Here is the rewritten content:<\/p>\n
The Chinese government-linked hacking group, Salt Typhoon, is still compromising telecommunications providers despite the recent sanctions imposed by the US government on the group.<\/p>\n
According to a report shared with TechCrunch, threat intelligence firm Recorded Future observed Salt Typhoon \u2014 also known as "RedMike" \u2014 breaching five telecommunications firms between December 2024 and January 2025.<\/p>\n
Salt Typhoon made headlines last September after it was revealed that the group had infiltrated several US phone and internet giants, including AT&T and Verizon, to gain access to the private communications of senior US government officials and political figures.<\/p>\n
Salt Typhoon also hacked into the systems used by law enforcement agencies for court-authorized collection of customer data, potentially accessing sensitive data such as the identities of Chinese targets of US surveillance.<\/p>\n
Recorded Future declined to name Salt Typhoon’s latest victims, but said they include a US-based affiliate of a prominent UK telecommunications provider, a US internet service provider, and telecommunications companies in Italy, South Africa, and Thailand.<\/p>\n
The hackers also performed reconnaissance \u2014 the practice of covertly discovering and collecting information about a system \u2014 on multiple infrastructure assets operated by Myanmar-based telecommunications provider, Mytel, according to Recorded Future.<\/p>\n
To carry out these attacks, Salt Typhoon exploited two vulnerabilities (tracked as CVE-20232-0198 and CVE-2023-20273) to compromise unpatched Cisco devices running Cisco IOS XE software. The hacking group has attempted to compromise more than 1,000 Cisco devices globally, focusing particularly on devices associated with telecommunications providers’ networks, Recorded Future said.<\/p>\n
Recorded Future said it had also observed Salt Typhoon targeting devices associated with universities, including the University of California and Utah Tech. The researchers said the hacking group "possibly targeted these universities to access research in areas related to telecommunications, engineering, and technology."<\/p>\n
The US government has sanctioned companies linked to the group. In January, the US Treasury Department said it had sanctioned a China-based cybersecurity company known as Sichuan Juxinhe Network Technology, which it says is directly linked to Salt Typhoon.<\/p>\n