Today's cybersecurity headlines are brought to you by ThreatPerspective

Exposing the Shadows: Uncovering China-Linked APT Salt Typhoon's Sophisticated Cyber Espionage Operations Targeting Canadian Telecom Companies

A recent report by the Canadian Centre for Cyber Security and the FBI has exposed China-linked APT group Salt Typhoon's sophisticated cyber espionage operations targeting Canadian telecom companies. The group has been known to breach networks by exploiting unpatched network devices, particularly those running Cisco IOS XE, and has already resulted in significant breaches across several countries, including the United States.

The world of cyber espionage is filled with complex web of threats, and one such group that has caught the attention of security experts is China-linked Advanced Persistent Threat (APT) group Salt Typhoon. According to a recent report by the Canadian Centre for Cyber Security and the FBI, Salt Typhoon has been targeting Canadian telecom firms in ongoing cyber espionage operations.

It has been reported that Salt Typhoon's hacking campaign, which has been active for 1-2 years, has targeted telecommunications providers in several dozen countries. This sophisticated APT group has managed to breach the networks of several major telecom companies, making it a significant threat to national security and personal data.

The Canadian Centre for Cyber Security has stated that Salt Typhoon likely hacked three telecom devices in February 2025, exploiting CVE-2023-20198 to steal configs and set up a GRE tunnel for data collection. This suggests that the group is highly skilled and knowledgeable about network vulnerabilities, making them a formidable opponent in the world of cyber espionage.

The threat actors' modus operandi is to exploit unpatched network devices, particularly those running Cisco IOS XE, to gain access to sensitive information. They have been known to breach networks by exploiting two Cisco flaws, CVE-2023-20198 and CVE-2023-20273, which highlights their ability to adapt and evolve.

The Canadian Centre for Cyber Security has also warned that Salt Typhoon is not just targeting telecom firms but also conducting network reconnaissance and possibly using compromised devices to reach more victims. This suggests that the group's ultimate goal is to gather as much sensitive information as possible, making it a significant threat to national security.

State-sponsored hackers, especially from China, have been heavily targeting telecom providers for espionage. These networks hold valuable data like call logs, locations, and private communications, making them an attractive target for cyber espionage operations.

The US government has also confirmed that Salt Typhoon has breached telecommunications companies in dozens of countries, including the United States. The group's methods are highly sophisticated, and it is estimated that they have accessed extensive metadata from targeted Americans while seeking specific communications, focusing regionally on government and political figures.

The breach at Viasat, a satellite firm, further highlights Salt Typhoon's capabilities and reach. This attack demonstrates the group's ability to target organizations across different sectors, making it a significant threat to national security.

The Canadian Centre for Cyber Security has issued guidance on how Canadian telecommunications companies can protect themselves against Salt Typhoon's attacks. The guidance includes steps such as patching Cisco IOS XE network devices and implementing robust cybersecurity measures to prevent exploitation of vulnerabilities.

Overall, the threat posed by China-linked APT group Salt Typhoon cannot be overstated. Their sophisticated cyber espionage operations have already resulted in significant breaches, and their ability to adapt and evolve makes them a formidable opponent in the world of cyber espionage. It is essential that organizations across different sectors take proactive measures to protect themselves against this threat.