Weathering the storm: In the midst of a Typhoon

Cisco Talos reports on a sustained, highly sophisticated intrusion campaign by the actor dubbed Salt Typhoon targeting U.S. telecommunications core network devices. The actor used stolen legitimate credentials, living-off-the-land techniques, configuration exfiltration (often via TFTP/FTP), packet captures (including a custom Go utility called JumbledPath), and persistent shell modifications to pivot across infrastructure and maintain long-term access; the report includes IOCs, references to CVE-2018-0171 Smart Install abuse (separate activity), and detailed detection and hardening guidance.