Salt Typhoon Exploits Flaws in Edge Network Devices to Breach 600 Organizations Worldwide
Summary: A joint advisory from 13 countries says the China-linked actor Salt Typhoon has breached at least 600 organizations across 80 countries, including 200 in the U.S., targeting backbone, provider edge, and customer edge routers in telecom, government, transportation, lodging, and military infrastructure. The actor gains initial access by exploiting exposed edge devices from Cisco (CVE-2018-0171, CVE-2023-20198, CVE-2023-20273), Ivanti (CVE-2023-46805, CVE-2024-21887), and Palo Alto Networks (CVE-2024-3400), then modifies router configurations, adds GRE tunnels, alters ACLs, and captures TACACS+ traffic on TCP port 49 to move laterally.
Why it matters: The advisory ties the activity to three Chinese companies that provide cyber products and services to China's intelligence services, and states that data stolen from telecom and ISP intrusions gives Beijing the ability to identify and track targets' communications and movements globally. The agencies also warn that edge devices are targeted regardless of ownership, so a device outside the actor's core targets still serves as a path into one.