{"id":58156,"date":"2025-02-13T22:30:41","date_gmt":"2025-02-13T22:30:41","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/"},"modified":"2025-02-13T22:30:41","modified_gmt":"2025-02-13T22:30:41","slug":"more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/","title":{"rendered":"More victims of China&#8217;s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs"},"content":{"rendered":"<p>China&#8217;s Salt Typhoon spy crew exploited vulnerabilities in Cisco devices to compromise at least seven devices linked to global telecom providers and other orgs, in addition to its previous victim count.<\/p>\n<p>The intrusions happened between December 2024 and January 2025 with the Chinese government snoops attempting to exploit more than 1,000 internet-facing Cisco-made boxes before successfully breaking into at least seven that were unpatched, according to Recorded Future&#8217;s Insikt Group.<\/p>\n<p>Salt Typhoon previously compromised at least <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/01\/06\/charter_consolidated_windstream_salt_typhoon\/\" rel=\"noopener\">nine US telecommunications<\/a> companies and <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/01\/15\/salt_typhoon_us_govt_networks\/\" rel=\"noopener\">government networks<\/a>, giving President Xi&#8217;s agents real-time access to people&#8217;s communications and whereabouts.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>In its latest espionage campaign, the crew infiltrated Cisco-supplied gear associated with a US internet service and telecommunications provider, a US affiliate of a &#8220;significant&#8221; UK-based telecom provider, an Italian ISP, and two other telecommunications firms, one in South Africa and a &#8220;large&#8221; one in Thailand, Insikt&#8217;s report [<a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/go.recordedfuture.com\/hubfs\/reports\/cta-cn-2025-0213.pdf\">PDF<\/a>] states. Again, that would give China intimate access to people&#8217;s internet activities, movements, and comms.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>&#8220;The group likely compiled a list of target devices based on their association with telecommunications providers&#8217; networks,&#8221; according to the write-up.<\/p>\n<p>Additionally, the snoops &#8220;possibly targeted&#8221; more than a dozen universities including University of California, Los Angeles to access research related to telecommunications, engineering, and technology, according to the infosec house, which tracks Salt Typhoon as RedMike.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Plus, in mid-December, Salt Typhoon also conducted a reconnaissance operation involving &#8220;multiple&#8221; IP addresses owned by Mytel, a Myanmar-based telecom firm.<\/p>\n<p>To compromise the targeted Cisco devices, Beijing&#8217;s spies combined two critical privilege escalation vulnerabilities in Cisco&#8217;s tech: CVE-2023-20198 and CVE-2023-20273. The networking giant <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-iosxe-webui-privesc-j22SaA4z\">issued patches<\/a> for both in 2023, and at the time warned the bugs had already been exploited as zero-days.<\/p>\n<p>CVE-2023-20198 is a privilege escalation vulnerability in Cisco IOS XE software&#8217;s web user interface. The snoops exploited this one for initial access, and then issued a <code>privilege 15<\/code> command to create a local user and password.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Then, they used the new local account to exploit another privilege escalation flaw, CVE-2023-20273, to gain root privileges on the device. This allowed Salt Typhoon to add a generic routing encapsulation (GRE) tunnel for persistent access to the victim&#8217;s network.<\/p>\n<p>More than half of the targeted devices, in terms of attempts, were in the US, South America, and India, with the rest spanning over 100 countries. Most of these were linked to telecom providers, while 12 universities were possibly targeted to access research related to technology. Basically, China wanted to pwn the world&#8217;s telecommunications networks.<\/p>\n<p>These colleges included, in the US: University of California, Los Angeles (UCLA); California State University, Office of the Chancellor;&nbsp;Loyola Marymount University; and Utah Tech University. Plus Argentina (Universidad de La Punta) and Bangladesh (Islamic University of Technology IUT).&nbsp;Two were in Indonesia: Universitas Sebelas Maret and Universitas Negeri Malang.<\/p>\n<p>Other attempted targets were in, at least, Malaysia (University of Malaya), Mexico (Universidad Nacional Autonoma), the Netherlands (Technische Universiteit Delft), Thailand (Sripatum University), and Vietnam (University of Medicine and Pharmacy at Ho Chi Minh City).<\/p>\n<p>After it emerged last year that Salt Typhoon had struck Verizon, AT&amp;T, Lumen Technologies, and others, and thus China was in a position to monitor millions of people&#8217;s calls, texts, locations, and internet activities, Uncle Sam urged IT departments to <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.cisa.gov\/resources-tools\/resources\/enhanced-visibility-and-hardening-guidance-communications-infrastructure\">tighten up<\/a> their network security and netizens to start using <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/01\/04\/encryption_backdoor_debate\/\" rel=\"noopener\">strong end-to-end encryption<\/a> for their online chatter.