Cisco Confirms Salt Typhoon Exploitation in Telecom Hits

Cisco confirmed that Salt Typhoon (a sophisticated Chinese APT) exploited CVE-2018-0171 and used stolen credentials to compromise major U.S. telecommunications providers (including T‑Mobile, AT&T, and Verizon), maintaining long-term access enabling configuration exfiltration, pivoting, and modification; Cisco also reported that the actor is abusing additional known CVEs (CVE-2023-20198, CVE-2023-20273, CVE-2024-20399) and recommends immediate patching and improved credential hygiene.