The Chinese hacker group Salt Typhoon continues to target telecommunications companies despite sanctions imposed by the United States. In a report published by the threat intelligence firm Recorded Future, security researchers noted that Salt Typhoon compromised five telecommunications companies between December 2024 and January 2025.
Salt Typhoon made headlines in September 2024 after the group was revealed to have infiltrated major U.S. phone and internet giants, such as AT&T and Verizon, attempting to access private communications of U.S. government officials and political figures. This hacker group also accessed systems used by law enforcement for collecting customer data through court orders, trying to gain information on U.S. surveillance operations targeting China.
While Recorded Future declined to name the latest victims, they mentioned that the affected companies included a U.S.-based affiliate of a prominent U.K. telecommunications provider, a U.S. internet service provider, and telecommunications companies in Italy, South Africa, and Thailand. The hackers also conducted reconnaissance on the infrastructure of Myanmar-based telecom provider Mytel. According to Recorded Future, Salt Typhoon exploited two vulnerabilities in Cisco devices running Cisco IOS XE software to carry out these attacks.
The hacker group also targeted universities, including the University of California and Utah Tech. Researchers believe that the group may have sought to access research related to telecommunications, engineering, and technology at these institutions.
The U.S. government has imposed sanctions on companies linked to Salt Typhoon. In January, the U.S. Department of the Treasury sanctioned Sichuan Juxinhe Network Technology, a China-based cybersecurity company directly tied to Salt Typhoon.
Recorded Future researchers anticipate that Salt Typhoon will continue targeting telecommunications companies in the U.S. and globally.
