Global Salt Typhoon hacking campaigns linked to Chinese tech firms

According to the joint advisories, the U.S. National Security Agency (NSA), the UKundefineds National Cyber Security Centre (NCSC), and partners from over a dozen countries have linked the Salt Typhoon global hacking campaigns to three China-based technology firms: Sichuan Juxinhe Network Technology Co. Ltd., Beijing Huanyu Tianqiong Information Technology Co., and Sichuan Zhixin Ruijie Network Technology Co.

Ltd., which allegedly provided cyber products and services to China’s Ministry of State Security and the People’s Liberation Army. Since at least 2021, Salt Typhoon actors have breached government, telecommunications, transportation, lodging, and military networks worldwide, stealing data to track targets’ communications and movements.

The campaigns have, in particular, conducted concerted attacks on telecommunications firms to spy on private communications, with a joint advisory noting they exploit widely known and fixed flaws rather than relying on zero-days. The advisory highlights vulnerabilities such as CVE-2024-21887, CVE-2024-3400, CVE-2023-20273, CVE-2023-20198, and CVE-2018-0171, used to access routing and network devices and maintain persistence.

BleepingComputer also notes Salt Typhoon’s past activity, including breaches of major U.S. carriers and a nine-month intrusion into a U.S. Army National Guard network in 2024.