Security experts are warning us that a group of hackers in China, known as Salt Typhoon, continues to successfully attack companies that provide telephone and internet services. This is happening even though the U.S. government has recently placed restrictions on this group to stop their actions.
In a report that was shared with TechCrunch, a company that specializes in tracking cybersecurity threats called Recorded Future revealed that they found evidence of Salt Typhoon breaking into five telecommunications companies between December 2024 and January 2025.
This hacking group first gained attention last September when it became known that they had infiltrated major American phone and internet companies like AT&T and Verizon. Their goal was to read private communications from high-ranking U.S. government officials and political leaders.
Salt Typhoon also managed to access systems used by law enforcement agencies to collect legal information about individuals, potentially exposing sensitive data such as the identities of Chinese citizens who are under U.S. surveillance.
While Recorded Future did not provide the names of the most recent victims of the attacks, they mentioned that these included a U.S. branch of a well-known telecommunications company from the U.K., a U.S. internet provider, and telecom companies located in Italy, South Africa, and Thailand.
Additionally, the hackers examined various systems belonging to a Myanmar telecommunications company called Mytel, gathering information about their infrastructure.
Read Also: Telegram Launches Better Sticker Search And Video Watching Features
To perform these attacks, Salt Typhoon took advantage of two weak spots—referred to as vulnerabilities—in certain Cisco devices that used specific software known as Cisco IOS XE. The hacking group has been trying to compromise over 1,000 of these Cisco devices worldwide, putting special focus on those connected to telecommunications networks.
Recorded Future also reported that Salt Typhoon is targeting devices tied to universities, including the University of California and Utah Tech. The researchers suggest that the reason behind this could be that they want to access academic research in areas related to telecommunications, engineering, and technology.
The U.S. government has responded by sanctioning businesses associated with Salt Typhoon. For instance, in January, the U.S. Treasury Department announced restrictions against a cybersecurity company in China called Sichuan Juxinhe Network Technology, which they believe has direct links to the hacking group.
Despite these governmental actions, the experts at Recorded Future forecast that Salt Typhoon will likely continue to target telecom providers in the United States and other countries.