<\/p>\n<p>The kicker in all of this is that, in that previous campaign, Beijing <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.eff.org\/deeplinks\/2024\/10\/salt-typhoon-hack-shows-theres-no-security-backdoor-thats-only-good-guys\">abused<\/a> equipment that provides surveillance backdoors intended for US law enforcement to track suspects in American networks to pull off these intrusions.<\/p>\n<p>In January, the US issued <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/01\/17\/fcc_telcos_calea\/\" rel=\"noopener\">sanctions<\/a> on a Salt Typhoon affiliated cyberscurity company, Sichuan Juxinhe Network Technology, which is based in Sichuan, China.<\/p>\n<p>But while the sanctions &#8220;signal a more assertive and commendable stance against state-backed cyber espionage in critical infrastructure,&#8221; according to the threat hunters, &#8220;robust international cooperation is crucial for effectively countering these persistent threats.&#8221;<\/p>\n<blockquote class=\"pullquote\" readability=\"5\">\n<p>We strongly advise customers to patch known vulnerabilities that have been disclosed<\/p>\n<\/blockquote>\n<p>A spokesperson for Cisco told us today that what it knows for certain is that the flaws highlighted by Insikt were fixed a few years ago, as we noted.<\/p>\n<p>&#8220;We are aware of new reports that claim Salt Typhoon threat actors are exploiting two known vulnerabilities in Cisco devices relating to IOS XE,&#8221; the spinner said.<\/p>\n<p>&#8220;To date, we have not been able to validate these claims but continue to review available data.<\/p>\n<p>&#8220;In 2023, we issued a security advisory disclosing these vulnerabilities along with guidance for customers to urgently apply the available software fix. We strongly advise customers to patch known vulnerabilities that have been disclosed and follow industry best practices for securing management protocols.&#8221; \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2025\/02\/13\/salt_typhoon_pwned_7_more\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Networks in US and beyond compromised by Beijing&#8217;s super-snoops pulling off priv-esc attacks China&#8217;s Salt Typhoon spy crew exploited vulnerabilities in Cisco devices to compromise at least seven devices linked to global telecom providers and other orgs, in addition to its previous victim count.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-58156","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>More victims of China&#039;s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"More victims of China&#039;s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2025-02-13T22:30:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"More victims of China&#8217;s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs\",\"datePublished\":\"2025-02-13T22:30:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/\"},\"wordCount\":801,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_onprem\\\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/\",\"name\":\"More victims of China's Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_onprem\\\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2025-02-13T22:30:41+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_onprem\\\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_onprem\\\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"More victims of China&#8217;s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"More victims of China's Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/","og_locale":"en_US","og_type":"article","og_title":"More victims of China's Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2025-02-13T22:30:41+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"More victims of China&#8217;s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs","datePublished":"2025-02-13T22:30:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/"},"wordCount":801,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/","url":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/","name":"More victims of China's Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2025-02-13T22:30:41+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_onprem\/networks&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Z66kR01FcmKWEatrPIY4ogAAAQ4&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/more-victims-of-chinas-salt-typhoon-crew-emerge-telcos-just-now-hit-via-cisco-bugs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"More victims of China&#8217;s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/58156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=58156"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/58156\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=58156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=58156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=58156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}