The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices
April 28, 2025, 8:52 a.m.
Description
Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall combined exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction. Cisco IOS XE was the only platform with increased exposure. Geographically, most exposures remain concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices raises questions about remediation efforts and organizational responses to these threats.
Tags
Date
- Created: April 26, 2025, 1:52 a.m.
- Published: April 26, 2025, 1:52 a.m.
- Modified: April 28, 2025, 8:52 a.m.
Additional Informations
- Telecommunications
- Government
- Germany
- United States of America