The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

Salt Typhoon is a Chinese state-sponsored threat actor targeting major telecommunications providers globally by exploiting vulnerabilities in various network devices. This analysis monitors exposures of internet-facing devices linked to Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction, while Cisco IOS XE exposure increased. Most exposures are concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices suggests ongoing challenges in remediation and organizational response.

• Targets high value telecommunications infrastructure in South AsiaMalware2026-01-08
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20
• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• India's government and energy sectors targeted with ZOHOMURK and MINIRECONMalware2026-06-29