One unpatched edge router. That is the entire initial-access requirement behind the most consequential telecom breach publicly attributed to a nation-state actor in the last decade. A single internet-facing Cisco IOS-XE management interface, running software the vendor had already shipped a fix for, gave a People's Republic of China state-sponsored operator a foothold that eventually reached into the systems US carriers use to fulfill lawfully authorized wiretap requests — the CALEA infrastructure that shows, in near real time, which individuals federal law enforcement is currently watching.
That is not a hypothetical worst case. It is what CISA, the FBI, and the NSA jointly disclosed in December 2024 about a campaign now tracked as Salt Typhoon — also reported under the aliases Earth Estries, GhostEmperor, and G1045. This is a case study in how a management-plane vulnerability with a maximum-severity CVSS score, left unpatched on carrier edge infrastructure, escalated into access over the surveillance apparatus of the country whose networks were breached.
This report dissects the Salt Typhoon campaign against US and global carriers: the formally-attributed PRC state sponsorship, the CVE-2023-20198/CVE-2023-20273 Cisco IOS-XE exploit chain used for initial access, a phase-by-phase kill chain walkthrough covering the GhostSpider and SnappyBee (Masol RAT) toolset, the ATT&CK technique mapping published in the joint CISA/FBI/NSA advisory, and the standards gap — an existing CISA hardening guide that was not applied before the breach occurred.
I. Attribution and Disclosure Timeline
Salt Typhoon is formally attributed to the People's Republic of China — not an "assessed" or "likely" attribution, but one stated directly in joint US government advisories. The campaign is also tracked industry-side as Earth Estries (Trend Micro), GhostEmperor, and under the Microsoft-style designation G1045, reflecting how independent vendor telemetry and government intelligence converged on the same infrastructure and toolset.
| Milestone | Detail |
|---|---|
| First observed activity | Late 2023 |
| Public disclosure | October 2024 |
| Estimated dwell time | ~12 months before detection |
| Confirmed victims | Multiple US carriers, plus additional global carrier targets |
| Classification | Management-plane APT |
| TelcoSec threat score | 99 / 100 — CRITICAL |
Twelve months of dwell time inside management-plane infrastructure is the detail that should concern defenders most. This was not a smash-and-grab intrusion — it was sustained, quiet access to the systems that administer carrier network devices, long enough to map credential domains, stage multiple backdoors, and reach systems well beyond the original entry point before anyone noticed.
II. The Exploit Chain: CVE-2023-20198 and CVE-2023-20273
The entry vector was Cisco IOS-XE CVE-2023-20198, a privilege-escalation vulnerability in the IOS-XE Web UI feature, scored CVSS 10.0 — the maximum possible severity. An unauthenticated attacker who could reach the Web UI management interface over HTTP or HTTPS could create a local user account with privilege level 15, the highest administrative level IOS-XE supports, without needing any valid credentials first.
That alone is a full authentication bypass against any exposed device. Salt Typhoon paired it with a second vulnerability, CVE-2023-20273, a command-injection flaw in the same Web UI feature, to escalate from "have an admin account" to "have arbitrary root-level command execution" — the step that let the actor drop a persistent web shell directly onto the compromised router's filesystem.
┌──────────────────────────────────────────────────────────────────────┐
│ WHY EDGE ROUTERS WERE THE WEAK POINT │
│ │
│ [Internet] ──▶ [Carrier Edge Router — IOS-XE Web UI exposed] │
│ │ │
│ CVE-2023-20198 (CVSS 10.0) │
│ Unauthenticated priv-15 account creation │
│ │ │
│ CVE-2023-20273 │
│ Command injection → root shell → IOS-XE WebShell │
│ │ │
│ ▼ │
│ [Flat TACACS+ credential domain across mgmt plane] │
│ │ │
│ ▼ │
│ Every device trusting the same TACACS+ realm is now reachable │
└──────────────────────────────────────────────────────────────────────┘
Neither CVE was a zero-day at the time Salt Typhoon is assessed to have begun exploitation — Cisco PSIRT had already published fixed software and an advisory. The exposure that mattered was not novel vulnerability research; it was carrier edge infrastructure with internet-facing management interfaces running unpatched software, months after a fix existed. This is precisely the class of exposure the telecom pentesting methodology flags in Phase 1 reconnaissance — Shodan-indexed management interfaces and exposed administrative web UIs are not hypothetical findings, they are routinely discovered against live carrier infrastructure.
