Cisco Salt Typhoon FEB 2025

Salt Typhoon has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).

JumbledPath has the ability to perform packet capture on remote devices via actor-defined jump-hosts.

Salt Typhoon has used a variety of tools and techniques to capture packet data between network interfaces.

Salt Typhoon has exfiltrated configuration files from exploited network devices over FTP and TFTP.

Salt Typhoon has added SSH authorized_keys under root or other users at the Linux level on compromised network devices.

JumbledPath can communicate over a unique series of connections to send and retrieve data from exploited devices.

Salt Typhoon has cracked passwords for accounts with weak encryption obtained from the configuration files of compromised network devices.

Salt Typhoon has created Linux-level users on compromised network devices through modification of `/etc/shadow` and `/etc/passwd`.

Salt Typhoon has exploited CVE-2018-0171 in the Smart Install feature of Cisco IOS and Cisco IOS XE software for initial access.

JumbledPath can compress and encrypt exfiltrated packet captures from targeted devices.

Salt Typhoon has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.

Salt Typhoon has used custom tooling including JumbledPath.

Salt Typhoon has used publicly available tooling to exploit vulnerabilities.

Salt Typhoon has used configuration files from exploited network devices to help discover upstream and downstream network segments.

Salt Typhoon has attempted to acquire credentials by dumping network device configurations.

JumbledPath can use a chain of jump hosts to communicate with compromised devices to obscure actor infrastructure.

JumbledPath can impair logging on all devices used along its connection path to compromised hosts.

JumbledPath can clear logs on all devices used along its connection path to compromised network infrastructure.

Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.

Salt Typhoon has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.