China’s Salt Typhoon Hackers Persist in Telecom Breaches Despite US Sanctions: A Growing Cyber Threat

Security researchers have raised concerns about the continued activities of the Chinese government-linked hacking group, Salt Typhoon. This group has been implicated in compromising telecommunications providers even after the recent sanctions imposed by the U.S. government. The findings, detailed in a report from the threat intelligence firm Recorded Future, highlight the persistent threat posed by Salt Typhoon to critical infrastructure.

Ongoing Threats from Salt Typhoon

According to Recorded Future, between December 2024 and January 2025, Salt Typhoon—also tracked as RedMike—managed to breach five telecommunications firms. This activity follows previous reports of the group’s infiltration into major U.S. phone and internet providers, including AT&T and Verizon, which allowed them access to sensitive communications of U.S. government officials and political figures.

Infiltration of Law Enforcement Systems

Salt Typhoon’s attacks have extended to systems used by law enforcement agencies for court-authorized data collection, potentially compromising sensitive information on individuals under U.S. surveillance.

Recent Victims of Salt Typhoon

Although Recorded Future has not disclosed the names of the latest victims, the report indicates that they include:

• A U.S.-based affiliate of a major U.K. telecommunications provider
• A U.S. internet service provider
• Telecommunications companies in Italy, South Africa, and Thailand

Targeting Infrastructure in Myanmar

Furthermore, Salt Typhoon has conducted reconnaissance on infrastructure assets owned by Mytel, a telecommunications provider in Myanmar. This indicates a broader strategy of gathering intelligence on various networks.

Exploitation of Vulnerabilities

To execute these attacks, Salt Typhoon has exploited two vulnerabilities, identified as CVE-2023-0198 and CVE-2023-0273. These vulnerabilities affect unpatched Cisco devices running Cisco IOS XE software. The hacking group has attempted to compromise over 1,000 Cisco devices worldwide, with a focus on those linked to telecommunications networks.

University Targets

In addition, Recorded Future observed that Salt Typhoon has targeted devices associated with universities, including:

• The University of California
• Utah Tech University

Researchers suggest that these attacks may be aimed at accessing research related to telecommunications, engineering, and technology.

U.S. Government Response

In response to these ongoing threats, the U.S. government has sanctioned several companies linked to Salt Typhoon. In January, the U.S. Treasury Department imposed sanctions on Sichuan Juxinhe Network Technology, a cybersecurity firm in China, which is reportedly connected to the hacking group.

Future Expectations

Despite these sanctions, experts at Recorded Future believe that Salt Typhoon will continue to target telecommunications providers both in the U.S. and globally, posing a significant risk to national and international security.