At a glance.
- Salt Typhoon exploits unpatched Cisco devices in continued campaign against telecoms.
- Russia's Seashell Blizzard expands its targeting.
- Fortinet patches high-severity flaw.
Salt Typhoon exploits unpatched Cisco devices in continued campaign against telecoms.
Recorded Future's Insikt Group warns that the Chinese state-sponsored threat actor Salt Typhoon (which Insikt Group tracks as "RedMike") continues to target telecommunication companies. Between December 2024 and January 2025, the researchers observed a campaign that exploited unpatched internet-facing Cisco network devices to compromise several organizations, including the US-based affiliate of a UK telecom provider and a South African telecom provider. The attacks exploited CVE-2023-20273, a privilege escalation flaw affecting the web UI feature of Cisco IOS XE Software.
Insikt Group states, "RedMike has attempted to exploit more than 1,000 Cisco devices globally. The group likely compiled a list of target devices based on their association with telecommunications providers' networks. Insikt Group also observed RedMike targeting devices associated with universities in Argentina, Bangladesh, Indonesia, Malaysia, Mexico, the Netherlands, Thailand, the United States (US), and Vietnam. RedMike possibly targeted these universities to access research in areas related to telecommunications, engineering, and technology, particularly at institutions like UCLA and TU Delft. In addition to this activity, in mid-December 2024, RedMike also carried out a reconnaissance of multiple IP addresses owned by a Myanmar-based telecommunications provider, Mytel."