Threat intelligence firm Recorded Future said it had observed Salt Typhoon breaching 5 telcos between December 2024 and January 2025.

Despite high-profile attention and even US sanctions, the group hasn’t stopped or even slowed its operation, including the breach of two more US telecoms.

Salt Typhoon continues its attacks against telecoms, security researchers reveal. According to the report, Salt Typhoon—tracked by Recorded Future as “RedMike”—breached up

Attacks continued through January, with China-backed hackers targeting devices linked to universities, telecoms, and ISPs, undeterred by significant media coverage and US sanctions.

Salt Typhoon's hacking spree has continued this year as the China-backed threat group recently compromised five more telecom providers across the globe, including two U.S.-based companies. According to research from Recorded Future's Insikt Group published Thursday,

Chinese APT Salt Typhoon has been exploiting known vulnerabilities in Cisco devices in attacks on telecom providers in the US and abroad.