Storm Watch | Cyber Podcast | Chinese Hackers Strike Again: Beyond Trust & Salt Typhoon Breaches Expose Critical U.S. Infrastructure
Summary: Two Chinese state-sponsored incidents hit U.S. infrastructure: the BeyondTrust breach, found in early December 2024, used a compromised Remote Support SaaS API key to reset passwords and reach workstations remotely, touching Treasury's Office of Financial Research and Office of Foreign Assets Control, and involved a command injection flaw scored 9.8 with over 13,500 BeyondTrust instances still exposed online. In the Salt Typhoon campaign, Chinese state actors infiltrated nine major U.S. telecom companies, gaining the ability to geolocate millions of people and potentially record calls, with actual interception limited to fewer than 100 high-profile targets, and lapses including one administrator account with access to over 100,000 routers and management passwords like "1111".
What's compelling: One administrator account reaching more than 100,000 routers and management passwords of "1111" at major carriers including AT&T, Verizon and Lumen is the margin by which a foreign state got geolocation reach over millions of people.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026