Site icon Cybercory

PRC “Salt Typhoon” Cyber‑Espionage Campaign Targets Global Telecoms – Canada Confirms Mid‑February Breach via CVE‑2023‑20198

Ouaissou DEMBELE

Canada and U.S. agencies have issued a joint alert on the exploitation of a critical Cisco vulnerability (CVE‑2023‑20198) by Chinese state‑sponsored actors known as Salt Typhoon. Telecom infrastructure, including three devices in Canada compromised in February 2025, faces directly invasive cyber‑espionage. This global intrusion underscores the urgent need for critical infrastructure defenses right now.

The Canadian Centre for Cyber Security identified that Salt Typhoon breached three telecom network devices, exploiting CVE‑2023‑20198 (a Cisco IOS XE vulnerability) to extract configuration files and establish a GRE tunnel allowing traffic interception.

October 2023 – Vulnerability First Disclosed

Cisco initially disclosed CVE‑2023‑20198 in October 2023. Despite available patches, at least one Canadian telecom provider remained unprotected until targeted in 2025 .

2024‑2025 – Global Espionage Wave

Salt Typhoon’s campaign has penetrated telecom networks across the U.S., South Africa, Italy, Australia, and beyond, with attackers intercepting call metadata and, in some cases, live voice communications.

MEA Perspective: Implications for Middle East & Africa

Regional Telecom Exposure

Telecom operators in MEA, many relying on similar edge device ecosystems, are at equal risk. Unpatched routers and misconfigured networks present fertile ground for exploitation by sophisticated state-actors.

Regulatory Parallels

Agencies like UAE NESA, Saudi NCA, and Kenya DPA mandate penetration testing and patch tracking. This bulletin underscores the regulatory urgency behind enforcing security services and pentesting across critical infrastructure a global best practice underscored by this breach.

Global Context

State-Sponsored Espionage Trend

Salt Typhoon is part of a larger wave of nation-state cyber-espionage targeting telecoms. In late 2024, Australia, Canada, New Zealand, UK, and US issued a joint warning.

Intelligence-Rich Targets

Telecom networks are treasure troves of location, call, and text metadata. As noted by FBI’s Cynthia Kaiser, the data collection is “gigantic and seemingly indiscriminate”, posing serious privacy and national security risks.

Technical Box: MITRE ATT&CK TTPs & IOCs

Initial Access       | Exploiting public‑facing edge device | T1190
Discovery            | Network device reconnaissance         | T1033
Command & Control    | GRE tunnel setup for exfiltration     | T1090
Impact               | Traffic collection, intelligence gain | T1497

Indicators of Compromise (IoCs):

Expert Commentary

“Three network devices … were compromised … enabling traffic collection from the network,” states the Canadian Cyber Centre bulletin, June 19, 2025 (cyber.gc.ca, bleepingcomputer.com, ic3.gov).

FBI’s Cynthia Kaiser warns the campaign’s scale is “gigantic and seemingly indiscriminate”—collecting both metadata and voice communications (cyberscoop.com).

Actionable Takeaways for Defenders

  1. Patch Cisco Edge Devices Immediately – Apply fixes for CVE‑2023‑20198 and similar edge OS vulnerabilities.
  2. Segment & Isolate Telecom Routers – Ensure no direct internet exposure to management interfaces.
  3. Monitor GRE Tunnel Configurations – Alert on unplanned GRE setups in network logs.
  4. Deploy Network Anomaly Detection – Utilize systems designed for telecom‑grade surveillance.
  5. Enforce Multi-Factor Authentication – Add layer to router and admin panel access.
  6. Conduct Regular Pentesting & Audits – Validate device configurations and OS levels.
  7. Log File Integrity Monitoring – Detect unauthorized config changes.
  8. Deploy WAF and IDS Protections – Monitor for exploit attempts.
  9. Share Intelligence Across Borders – MEA telecoms should integrate global news feeds.
  10. Engage Government Cyber Authorities – Follow guidance from NESA, NCA, and Kenya DPA closely.

Conclusion

Salt Typhoon’s exploitation of CVE‑2023‑20198 to hijack global telecom infrastructure marks a seminal moment in state-sponsored cyberespionage. For MEA and global telecom providers, the alert is clear: unpatched routers aren’t just a vulnerability-they are strategic entry points for nation-state actors. Swift patching, layered defenses, and proactive intelligence-sharing are non-negotiable to defend against this threat.

Sources

Exit mobile version