The second structural weakness Salt Typhoon exploited was architectural rather than a CVE: a flat TACACS+ credential domain across the management plane. TACACS+ centralizes authentication and authorization for network device administration — a sound design when the boundary of trust is understood and segmented. Here, the same credential domain that authenticated to the compromised edge router also authenticated to a much broader set of managed devices, turning one router compromise into a lateral-movement multiplier.
III. Kill Chain Walkthrough
Mapped against the Lockheed Martin seven-phase Cyber Kill Chain, the campaign's progression from external reconnaissance to CALEA-adjacent collection followed a consistent, deliberate structure.
Phase 1 — Reconnaissance
External scanning of carrier edge infrastructure to identify internet-facing Cisco IOS-XE management interfaces running vulnerable software versions. (T1190 — Exploit Public-Facing Application)
Phase 2 — Weaponization
The GhostSpider modular backdoor was prepared with encrypted C2 channels and in-memory plugin execution, while SnappyBee (also tracked as Masol RAT) was staged as a second-phase persistence mechanism — a deliberate redundancy so losing one implant didn't cost the operators their foothold. (T1027 — Obfuscated Files or Information)
Phase 3 — Delivery
Exploitation of CVE-2023-20198 for privilege escalation on the IOS-XE management web interface, immediately followed by web shell deployment via CVE-2023-20273. (T1190)
Phase 4 — Exploitation
The IOS-XE WebShell provided the initial durable foothold. From there, TACACS+ credentials were captured through management-VLAN sniffing and adversary-in-the-middle positioning. (T1505.003, T1040, T1557)
Phase 5 — Installation
GhostSpider and SnappyBee were deployed for durable persistence, and captured TACACS+ credentials were reused to move laterally — reaching not just adjacent network gear but eventually core and CALEA-adjacent infrastructure. (T1078, T1505.003)
Phase 6 — Command and Control
GhostSpider's encrypted C2 used randomized beacon timing designed to blend with routine HTTPS management traffic. Its in-memory plugin execution model avoided writing plugin code to disk, denying defenders the forensic artifacts a traditional file-based implant would leave. (T1071.001, T1027)
Phase 7 — Actions on Objectives
Two collection priorities defined this phase: mass harvesting of Call Detail Records for social-graph and mobility analysis at scale, and access to CALEA lawful-intercept infrastructure — revealing which individuals were active surveillance targets of US law enforcement. (T1213, T1119)
IV. The Toolset
| Tool | Role |
|---|---|
| GhostSpider | Primary modular backdoor. Encrypted C2, in-memory plugin execution, randomized beacon timing to blend with HTTPS management traffic. |
| SnappyBee (Masol RAT) | Secondary persistence implant, staged independently of GhostSpider as redundant access in case the primary backdoor was discovered and removed. |
| IOS-XE WebShell | Initial-foothold web shell deployed directly onto the compromised router via the CVE-2023-20273 command-injection chain. |
Each tool served a distinct stage of the operation rather than overlapping in function — a reconnaissance-to-persistence pipeline with minimal redundancy at the tooling layer, but deliberate redundancy at the access layer.
V. ATT&CK Technique Mapping
The joint CISA/FBI/NSA advisory maps Salt Typhoon activity to the following MITRE ATT&CK techniques:
| Technique ID | Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1505.003 | Server Software Component: Web Shell | Persistence |
| T1040 | Network Sniffing | Credential Access |
| T1557 | Adversary-in-the-Middle | Credential Access |
| T1078 | Valid Accounts | Defense Evasion |
| T1213 | Data from Information Repositories | Collection |
| T1119 | Automated Collection | Collection |
| T1071.001 | Application Layer Protocol: Web Protocols | Command and Control |
| T1027 | Obfuscated Files or Information | Defense Evasion |
Notice how few of these techniques rely on custom exploit engineering. Once T1190 delivered initial access, the remainder of the campaign leaned on credential abuse (T1078, T1040, T1557) and traffic blending (T1071.001, T1027) — the same categories of technique that appear across most sustained management-plane intrusions, telecom or otherwise. What made Salt Typhoon exceptional was not novel tradecraft; it was what those techniques were pointed at.
