Salt Typhoon remains active, hits more telecom networks via Cisco routers

Salt Typhoon (aka RedMike), a Chinese nation-state actor, is actively exploiting two critical Cisco IOS XE vulnerabilities (CVE-2023-20198 and CVE-2023-20273) to create accounts and gain root on internet-exposed routers used by telecom providers worldwide. Recorded Future observed compromised Cisco devices communicating with Salt Typhoon infrastructure across multiple telecom networks — including U.S. providers — and the campaign demonstrates large scale, targeted intrusions against critical communications infrastructure.