Salt Typhoon Cyber Attacks Hit 200 Organizations in the United States

Salt Typhoon Expands Global Espionage Campaign Targeting Telecommunications and Critical Sectors

Summary

Salt Typhoon (also known as GhostEmperor, OPERATOR PANDA, RedMike, UNC5807, FamousSparrow) is a Chinese state-sponsored hacking group active since 2019. The group has impacted more than 600 organizations across 80 countries, including 200 in the United States, by exploiting publicly known vulnerabilities to compromise telecommunications providers and critical industries. Primary targets include the United States, Australia, Canada, New Zealand, and the United Kingdom, with a focus on telecommunications, government, transportation, lodging, and military sectors. The group’s activities involve compromising Fortinet and Juniper firewalls, Microsoft Exchange servers, Cisco IOS XE devices, Palo Alto firewalls, Nokia routers, SonicWall appliances, and Sierra Wireless devices.

Attack Details

Salt Typhoon focuses heavily on compromising large backbone routers of telecom providers to secure long-term persistent access. Once inside, the group pivots into connected networks by exploiting trusted connections and modifying router configurations.

Key exploitation methods include:

• Chained Ivanti vulnerabilities – CVE-2024-21887 (command injection) combined with CVE-2023-46805 (authentication bypass).

• Cisco IOS XE vulnerabilities – CVE-2023-20273 (command injection), CVE-2023-20198 (privilege escalation), CVE-2018-0171 (remote code execution).

• Palo Alto PAN-OS vulnerability – CVE-2024-3400 (command injection).

Salt Typhoon relies on VPS infrastructure and compromised routers that are not linked to known botnets, targeting ISPs and network service providers indiscriminately. Once devices are compromised, attackers:

• Deploy GRE tunnels for data exfiltration.

• Modify Access Control Lists (ACLs) to whitelist malicious IPs.

• Open standard and non-standard ports for persistence.

• Run commands inside Linux containers on Cisco devices to stage tools and move laterally.

• Exploit TACACS+ protocols, SNMP, and SSH to traverse networks and collect packet captures (PCAPs) for intelligence gathering.

Recommendations

1. Prioritize Patching – Immediately patch known exploited CVEs: CVE-2024-21887, CVE-2023-46805, CVE-2024-3400, CVE-2023-20273, CVE-2023-20198, and CVE-2018-0171. Replace unsupported devices with vendor-supported versions.

2. Harden Management Protocols – Isolate device management services in out-of-band networks or VRFs. Restrict management-plane access via ACLs and CoPP with default-deny policies. Disable Telnet and enforce SSHv2 only.

3. Strengthen Authentication – Change default credentials, require public-key authentication, disable password logins where possible, enforce RBAC, and enable account lockouts after failed login attempts.

4. Network Segmentation & Zero Trust – Isolate sensitive networks and adopt Zero Trust Network Access (ZTNA) with identity-based enforcement.

5. Centralized Logging & Monitoring – Forward detailed logs to SIEM platforms over encrypted channels (IPsec, TLS, SSH). Enable alerts for configuration changes, privilege escalations, and authentication anomalies.

Indicators of Compromise (IoCs)

• IPv6:

  • 2001[:]41d0[:]700[:]65dc[:]f656[:]929f

  • 2a10[:]1fc0[:]7[:]f19c[:]39b3

• IPv4 (samples):

  • 1[.]222[.]84[.]29

  • 103[.]168[.]91[.]231

  • 104[.]194[.]129[.]137

  • 142[.]171[.]227[.]16

  • 167[.]88[.]175[.]175

  • 172[.]86[.]106[.]234

  • 193[.]239[.]86[.]132

  • 45[.]61[.]133[.]77

  • 63[.]245[.]1[.]34

  • 89[.]117[.]2[.]39

• Hashes:

  • MD5: eba9ae70d1b22de67b0eba160a6762d8

  • SHA256: 8b448f47e36909f3a921b4ff803cf3a61985d8a10f0fe594b405b92ed0fc21f1

MITRE ATT&CK TTPs

• Tactics: Reconnaissance (TA0043), Initial Access (TA0001), Persistence (TA0003), Privilege Escalation (TA0004), Lateral Movement (TA0008), Exfiltration (TA0010), Command and Control (TA0011).

• Techniques:

  • Active Scanning (T1595), Exploit Public-Facing Application (T1190), Trusted Relationship (T1199)

  • Proxy/Multi-hop Proxy (T1090/T1090.003)

  • Command and Scripting Interpreter (T1059), Network Device CLI (T1059.008)

  • Create Account (T1136), SSH Authorized Keys (T1098.004)

  • Exploitation for Privilege Escalation (T1068), Password Cracking (T1110.002)

  • GRE/Protocol Tunneling (T1572), Exfiltration Over Alternative Protocol (T1048)

  • SNMP (MIB Dump) (T1602.001), Network Device Configuration Dump (T1602.002)

References

• CISA Advisory AA25-239A – Salt Typhoon

• FBI Advisory Video – Salt Typhoon Expansion

• Washington Post – FBI Advisory on China Hacking Expansion

• WSJ – Chinese Spies Hit 80 Countries in Salt Typhoon Breach

• Hive Pro – Salt Typhoon’s Covert Campaign