VI. Real-World Impact: CALEA and Lawful-Intercept Exposure
The Communications Assistance for Law Enforcement Act (CALEA) requires US carriers to build in the technical capability for law enforcement to execute court-authorized wiretaps. That capability necessarily exists as infrastructure inside the carrier network — systems that receive, log, and route lawful-intercept requests from federal and state law enforcement agencies.
This is what makes Salt Typhoon's reach into CALEA-adjacent systems categorically different from a typical data breach. The exposure was not limited to subscriber PII or billing records — categories of harm that, while serious, are well understood and covered by existing breach-notification and remediation frameworks. A foreign intelligence service gaining visibility into which individuals were under active US law-enforcement surveillance is a national-security-grade compromise with no clean remediation path: you cannot "reset a password" to undo the fact that an adversary may have known, in near real time, who the FBI was watching and when.
┌─────────────────────────────────────────────────────────────────────┐
│ WHY CALEA ACCESS IS UNIQUELY ALARMING │
│ │
│ Standard data breach: Subscriber PII, billing, CDR metadata │
│ → Remediable: notify, monitor for fraud, rotate credentials │
│ │
│ CALEA lawful-intercept breach: Active surveillance target list │
│ → Not remediable: exposure of ongoing investigations cannot be │
│ "undone" once a foreign intelligence service has observed it │
└─────────────────────────────────────────────────────────────────────┘
Beyond the CALEA dimension, the campaign's mass CDR harvest gave the actor the raw material for large-scale social-graph and mobility analysis across affected subscriber bases — the same category of collection documented in other telecom-targeting campaigns, but here achieved through management-plane access rather than a signaling-protocol query, and at a scale enabled by nearly a year of undetected persistence.
VII. The Standards Gap
The standards gap behind Salt Typhoon is unusually direct to state: a CISA hardening guide existed and was not applied before the breach occurred. This was not a case of a control gap in published guidance, nor an emerging threat class outrunning available defenses. Vendor patches for both exploited CVEs were available. Government-published hardening guidance for exactly this class of edge-device exposure existed. The gap was operational — patch and hardening-guide adoption on carrier edge infrastructure lagged the threat by long enough for a sophisticated actor to establish and sustain a year of access.
This pattern — available fix, available guidance, insufficient deployment discipline — recurs across nearly every publicly documented telecom APT campaign, independent of whether the entry point is a signaling protocol, a VPN appliance, or a management-plane web interface. The standards themselves are rarely the weak link; consistent operational enforcement is.
VIII. Defensive Countermeasures
Patch edge management interfaces on a compressed timeline. CVE-2023-20198 and CVE-2023-20273 were both patched by Cisco before Salt Typhoon's exploitation of carrier infrastructure. Internet-facing management interfaces — IOS-XE Web UI and equivalents from other vendors — should be treated as P0 patch priority, not standard change-control cadence.
Remove management interfaces from the public internet. No IOS-XE Web UI, or equivalent administrative interface, should be directly reachable from the internet. Restrict access to out-of-band management networks or VPN-gated jump hosts, with no exception carved out for operational convenience.
Segment TACACS+ (and equivalent AAA) credential domains. A single flat credential realm spanning edge routers, core infrastructure, and CALEA-adjacent systems means one compromised device compromises the trust boundary for all of them. Segment AAA realms by function and criticality, with CALEA and lawful-intercept infrastructure isolated into its own credential domain with independent, heavily monitored access.
