Archive — US — techcrunch
China’s Salt Typhoon hackers continue to breach telecom firms despite USsanctions
The China-linked hacking group Salt Typhoon continues to breach telecom firms despite U.S. sanctions. Recorded Future reports that the group compromised multiple providers, exploiting Cisco device vulnerabilities. Their activities include accessing sensitive data and targeting universities for research. The U.S. government has sanctioned associated companies, but experts predict ongoing threats from Salt Typhoon.
Key points
- Salt Typhoon, a Chinese hacking group, continues operations despite U.S. sanctions.
- Breached five telecom firms from December 2024 to January 2025.
- Previously infiltrated U.S. telecom giants like AT&T and Verizon.
- Exploited vulnerabilities in Cisco devices (CVE-2023-0198, CVE-2023-20273).
- Targets include telecommunications firms in the U.S., Italy, South Africa, and Thailand.
- Conducted reconnaissance on Myanmar's Mytel telecommunications infrastructure.
- Possibly targeted universities for research data in telecommunications and technology.
- Related to recent sanctions against Sichuan Juxinhe Network Technology.
Why it matters
- This resurgence of hacking activities is linked to ongoing geopolitical tensions between the U.S. and China.
- Represents a trend in increasing cyber warfare tactics, especially targeting critical infrastructure.
- Continues a pattern of China-linked cybersecurity threats heightened since 2020 and the COVID-19 pandemic.
- Reflects a broader IT trend in 2025 where nation-state cyber threats are increasing against telecoms and universities.
Despite U.S. sanctions, Salt Typhoon's relentless pursuit of telecom vulnerabilities demonstrates the significant challenges in combating state-sponsored cyber threats, emphasizing the need for enhanced cybersecurity measures globally.