Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide

According to The Hacker News’ coverage of a joint advisory issued on 28 August 2025, the Salt Typhoon APT group, linked to China, has continued attacks on networks worldwide by exploiting flaws in Cisco, Ivanti, and Palo Alto Networks devices. The advisory notes that the intrusions have affected no fewer than 600 organisations globally, including 200 in the United States and spanning 80 countries, with activity clustering around telecommunications, government, transportation, lodging, and military sectors.

The attackers are observed compromising exposed edge devices from Cisco (exploiting CVE-2018-0171, CVE-2023-20198, CVE-2023-20273), Ivanti (CVE-2023-46805 and CVE-2024-21887), and Palo Alto Networks (CVE-2024-3400) to gain initial access and pivot within networks.

Once inside, Salt Typhoon has been seen modifying device configurations, establishing GRE tunnels, and using TACACS+ authentication to facilitate lateral movement and credential harvesting, with PCAP collection cited as a method to capture sensitive traffic. The campaign, which overlaps with aliases such as GhostEmperor and UNC5807, has reportedly persisted since at least 2019, and the advisory highlights a broad ecosystem of contractors and tools that enable its rapid evolution and scale.