InfoSecBulletin Cybersecurity for mankind
The China-linked APT group Salt Typhoon is still attacking networks globally, focusing on telecommunications, government, transportation, hospitality, and military sectors.
“While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and customer edge (CE) routers, they also leverage compromised devices and trusted connections to pivot into other networks,” according to a joint cybersecurity advisory published Wednesday. “These actors often modify routers to maintain persistent, long-term access to networks.”
Hacker claim to breach Link3; 189,000 Users data up for sale
Check Point Hosts “Securing the Hyperconnected World in the AI Era” in Dhaka
Microsoft Confirms 900+ XSS Vulns Found in IT Services
Daily Security Update Dated : 15.09.2025
IBM QRadar SIEM Vuln Let Attackers Perform Unauthorized Actions
Major Australian Banks using Army of AI Bots to Scam Scammers
F5 to acquire CalypsoAI for $180M for Advanced AI Security Capabilities
AI Pentesting Tool ‘Villager’ Merges Kali Linux with DeepSeek AI for Automated Attacks
CVE-2025-21043
Samsung Patched Critical Zero-Day Flaw Exploited in Android Attacks
Albania appoints world’s first AI minister, “Diella” to Tackle Corruption
The advisory, shared by authorities from 13 countries, said this malicious behavior has been linked to three Chinese companies: Sichuan Juxinhe Network Technology Co., Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd.
The countries that have issued the security alert include Australia, Canada, the Czech Republic, Finland, Germany, Italy, Japan, the Netherlands, New Zealand, Poland, Spain, the U.K., and the U.S.
According to The Wall Street Journal and The Washington Post, the hacking crew has expanded its targeting focus to other sectors and regions, attacking no less than 600 organizations, including 200 in the U.S., and 80 countries.
Salt Typhoon, associated with GhostEmperor, Operator Panda, RedMike, and UNC5807, gained initial access by exploiting vulnerabilities in exposed Cisco (CVE-2018-0171, CVE-2023-20198, CVE-2023-20273), Ivanti (CVE-2023-46805, CVE-2024-21887), and Palo Alto Networks (CVE-2024-3400) devices.
“The APT actors collected PCAPs using native tooling on the compromised system, with the primary objective likely being to capture TACACS+ traffic over TCP port 49,” the agencies said. “TACACS+ traffic is used for authentication, often for administration of network equipment and including highly privileged network administrators’ accounts and credentials, likely enabling the actors to compromise additional accounts and perform lateral movement.”
Salt Typhoon has been seen activating the sshd_operns service on Cisco IOS XR devices to create a local user with elevated privileges.
Storm-0501 Deletes Data and Backups Post-Exfiltration on Azure in Hybrid Cloud Attacks
