CISA Alert AA25-239A: Analysis, Simulation, and Mitigation of Chinese APTs

On August 27, 2025, CISA with NSA, FBI and international partners published a joint advisory attributing persistent global espionage campaigns since 2021 to Chinese state-sponsored APTs (Salt Typhoon / OPERATOR PANDA / RedMike / UNC5807 / GhostEmperor) that compromise routers and other network-edge devices by exploiting known CVEs, altering configurations (ACLs, TACACS+/SNMP), abusing SSH/Guest Shell, and tunneling (GRE/IPsec) to capture credentials, mirror traffic, and exfiltrate sensitive communications; the advisory lists high-priority CVEs, maps observed behaviors to MITRE ATT&CK, identifies impacted sectors (telecom, government, transportation, lodging, military), and provides defensive recommendations.