More victims of China's Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs

China's Salt Typhoon spy crew exploited vulnerabilities in Cisco devices to compromise at least seven devices linked to global telecom providers and other orgs, in addition to its previous victim count. The intrusions happened between December 2024 and January 2025 with the Chinese government snoops attempting to exploit more than 1,000 internet-facing Cisco-made boxes before successfully breaking into at least seven that were unpatched, according to Recorded Future's Insikt Group. Salt Typhoon previously compromised at least nine US telecommunications companies and government networks, giving President Xi's agents real-time access to people's communications and whereabouts. In its latest espionage campaign, the crew infiltrated Cisco-supplied gear associated with a US internet service and telecommunications provider, a US affiliate of a "significant" UK-based telecom provider, an Italian ISP, and two other telecommunications firms, one in South Africa and a "large" one in Thailand, Insikt's report [PDF] states. Again, that would give China intimate access to people's internet activities, movements, and comms. "The group likely compiled a list of target devices based on their association with telecommunications providers' networks," according to the write-up. Additionally, the snoops "possibly targeted" more than a dozen universities including University of California, Los Angeles to access research related to telecommunications, engineering, and technology, according to the ...