CISA, FBI, NSA Warn of Chinese 'Global Espionage System'

A joint advisory from CISA, FBI, and NSA warns of a Chinese global espionage system, detailing how state-backed threat actors, including Salt Typhoon, have been probing networks worldwide. According to CISA, FBI, NSA, the activity targets telecommunications, government, transportation, lodging and defence sectors, often by compromising large routers and trusted connections to move laterally, with persistence across networks.

The agencies say the cluster partially overlaps with Salt Typhoon and note that there has been no zero-day exploitation observed to date, though publicly known vulnerabilities such as Ivanti Connect Secure CVE-2024-21887, Ivanti Policy Secure Web-component CVE-2024-3400, and Cisco IOS XE CVEs including CVE-2023-20273, CVE-2023-20198, and CVE-2018-0171 are part of the threat landscape.

Mitigations are provided, and defenders are urged to prioritise them, given the actors’ tendency to target routers and related devices. The advisory is cosigned by multiple nations, and the report describes extensive techniques used to gain and maintain access, including altering ACLs, opening ports, and conducting SNMP-based reconnaissance for lateral movement. according to CISA, FBI, NSA