China’s Salt Typhoon: Years of Global Infrastructure Hacks

Essential Insights

1. The China-linked group Salt Typhoon has been globally infiltrating backbone and edge routers since at least 2021, targeting sectors like government, telecom, transportation, lodging, and military.
2. They exploit known vulnerabilities in Cisco, Ivanti, and Palo Alto products to gain initial access, then manipulate routing and configurations to maintain persistent, long-term espionage operations.
3. Their activities enable Chinese intelligence to track communications and movement worldwide by stealing data from telecoms and ISPs, with operations often supported by Chinese companies linked to Chinese intelligence.
4. Threat actors deploy sophisticated evasion and lateral movement tactics, including tampering with ACLs, creating tunnels, and disabling logs, requiring organizations to follow strict detection, mitigation, and threat-hunting protocols to evict them.

The Core Issue

The cyberespionage group known as Salt Typhoon, also referred to by names such as GhostEmperor and Operator Panda, has been conducting sophisticated cyber operations for over five years, primarily targeting critical infrastructure and government networks across the US, UK, Australia, Canada, New Zealand, and beyond. These attacks involve exploiting known vulnerabilities in popular enterprise products like Cisco, Ivanti, and Palo Alto Networks to gain initial access, then moving laterally through networks by hijacking routers and modifying configurations. Their strategic activities include intercepting communications, stealing sensitive data, and creating backdoors for persistent access, often by tampering with network devices, establishing covert tunnels, and deleting logs to evade detection. The operations are linked to Chinese-based companies and backed by a complex ecosystem of contractors that help build infrastructure and execute intrusions, raising concerns about national security and espionage. The joint advisory from multiple U.S. and allied agencies reports these incidents, warning organizations of Salt Typhoon’s ongoing threat and emphasizing the need for robust detection and response measures to evict the threat actors from compromised networks.

What’s at Stake?

The China-linked cyberespionage group known as Salt Typhoon (also called GhostEmperor, Operator Panda, RedMike, and UNC5807) has been extensively compromising backbone and edge routers globally, primarily targeting telecommunications, government, transportation, lodging, and military infrastructures since at least 2021. By exploiting known vulnerabilities in Cisco, Ivanti, and Palo Alto Networks products, they gain persistent access to networks worldwide, enabling them to pivot into critical systems, modify routing, mirror traffic, and exfiltrate vast amounts of sensitive data. Their operations facilitate Chinese intelligence efforts by enabling the identification, tracking, and surveillance of international communications and activities. Salt Typhoon’s sophisticated techniques include tampering with network configurations, creating covert tunnels, disabling logs, and manipulating routing protocols, which allow long-term, undetected access. The group’s activities not only threaten global infrastructure stability but also compromise data security, with potential impacts including espionage, disruption of services, and intelligence collection, emphasizing the need for organizations to implement rigorous detection, containment, and evasion mitigation strategies.

Possible Action Plan

Addressing the ongoing threat posed by China’s Salt Typhoon hacking critical infrastructure worldwide underscores the urgent need for swift and effective remediation. Timely intervention not only minimizes immediate damage but also safeguards future stability and security.

Mitigation Strategies

• Strengthen Cyber Defenses: Deploy advanced firewalls, intrusion detection systems, and continuous monitoring to prevent unauthorized access.
• Conduct Vulnerability Assessments: Regularly identify and patch security weaknesses across all critical systems.
• Implement Segmentation: Isolate critical infrastructure networks to limit the spread of cyberattacks.
• Enhance Employee Training: Educate staff on cybersecurity best practices and recognition of spear-phishing attempts.
• Establish Incident Response Plans: Develop and regularly update protocols to swiftly contain and recover from breaches.
• Collaborate Internationally: Share threat intelligence and best practices with global cybersecurity agencies to stay ahead of evolving tactics.
• Monitor Activity: Use real-time analytics to detect unusual or malicious behavior promptly.
• Backup Data: Maintain secure, off-site backups to ensure rapid restoration in case of an attack.
• Enforce Access Controls: Limit system permissions to essential personnel only, reducing potential entry points.
• Policy Development: Formulate clear cybersecurity policies aligned with international standards to guide ongoing protection efforts.

Continue Your Cyber Journey

Discover cutting-edge developments in Emerging Tech and industry Insights.

Explore engineering-led approaches to digital security at IEEE Cybersecurity.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1