Apply the CISA/FBI/NSA Enhanced Visibility and Hardening Guidance directly. The December 2024 joint advisory issued specific, actionable hardening steps in direct response to this campaign — treat it as a checklist, not background reading.
Hunt for redundant persistence, not just the first implant found. As demonstrated by GhostSpider and SnappyBee being staged independently, assume a sophisticated actor pre-positions secondary access. Removing one backdoor and declaring an incident closed is insufficient without an independent hunt for others.
| Control | Rationale |
|---|---|
| Patch IOS-XE (and equivalent) management interfaces within 72 hours of vendor advisory | Both exploited CVEs had fixes available before exploitation began |
| Remove management Web UIs from internet-facing interfaces | Removes the reconnaissance target entirely — T1190 requires a reachable public-facing app |
| Segment AAA/TACACS+ credential domains by criticality tier | Prevents one compromised edge device from exposing CALEA-adjacent systems |
| Deploy behavioral detection for in-memory / fileless plugin execution | GhostSpider's design specifically avoids disk-based forensic artifacts |
| Independently verify absence of secondary implants after any confirmed compromise | Redundant persistence (SnappyBee alongside GhostSpider) defeats single-implant remediation |
IX. Frequently Asked Questions
No. The initial access vector, CVE-2023-20198, and the follow-on command-injection vulnerability CVE-2023-20273, both had Cisco-published fixes available before Salt Typhoon's exploitation of carrier infrastructure. The failure was in patch and hardening-guide adoption on carrier edge devices, not in the absence of a fix.
A standard breach of subscriber PII or billing data is serious but remediable — carriers can notify affected users, monitor for fraud, and rotate credentials. CALEA infrastructure reveals which individuals are under active, court-authorized law-enforcement surveillance. If a foreign intelligence service gained visibility into that list, there is no remediation step that undoes the fact of that exposure — ongoing investigations may have been compromised the moment the access occurred, independent of when it was later detected or disclosed.
Management-plane compromise gives an actor visibility into and control over everything the compromised device administers — not just one protocol's data. Where a signaling-plane actor like LightBasin is limited to what SS7/Diameter queries expose, a management-plane foothold on a device with broad administrative reach can pivot toward core network functions, monitoring systems, and — in this case — infrastructure never intended to be reachable from a breached edge router at all.
GhostSpider used encrypted command-and-control with randomized beacon timing specifically engineered to blend into legitimate HTTPS management traffic, and it executed plugins in-memory rather than writing them to disk. That combination denies defenders both the network-signature anomalies and the file-based forensic artifacts that typically drive detection of persistent backdoors.
No — the exposure was specific to internet-facing IOS-XE Web UI management interfaces running unpatched software. Carriers that patched promptly, restricted management-interface reachability to out-of-band networks, or used vendors/configurations not affected by these specific CVEs were not exposed through this vector. The broader lesson is architectural: any internet-facing management interface, regardless of vendor, is a Phase 1 reconnaissance target and should be treated accordingly — see the telecom penetration testing methodology for how this class of exposure is systematically identified in an authorized assessment.
Conclusion
Salt Typhoon did not succeed through novel exploit research. It succeeded because a maximum-severity, already-patched vulnerability sat unremediated on internet-facing carrier edge infrastructure long enough for a patient, well-resourced state actor to walk through it, establish redundant persistence, and quietly expand access across a flat management-plane credential domain — eventually reaching systems that show which individuals a nation's own law enforcement is watching. Twelve months of dwell time is the cost of a patch cycle that moved slower than the threat.
TelcoSec's telecom-focused research covers exactly this class of management-plane exposure — the reconnaissance patterns that expose administrative interfaces, the credential-domain segmentation failures that turn single-device compromise into network-wide access, and the detection approach needed against fileless, in-memory C2 like GhostSpider's.
Sources: CISA/FBI/NSA joint advisory — Enhanced Visibility and Hardening Guidance for Communications Infrastructure (Dec 2024); Trend Micro Research — Earth Estries / GhostSpider analysis (Nov 2024); Cisco PSIRT — CVE-2023-20198 / CVE-2023-20273 advisory.
