Attacks continued through January, with China-backed hackers targeting devices linked to universities, telecoms, and ISPs, undeterred by significant media coverage and US sanctions.

Threat intelligence firm Recorded Future said it had observed Salt Typhoon breaching 5 telcos between December 2024 and January 2025.

Despite high-profile attention and even US sanctions, the group hasn’t stopped or even slowed its operation, including the breach of two more US telecoms.

Recorded Future’s latest findings shed light on how widespread the Salt Typhoon campaign has become since it was uncovered last year.

Chinese APT Salt Typhoon has been exploiting known vulnerabilities in Cisco devices in attacks on telecom providers in the US and abroad.

China's Salt Typhoon hackers are still actively targeting telecoms worldwide and have breached more U.S. telecommunications providers via unpatched Cisco IOS XE network devices.

Salt Typhoon continues its attacks against telecoms, security researchers reveal. According to the report, Salt Typhoon—tracked by Recorded Future as “RedMike”—breached up