Loading story…
Researchers reported that internet-facing devices tied to Salt Typhoon, a Chinese state-sponsored threat actor linked to intrusions in telecommunications and government environments, remain widely exposed even after a modest overall decline in attack surface. Tracking six months of exposure data for Sophos Firewall, Cisco IOS XE Web UI, Ivanti Connect Secure, and Fortinet FortiClient EMS showed a combined 25% reduction, driven largely by a sharp drop in Sophos Firewall exposure, while Ivanti and Fortinet changed little and a substantial number of systems remained reachable from the internet.
The reporting also found that Cisco IOS XE was the only monitored platform to post a net increase in exposure, underscoring continued risk around internet-facing edge infrastructure that can provide direct access into internal networks. Analysts cautioned that attribution remains difficult and confirmed Salt Typhoon indicators are limited, but said the affected technologies should remain high-priority because the group has been associated not only with vulnerability exploitation but also with the use of stolen credentials in some Cisco-related incidents; most observed exposures were concentrated in the United States, while Sophos Firewall exposure was concentrated in Germany.
Map this exposure pattern across your cloud, code, and identities.
7 events from the most recent confirmed update back to the earliest known activity.
As of April 22, 2025, Censys observed Germany leading exposed Sophos Firewall instances with 38,787, versus 16,589 in the United States, while the United States had 7,778 exposed Cisco IOS XE Web UIs.
By April 2025, Censys found combined exposure across the tracked platforms had fallen 25% since October 2024, driven mainly by a drop of more than 70,000 exposed Sophos Firewall interfaces. Cisco IOS XE was the only tracked platform to increase, while Ivanti Connect Secure and FortiClient EMS declined slightly.
Talos observed that in most incidents involving Cisco devices, attackers gained access through stolen credentials rather than vulnerability exploitation, indicating patched internet-facing devices could still remain at risk.
Censys began a six-month analysis window tracking internet exposure of Sophos Firewall, Cisco IOS XE Web UI, Ivanti Connect Secure, and Fortinet FortiClient EMS systems associated in public reporting with Salt Typhoon targeting.
Ivanti Connect Secure and Policy Secure vulnerabilities CVE-2023-46805 and CVE-2024-21887 were identified as enabling authentication bypass and elevated command execution, respectively.
Cisco IOS XE vulnerabilities CVE-2023-20198 and CVE-2023-20273 were publicly identified as flaws that can be chained to gain full control of vulnerable devices via the Web UI.
Recorded Future reported that RedMike, identified here with Salt Typhoon, attempted to exploit more than 1,000 internet-facing Cisco network devices worldwide, primarily at telecommunications providers, using CVE-2023-20198 and CVE-2023-20273. After exploitation, the actor changed device configurations and established GRE tunnels for persistence.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Salt Typhoon, a China-linked advanced persistent threat (APT) group, conducted a sophisticated cyber espionage campaign targeting a European telecommunications organization. The attackers gained initial access by exploiting a Citrix NetScaler Gateway appliance, then moved laterally to internal Citrix Virtual Delivery Agent hosts. They used DLL sideloading via legitimate antivirus software to deploy the SNAPPYBEE (Deed RAT) backdoor, leveraging LightNode VPS endpoints and non-standard protocols for command-and-control to evade detection. The operation was detected by Darktrace and highlights the group’s focus on intelligence collection and geopolitical influence across critical infrastructure sectors. Security experts emphasize the evolving tactics, techniques, and procedures (TTPs) of Salt Typhoon, including the exploitation of zero-day vulnerabilities and outdated infrastructure. The incident underscores the challenges of defending public-facing appliances and the importance of robust network visibility and proactive threat detection. Organizations in telecommunications and other critical sectors are urged to strengthen their defenses against state-sponsored threats by improving monitoring, patch management, and incident response capabilities.
Jun 29, 2026
Salt Typhoon, a threat group linked to the People’s Republic of China, conducted a multiyear cyber espionage campaign targeting major U.S. telecom providers such as Verizon, AT&T, and T-Mobile, compromising the data of hundreds of millions of users. The campaign is considered by U.S. officials to be the most significant cyber espionage operation in history, with attackers gaining access to sensitive information including call logs, unencrypted texts, and audio from high-ranking political figures, as well as targeting law enforcement intercept backdoors and military networks. The group’s activities have raised concerns about potential election interference, political blackmail, and threats to national security. Salt Typhoon exploited unpatched, end-of-life, and forgotten network perimeter devices—such as routers, VPNs, and firewalls—using sophisticated “living off the land” tactics to establish long-term persistence and evade detection. The attackers stole administrator credentials, network traffic diagrams, and personal information from military and state cybersecurity personnel, using this intelligence to fuel further intrusions. The campaign highlights the urgent need for organizations to address technical debt and proactively secure legacy infrastructure, as reactive patching cannot undo compromises on already breached devices.
Jul 12, 2026
Salt Typhoon, a Chinese state-linked advanced persistent threat (APT) group, attempted to infiltrate a European telecommunications organization by exploiting a vulnerability in a Citrix NetScaler Gateway appliance. The attack was first detected by Darktrace in July 2025, when threat activity consistent with Salt Typhoon’s known tactics, techniques, and procedures (TTPs) was observed. The group, also known as Earth Estries, GhostEmperor, and UNC2286, has a history of targeting telecoms and digital infrastructure globally, with previous campaigns against U.S. telecoms and ongoing interest in European targets. Initial access was achieved through the exploitation of the Citrix NetScaler Gateway, a method frequently used by Salt Typhoon to compromise network equipment. After breaching the gateway, the attackers moved laterally within the organization, targeting Citrix Virtual Delivery Agent hosts in the Machine Creation Services (MCS) subnet. The group deployed the SNAPPYBEE (also known as Deed RAT) backdoor, a tool commonly shared among Chinese APT groups, to establish command and control (C2) within the compromised environment. The C2 infrastructure utilized LightNode VPS endpoints and communicated over both HTTP and an unidentified TCP-based protocol, demonstrating the group’s use of non-standard and layered protocols to evade detection. To maintain stealth and persistence, Salt Typhoon employed DLL sideloading techniques, delivering malicious DLLs alongside legitimate antivirus executables such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This allowed the attackers to execute their payloads under the guise of trusted software, bypassing traditional security controls. The group’s tactics included abusing legitimate software for stealth and execution, a hallmark of their operations. Darktrace analysts noted that the pattern of activity closely matched Salt Typhoon’s previous campaigns, reinforcing attribution to the group. The intrusion was detected before the attackers could achieve deeper compromise or exfiltrate sensitive data, highlighting the importance of proactive threat detection. The incident underscores the persistent threat posed by Chinese cyberespionage actors to the telecommunications sector, particularly through the exploitation of known vulnerabilities in widely used network appliances. The Five Eyes intelligence alliance and other international partners have previously warned about Salt Typhoon’s global targeting of communications infrastructure. The group’s operations are believed to be conducted by private hacking firms contracted by Chinese government agencies, as revealed by earlier data leaks. The attempted breach demonstrates the evolving sophistication of state-sponsored cyber operations and the need for robust security measures in critical infrastructure sectors. The use of advanced lateral movement, stealthy persistence mechanisms, and shared malware tools reflects the group’s technical capabilities. The incident also highlights the value of threat intelligence sharing and rapid response in mitigating nation-state cyber threats. Ongoing monitoring and patching of network equipment vulnerabilities remain essential defenses against such targeted attacks. The European telecom’s timely detection and response prevented further escalation and potential operational impact. This event adds to the growing body of evidence regarding Salt Typhoon’s focus on global telecommunications espionage.
Jun 29, 2026