RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Providers

Recorded Future’s Insikt Group attributes a December 2024–January 2025 campaign to RedMike (Microsoft: Salt Typhoon) that attempted to exploit over 1,000 internet-facing Cisco IOS XE devices worldwide using CVE-2023-20198 and CVE-2023-20273 to create privileged accounts and escalate to root, then add GRE tunnels for persistent covert access; primary targets included telecommunications providers and select universities, with confirmed compromises and documented reconnaissance activity.