US Government Issues Cisco-Specific Advise To Counter China’s Salt Typhoon Cyber-attacks

Chinese hackers known as "Salt Typhoon" have been in the news of late but this time they’ve caught the attention of the US government. The hackers are targeting Cisco equipment and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has stepped up to release a warning to telecom enterprises using Cisco’s gear.

The goal of this advisory is to protect important communication networks from ongoing cyber-espionage operations and cyber-attacks that have already affected several U.S. phone companies.
That being said, what did the warning say and how can businesses protect themselves from these complex attacks?

Let’s dive in!
 

What Did US Government’s CISA’s Advisory Reveal?

With ties to China's Ministry of State Security, Salt Typhoon is a hacking group that has been looking for weak spots in Cisco’s networking equipment to get into phone networks in the US and other countries.

Recently, these hacker groups were able to get into the call logs and private communications of at least 8 telecommunications providers without permission. These communications were mostly between government officials and political groups.

CISA says that these breaches are part of a mass-surveillance operation that has affected key U.S. infrastructure as well as those in dozens of countries, such as Canada, Australia and New Zealand.

To protect against these threats, CISA's guidelines suggest patch management, configuration hardening and putting in place strong access controls. The advisory also talks about Cisco's IOS XE Hardening Guide and NX-OS Security Guide and recommends companies to use these tools to make their security stronger.
 

So, What Actions Did CISA Recommend?

Organizations were urged to update all Cisco devices with the latest security patches to prevent exploitation by Salt Typhoon. Moreover, fortifying network devices against unauthorized access will be key, with CISA suggesting implementing security guidelines explained in Cisco's hardening guides.

The advisory suggests using a wide range of logging and tracking tools to find and stop any suspicious activity. Additionally, to keep administrators from getting into important network devices, they suggest using strict access controls, such as multi-factor authentication.

CISA pointed out that Cisco was working with them to solve these problems and encouraged other groups to use the company's tools for help and advice. Yet, why did CISA release the advisory?
 

How Severe Are The Threats?

It is said that Salt Typhoon has had access to networks that have been hacked for months and has taken a huge amount of private data, such as internet traffic, customer call records and legal communications.

Major telecommunications providers such as AT&T, Verizon, T-Mobile and Lumen Technologies were affected by the hacker group. While there is no evidence of classified information being compromised, the breaches by Salt Typhoon pose significant risks to national security and public trust.

A top CISA official said, “We cannot say with certainty that the adversary has been fully evicted, as we are still assessing the scope of their activities.”

Even representatives from the White House and other ally cybersecurity agencies stressed how important it is for countries to work together to fight these threats. Cisco said it was committed to fixing security holes and giving its customers strong ways to protect themselves from online threats.
 

How Can Organizations Protect Themselves?

 

• To make your communications infrastructure less vulnerable to threats, follow CISA's Enhanced Visibility and Hardening Guidance for Communications Infrastructure.

• Use secure messaging apps like Signal and WhatsApp to keep private information safe from outsiders.

• Update all network devices' software and hardware on a regular basis to quickly fix any known security holes.

• Conduct routine security audits, penetration testing and mock drills to identify and mitigate weaknesses in your IT infrastructure.

• Stay updated on advisories released by CISA and other cybersecurity authorities for the latest threat intelligence trends.

Will these measures help telecom firms curb the risks posed by state-sponsored cyber espionage? Share your thoughts in the box below!