Chinese APT Groups Exploit Router Flaws to Breach Enterprises

Chinese state-sponsored APT groups have escalated cyber espionage campaigns since 2021, systematically targeting global telecommunications, government, and military networks through sophisticated router exploitation techniques. The actors, operating under aliases such as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor, have compromised core networking infrastructure across the United States, Australia, Canada, New Zealand, and the United Kingdom.

They frequently exploit publicly known vulnerabilities to gain initial access, with Cyble noting that no zero-day exploits have been confirmed in these campaigns. The CVEs linked to these campaigns include CVE-2024-21887 (Ivanti Connect Secure), CVE-2024-3400 (Palo Alto Networks PAN-OS GlobalProtect), CVE-2023-20273 (Cisco IOS XE), CVE-2023-20198 (Cisco IOS XE), and CVE-2018-0171 (Cisco IOS/IOS XE).

Once inside, they modify router configurations, expose services on various ports, and leverage Cisco’s embedded features, including PCAP interception, to harvest credentials. The report urges defenders to hunt for signs of compromise and maintain mitigations, highlighting the need for vigilance against these persistent, state-sponsored threats. According to Cyble, while there have been no confirmed zero-days, attackers chain multiple exploits to achieve full control over devices.