Threat intelligence firm Recorded Future said it had observed Salt Typhoon breaching 5 telcos between December 2024 and January 2025.

China's Salt Typhoon hackers are still actively targeting telecoms worldwide and have breached more U.S. telecommunications providers via unpatched Cisco IOS XE network devices.

Recorded Future’s latest findings shed light on how widespread the Salt Typhoon campaign has become since it was uncovered last year.

Attacks continued through January, with China-backed hackers targeting devices linked to universities, telecoms, and ISPs, undeterred by significant media coverage and US sanctions.

Despite high-profile attention and even US sanctions, the group hasn’t stopped or even slowed its operation, including the breach of two more US telecoms.