Weathering the storm: In the midst of a Typhoon
Summary: Cisco Talos reported that the Salt Typhoon threat actor gained access to core networking infrastructure at several major U.S. telecommunications companies, persisting in one environment for over three years. Talos found that in all but one investigated incident, initial access came from legitimate stolen login credentials rather than a Cisco vulnerability, with only one case showing likely abuse of CVE-2018-0171.
Key Takeaway: The actor captured SNMP, TACACS, and RADIUS traffic including secret keys, exfiltrated device configurations over TFTP and FTP, and pivoted from one telecom's compromised device into another telecom's network - so a single stolen credential and weak local password encryption can expose authentication material across an entire trusted infrastructure.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2018-0171
- Related
- Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices Cyber Risks ·