China-Linked Salt Typhoon breaches European Telecom via Citrix exploit

According to SecurityAffairs, Salt Typhoon, a China-linked APT group, hacked a European telecom in July 2025 by exploiting a Citrix NetScaler Gateway to gain initial access, then pivoting to Citrix Virtual Delivery Agent hosts in the client’s Machine Creation Services subnet and leveraging a SoftEther VPN endpoint.

In the late 2024 campaign against global telecoms, and again in December 2024, U.S. officials noted that Salt Typhoon had targeted telecommunications providers in dozens of countries; Darktrace later reported that its AI detected activity consistent with Salt Typhoon tactics in July 2025 at a European firm.

The attackers deployed the SNAPPYBEE (Deed RAT) backdoor via DLL sideloading using legitimate antivirus executables (Norton, Bkav, IObit) to evade detection, and used LightNode VPS servers for C2 with HTTP communications and an unknown TCP protocol, sending POST requests that mimicked Internet Explorer traffic. Darktrace concludes that Salt Typhoon/Earth Estries similarities in tools and infrastructure point to the same group, though with moderate confidence.