Hoplon InfoSec
14 Feb, 2025
Do you know that RedMike Hackers Breach 1000+ Cisco Devices for Admin Access? In recent months, cybersecurity experts have observed a highly sophisticated cyber-espionage campaign orchestrated by a state-sponsored Chinese group known as “Salt Typhoon” (also referred to as “RedMike”). This campaign has emerged as a stark reminder of the vulnerabilities inherent in unpatched network devices and the persistent threat posed by state-backed actors. In this article, we explore the timeline of events, technical details behind the exploitation, the targeted organizations, the strategic intelligence objectives behind the campaign, and the necessary mitigation measures to protect critical infrastructure from such advanced threats.
Between December 2024 and January 2025, Salt Typhoon executed a methodical campaign targeting unpatched Cisco network devices worldwide. Over these two months, more than 1,000 Cisco devices were compromised, affecting various organizations, including telecommunications providers and universities. The attackers used known vulnerabilities to infiltrate networks, emphasizing the need for robust patch management and cybersecurity practices worldwide.
This incident is not just a case study in technical exploitation; it also reveals how state-sponsored groups leverage known software vulnerabilities to gain strategic advantages. By focusing on critical infrastructure and academic institutions, Salt Typhoon demonstrated an understanding of where valuable data, research, and communications converge.
At the heart of the campaign were two critical privilege escalation vulnerabilities in Cisco’s IOS XE software: CVE-2023-20198 and CVE-2023-20273. Both vulnerabilities were publicly disclosed in October 2023, providing attackers with a roadmap to exploit weaknesses in unpatched systems. By exploiting these vulnerabilities, the group could gain initial access through the web user interface (UI) and then elevate their privileges to root-level access—a level of control that allows nearly unfettered command over the affected devices.
Once the attackers obtained root access, their next step was to reconfigure the compromised devices. They created Generic Routing Encapsulation (GRE) tunnels, a feature built into Cisco devices, to establish persistent, covert communication channels between the compromised networks and their command-and-control (C2) infrastructure. While a standard and legitimate networking feature, GRE tunneling became an effective tool for bypassing traditional firewalls and intrusion detection systems in this scenario. This stealth approach allowed the group to exfiltrate sensitive data and maintain continuous access without triggering immediate alarms.
The use of GRE tunnels also highlights a broader challenge for network administrators: the dual-use nature of many networking protocols. What is typically a useful tool for ensuring connectivity and secure data transmission can be repurposed by malicious actors to mask their activities and evade detection. Exploiting these vulnerabilities underscores the importance of constant vigilance and proactive measures in network security management.
Salt Typhoon’s campaign was not random. The attackers carefully selected their targets, focusing primarily on telecommunications providers and academic institutions. This selection was driven by the high value of the information and research housed within these organizations.
Telecommunications companies are at the core of modern digital communications, making them an attractive target for cyber espionage. In this campaign, multiple telecommunications providers across different regions were affected. The attackers managed to compromise networks belonging to:
These companies are critical to maintaining the communications infrastructure of entire regions. By infiltrating these networks, attackers gain access to sensitive operational data, and the potential to monitor real-time communications, disrupt services, or even manipulate data flows during geopolitical conflicts.
In addition to telecommunications providers, Salt Typhoon extended its reach to several universities worldwide. These academic institutions in countries such as Argentina, Bangladesh, Indonesia, Malaysia, Mexico, the Netherlands, Thailand, Vietnam, and the United States (including renowned institutions like UCLA and TU Delft) are hubs for research in telecommunications, engineering, and advanced technologies. These campuses’ data and intellectual property are of immense value for economic and national security reasons.
The strategic choice to target universities further demonstrates the attackers’ intent to tap into cutting-edge research and potentially influence or gather intelligence on emerging technologies. Over half of the compromised devices were located in regions such as the United States, South America, and India—known for their significant contributions to global research and technology development.
Apart from the primary targets, researchers noted reconnaissance activities against a Myanmar-based telecom provider, Mytel, in December 2024. These scans suggest that Salt Typhoon’s ambitions extend beyond the immediate list of compromised organizations. Instead, the group appears to be mapping out additional networks for future infiltration, indicating that this campaign may be part of a broader strategy aimed at regional dominance in cyber intelligence.
The technical aspects of the Salt Typhoon campaign reveal more than just a sophisticated hacking operation; they hint at underlying strategic intelligence objectives. With persistent access to networks, state-backed actors can achieve several strategic goals:
One of the campaign’s primary objectives is intercepting sensitive real-time communications. By infiltrating telecommunications networks, the attackers can monitor conversations, collect metadata, and gather valuable information for strategic decision-making. In today’s world, where the flow of information is as critical as the physical movement of goods and services, the ability to monitor communications provides a significant intelligence advantage.
In addition to monitoring, the attackers have the potential to disrupt services. During periods of geopolitical tension or conflict, the ability to sabotage critical communication channels can have far-reaching implications. This disruptive capability is not merely theoretical; historical precedents have shown that cyber attacks can lead to widespread service outages, impacting everything from emergency services to global financial markets.
