaborative international efforts are deemed essential for effectively mitigating these risks.

– **Recommendations**: The incident serves as a crucial reminder for organizations, particularly in telecommunications, to:
– Regularly update and patch software to close exploited vulnerabilities.
– Implement rigorous access control measures based on the principle of least privilege.
– Foster a culture of cybersecurity awareness that encourages reporting and proactive identification of threats.

In summary, this cybersecurity incident serves as a stark warning for security and compliance professionals regarding the vulnerabilities inherent in critical infrastructure components and the necessity of adopting robust security practices in response to escalating global threats.

01 1 2 3 5 7 a access access control Act Africa AI and Arch art as attack attackers attacks awareness based breach Bug bugs by C China Chinese Chinese cyber CIA Cisco Col collaborative communication communications networks Communications. compilation compliance compliance professionals control core critical critical infrastructure cross culture CVE cyber cyber threat cyber threats cybersecurit Cybersecurity cybersecurity awareness cybersecurity breach cybersecurity incident cybersecurity measures D de defense defenses e effective encryption encryption methods end enhanced security espionage exp exploit exploited vulnerabilities face for full g Gen GIS Go Group gs high Highlight HR http HTTPS in incident infrastructure infrastructure components infrastructure sector inter intern internet iOS ite J k Key l Labor land law least least privilege led Link linked low multi nation network network defense network security networks no o of off on one opt organization organizations out over Patch patching point porting pre Principle of Least Privilege privilege escalation proactive proactive identification professionals prompt Py R rag rate RCE recommendations red report reporting research response Risk risks Ro robust security robust security practices Root Root Privileges RoT s Salt Typhoon Sanctions search sec security security and compliance security awareness security breach security gaps security incident security measure security measures security practices security professionals sensitive communications service services Sig SoC software source sponsored sponsored cyber threats spy SSE state state-sponsored state-sponsored cyber threats system systems T targeted telecom telecommunications telecommunications providers text the threat threats to Tor TP trie two UK universities up update US use user user interface uth V victims vulnerabilities vulnerability web Wi x