Salt Typhoon strikes again – more US ISPs, universities and telecoms networks hit by Chinese hackers

• Security researchers from Recorded Future observe new Salt Typhoon activity
• The threat actor is still going after ISPs and universities in the west
• The group is abusing flaws in Cisco gear to hit new targets

Salt Typhoon, a Chinese state-sponsored threat actor best known for recently breaching almost a dozen telecom providers in the US, has struck again, hitting not just American organizations, but also those from the UK, South Africa, and elsewhere around the world.

The latest intrusions were spotted by cybersecurity researchers from Recorded Future, which said the group is targeting internet-exposed web interfaces of Cisco’s IOS software that powers different routers and switches. These devices have known vulnerabilities that the threat actors are actively exploiting to gain initial access, root privileges, and more.