Another alarming aspect of the campaign is the possibility of manipulating data flows. By altering or redirecting critical information, attackers can inject false data or propaganda, influence public opinion, or alter the outcomes of strategic decisions. This manipulation could be particularly harmful if it involves lawful intercept systems or impacts high-profile political figures, as noted in the campaign’s focus on U.S. political targets.
The strategic intelligence objectives of Salt Typhoon illustrate the multifaceted nature of modern cyber warfare. Security must not be considered solely in protecting data; it must also consider the broader implications of compromised communications and the potential for wide-scale manipulation of information.
Given the scale and sophistication of the Salt Typhoon campaign, organizations must take proactive steps to defend their networks against similar attacks. The following mitigation measures provide a roadmap for strengthening cybersecurity and minimizing the risk of such intrusions:
The first and most critical step is ensuring that all network devices, particularly those running Cisco IOS XE, are updated with the latest security patches. Vulnerabilities such as CVE-2023-20198 and CVE-2023-20273 have already been identified and documented; therefore, organizations must prioritize the immediate application of these patches. Failure to do so leaves systems vulnerable to exploitation and may result in severe security breaches.
Many of the attacks in this campaign began with unauthorized access via network devices’ web user interface (UI). To mitigate this risk, organizations should restrict exposure to these interfaces on devices accessible from the public Internet. Limiting access to internal networks or employing robust authentication measures can also significantly reduce the attack surface.
Implementing comprehensive monitoring and logging is crucial for the early detection of unauthorized changes. Organizations should deploy systems identifying unexpected configuration modifications, such as creating GRE tunnels. Early detection allows for rapid response and containment, preventing attackers from establishing persistent footholds in the network.
Since GRE tunneling is a legitimate networking function that can be abused for covert communications, monitoring and controlling its usage within your network is essential. Security teams should employ advanced network monitoring tools capable of detecting unusual GRE tunnel activity, enabling them to identify potential breaches before they escalate into full-blown intrusions.
End-to-end encryption is a vital strategy for protecting sensitive communications from interception. Encryption secures data in transit, making it significantly more difficult for attackers to manipulate or access confidential information. Government agencies such as the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have recommended adopting encrypted messaging applications to mitigate eavesdropping risks.
While technical measures are essential, combating state-sponsored cyber espionage requires international collaboration. For example, the U.S. Treasury Department recently sanctioned Sichuan Juxinhe Network Technology Co., Ltd., a Chinese contractor linked to Salt Typhoon’s activities. Such actions serve as a deterrent and demonstrate a commitment to holding perpetrators accountable. However, cybersecurity experts emphasize that no single country can address the threat alone; it requires coordinated efforts across borders and industries.
An often overlooked aspect of cybersecurity is the human element. Employees and administrators must be educated about the risks and signs of cyber intrusion. Regular training sessions, simulated phishing exercises, and awareness campaigns can empower staff to recognize and report suspicious activities. A well-informed workforce acts as an additional defense against sophisticated cyber attacks.
Regular network audits and penetration tests are other critical measures to identify and address vulnerabilities before they can be exploited. By simulating potential attack scenarios, organizations can uncover weaknesses in their defenses and implement corrective measures promptly. These exercises enhance the security posture and prepare teams for rapid response during a breach.
The Salt Typhoon campaign is a clear illustration of how state-sponsored actors can leverage known vulnerabilities to conduct high-stakes cyber espionage. It also underscores several key lessons that organizations across the globe must take to heart:
The Salt Typhoon cyber-espionage campaign is a powerful case study in the evolving landscape of cyber threats. From the exploitation of specific Cisco vulnerabilities to the strategic objectives behind targeting telecommunications providers and academic institutions, the campaign underscores the complexity and scale of modern cyber warfare. The attackers’ ability to exploit GRE tunnels and bypass detection systems highlights the need for continuous vigilance and the rapid application of security patches.
The lessons from this campaign are clear for organizations: proactive defense, regular monitoring, employee training, and international collaboration are not optional—they are essential components of any robust cybersecurity strategy. As state-backed actors refine their techniques, the onus is on every organization to stay one step ahead. By implementing the mitigation measures discussed in this article, businesses and institutions can better protect themselves from similar threats in the future.
In a world where the digital and physical realms are increasingly intertwined, ensuring the security of our critical infrastructure is more important than ever. Whether you are a small business, a multinational corporation, or a government entity, understanding and addressing these vulnerabilities is key to safeguarding your operations against sophisticated cyber-espionage campaigns like Salt Typhoon.
The cybersecurity community must remain committed to innovation, collaboration, and education as we move forward. Only by working together can we hope to build a more secure digital future and prevent the next wave of cyber attacks from compromising the very foundations of our global communications networks.
By staying informed, applying best practices, and investing in advanced security measures, organizations can mitigate the risks posed by vulnerabilities like CVE-2023-20198 and CVE-2023-20273 and build a resilient defense against the evolving threat landscape of state-sponsored cyber espionage.
For more:
https://cybersecuritynews.com/salt-typhoon-hackers-exploited-1000-cisco-devices/
Share this :