Executive Summary

In mid-to-late 2024, US intelligence agencies and cybersecurity investigators uncovered one of the most broad-reaching and strategically damaging espionage campaigns in history. Code-named Salt Typhoon (also tracked as RedMike, UNC5807, and BRONZE COVET), a China-linked Advanced Persistent Threat (APT) successfully infiltrated the core routing networks of multiple major US telecommunications providers. The objective was not database theft or simple service disruption, but the systematic interception of sensitive call records, SMS texts, and most alarmingly, court-authorized wiretapping data feeds (CALEA systems) used by federal law enforcement.

Who is Salt Typhoon?

Salt Typhoon is a highly sophisticated Chinese state-sponsored cyber espionage group. Unlike other threat actors like Volt Typhoon, which focuses on pre-positioning cyber weapons to disrupt industrial control systems, Salt Typhoon’s primary mission is signal intelligence (SIGINT) collection. They target network backbones—the physical and logical highways of the internet—to gain silent, continuous access to global data streams.

Targeted Access: Infiltrating the Telecommunication Backbone

Salt Typhoon’s intrusions did not target typical office computers. Instead, the group went straight for core infrastructure:

• Backbone and Edge Routers: By compromising routers operated by Cisco and Juniper, the group controlled the routing tables of national internet traffic.
• Authentication Servers: The group targeted RADIUS and TACACS+ authentication portals, stealing administrative credentials to move laterally within telco networks.
• Law Enforcement Intercept Portals: The hackers breached the systems built to comply with the Communications Assistance for Law Enforcement Act (CALEA). These systems allow US law enforcement to perform court-approved wiretaps on subscribers. By compromising this gateway, Salt Typhoon was able to see who federal agencies were wiretapping and potentially intercept those same streams.

Vulnerability Profile & Exploitation Tactics

The primary entry vectors for Salt Typhoon involved a combination of zero-day exploits, stolen credentials, and unpatched firmware vulnerabilities in edge appliances:

1. Exploitation of Cisco IOS XE (CVE-2023-20198 and CVE-2023-20273): Salt Typhoon actively weaponized a critical privilege-escalation vulnerability in Cisco's IOS XE software. This flaw allowed unauthenticated remote attackers to create high-level administrative accounts, which they paired with CVE-2023-20273 to execute code with root privileges on target routers.
2. Juniper Junos OS Exploitation: The group similarly targeted Juniper firewalls and switches, deploying custom memory-resident backdoors to maintain persistence.
3. Generic Routing Encapsulation (GRE) Tunnels: Once inside a router, the group established covert GRE tunnels. This technique redirected copies of targeted network traffic directly to IP addresses controlled by Salt Typhoon, allowing them to passively capture data.
4. Embedded Packet Capture (EPC): The threat actors utilized native router features like EPC to sniff and capture administrative traffic, letting them steal passwords and access keys as they passed through the network.

Post-Mortem: Strategic Implications

The Salt Typhoon campaign represents a watershed moment in infrastructure security:

• Infiltration of Law Enforcement Systems: By accessing CALEA wiretap feeds, Salt Typhoon was able to identify Chinese dissidents, intelligence targets, and covert operations currently under surveillance by US law enforcement, directly undermining counter-espionage efforts.
• The Visibility Blindspot: Network devices (routers, switches, firewalls) rarely support traditional Endpoint Detection and Response (EDR) agents. This lack of visibility allowed Salt Typhoon's implants to remain undetected on core routers for months.
• Call for End-to-End Encryption: Following the disclosure of the compromise, federal authorities and cybersecurity agencies advised both government personnel and the general public to enforce strict end-to-end encryption (such as using Signal or double-encrypted channels) for all voice and text communications, acknowledging that the underlying carrier networks can no longer be assumed secure.

Recommended Mitigation Strategies

To defend against Salt Typhoon's signature tactics, infrastructure administrators must prioritize the following:

• Firmware Integrity Audits: Regularly audit router firmware hash values against verified manufacturer baselines to detect unauthorized custom backdoors.
• Restrict Administrative Access: Ensure that router management ports are never exposed to the public internet. Restrict administration strictly to dedicated Out-of-Band (OOB) management networks.
• Monitor Routing Configurations: Enable continuous configuration change monitoring. Flag any new, unrecognized GRE tunnels, modified access lists, or altered TACACS+/RADIUS settings.
• Enforce Multi-Factor Authentication (MFA): Implement strict, certificate-based MFA for all network administration credentials.

Frequently Asked Questions (FAQ)