{
  "name": "The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices",
  "slug": "the-persistent-threat-of-salt-typhoon-tracking-exposures-of-potentially-targeted-devices",
  "description": "Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall combined exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction. Cisco IOS XE was the only platform with increased exposure. Geographically, most exposures remain concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices raises questions about remediation efforts and organizational responses to these threats.",
  "published": "2025-04-25T23:52:01+00:00",
  "created_at": "2025-04-25T23:52:01+00:00",
  "modified_at": "2025-04-28T06:52:05+00:00",
  "created_at_opencti": "2025-04-25T23:52:01+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-04-26",
    "CVE-2022-3236",
    "CVE-2023-20198",
    "CVE-2023-20273",
    "CVE-2023-46805",
    "CVE-2023-48788",
    "CVE-2024-21887",
    "chinese state-sponsored",
    "cisco ios xe",
    "exposure tracking",
    "fortinet forticlient ems",
    "ivanti connect secure",
    "masol rat",
    "network devices",
    "shadowpad",
    "sophos firewall",
    "telecommunications",
    "vulnerability exploitation"
  ],
  "related_entities": {
    "malware": [
      {
        "id": "fd8b2c46-b03b-4297-8230-dbb901fa4cd7",
        "name": "MASOL RAT",
        "slug": "masol-rat"
      },
      {
        "id": "85ab906f-5034-44be-b872-ebfe4a94716e",
        "name": "POISONPLUG.SHADOW",
        "slug": "poisonplugshadow"
      },
      {
        "id": "6eb1e541-4ae8-42dd-87c4-197534c82ca3",
        "name": "ShadowPad - S0596",
        "slug": "shadowpad-s0596"
      }
    ],
    "intrusion_sets": [
      {
        "id": "35569085-ee2f-460c-8115-f2cd8e626ec5",
        "name": "Salt Typhoon",
        "slug": "salt-typhoon"
      }
    ],
    "attack_patterns": [
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "53b3b18c-d0d0-4bf6-bc6b-2c0ab9180deb",
        "name": "T1070"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Germany"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://censys.com/blog/the-persistent-threat-of-salt-typhoon-tracking-exposures-of-potentially-targeted-devices",
    "https://otx.alienvault.com/pulse/680c3c41a960b91fa23ec72d"
  ]
}