Salt Typhoon's surge extends far beyond US telcos

Trend Micro reports that the China-linked APT "Salt Typhoon" (Earth Estries) has conducted prolonged, global cyber-espionage campaigns since 2020 against telcos, governments, consultants, NGOs and suppliers in over 20 organizations and many countries. The attackers exploit public-facing CVEs (including Ivanti, Fortinet, Sophos, and Microsoft Exchange flaws), use living-off-the-land tools (WMIC, PsExec) for lateral movement, and deploy malware such as SnappyBee/Deed RAT, the Demodex rootkit, and a newly observed GhostSpider backdoor.