China-Linked Hacking Group Salt Typhoon Still Targeting US Telecommunications

Despite recent US government sanctions, Salt Typhoon, a Chinese government-linked hacking group, continues to target telecommunications companies. Carly Page, writing in TechCrunch, references a report by Security firm Recorded Future claiming that the group has compromised at least five telecom firms between December 2024 and January 2025.

This follows previous Salt Typhoon breaches involving major US providers like AT&T and Verizon, in which the hackers accessed the private communications of high-profile officials and political figures and the data systems of law enforcement agencies likely to monitor Chinese individuals under US watch.

Their latest victims reportedly include a US affiliate of a British telecom firm, a US internet provider, and telecom companies in Italy, South Africa, and Thailand.

Additionally, according to Recorded Future, Salt Typhoon conducted reconnaissance on multiple infrastructure assets operated by Myanmar-based telecommunications provider Mytel.

Universities like the University of California and Utah Tech have also been targeted. Recorded Future researchers said Salt Typhoon “possibly targeted these universities to access research in areas related to telecommunications, engineering, and technology.” 

To execute these attacks, Salt Typhoon exploited two vulnerabilities in Cisco devices, specifically those running Cisco IOS XE software. More than 1,000 devices have been targeted worldwide, always with telecommunications networks being a primary focus.

The US has placed sanctions on Chinese firms linked to the attackers, including a cybersecurity company known as Sichuan Juxinhe Network Technology. Nevertheless, the group remains active and continues its cyberespionage efforts.

These developments highlight increasing legal risks for telecom companies, including regulatory scrutiny, potential litigation, and cybersecurity liability.