China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years

China-linked APT Salt Typhoon, also known as GhostEmperor, Operator Panda, RedMike and UNC5807, has been compromising backbone and edge routers globally for persistent access across telecoms, government, transportation, lodging and military networks since at least 2021. The group has targeted organisations in the US, Australia, Canada, New Zealand, the UK and other regions, carrying out cyberespionage operations over more than half a decade.

Their techniques include exploiting known router vulnerabilities in Cisco (CVE-2018-0171, CVE-2023-20198, CVE-2023-20273), Ivanti (CVE-2024-21887) and Palo Alto Networks products (CVE-2024-3400) for initial access, then moving laterally by tampering with Access Control Lists, opening ports, creating tunnels and abusing peering connections for data exfiltration.

They are seen modifying server configurations to point to IPs they control, creating privileged accounts, and deleting logs to hide activity, while using routers to pivot into other networks and to mirror traffic. The advisory notes Salt Typhoon’s persistence, long-term access and capability to identify and track targets’ communications and movements globally, with hundreds of organisations targeted in 80 countries in 2024 alone.