Chinese hackers breached National Guard to steal network configurations

Salt Typhoon, a Chinese state-sponsored hacking group, breached and remained undetected in a U.S. Army National Guard network from March to December 2024, exfiltrating network diagrams, configuration files, administrator credentials, and personal data; DHS warns the group has stolen 1,462 network configuration files from ~70 U.S. government and critical infrastructure entities and has used CVE exploits (including CVE-2018-0171, CVE-2023-20198, CVE-2023-20273, CVE-2024-3400), custom malware (JumblePath, GhostSpider), and identified IP addresses to facilitate intrusions and follow-on compromises.