Salt Typhoon Exploits Cisco Devices in Telco Infrastructure

Salt Typhoon (also tracked as RedMike/UNC2286) has been observed exploiting two Cisco IOS XE vulnerabilities (CVE-2023-20198 and CVE-2023-20273) to compromise over a thousand network devices across telcos, ISPs, and universities globally; the group used GRE tunnels for persistence and data exfiltration, posing significant risk to critical communications infrastructure and sensitive research networks.