Salt Typhoon logged into telecom network gear with stolen credentials in all but one case Talos examined
Cisco Talos's February 2025 analysis of Salt Typhoon's telecom intrusions found the actor used stolen legitimate logins on Cisco devices in all but one case. It then pulled more logins from weakly encrypted router configs and captured TACACS and RADIUS keys, so credentials stored on network gear are the first exposure for defenders to close.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence66
Elttam's two-packet TACACS+ exploit runs code on the servers that approve router logins
Elttam says two packets and an offline crack of weak encryption let attackers run code on TACACS+ servers before login. Only the Shrubbery Networks build has a patch, leaving sites on the archived Facebook fork to migrate or limit who can reach port 49.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher Elttam's two-packet exploit runs code on TACACS+ servers before anyone logs in
Elttam says a TACACS+ server flaw lets attackers run code before login with two packets and an offline crack of the protocol's weak encryption. Of the two main server codebases, Shrubbery Networks' has a fix that still has no CVE and Facebook's archived fork will get none, so the first job is finding out which daemon answers on port 49.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence40
Sygnia found the China-nexus group running packet captures, a tac_plus credential hook and two layers of log suppression on the gear that authenticates the rest of the estate, and it never established how the router was breached.
Perspective Coverage
6 publishers
- Builder
- Builder 33%
- Operator
- Operator 53%
- Investor
- Investor 14%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+25
- Incentives55
- Confidence64
Sens. Mark Warner and Ted Cruz filed a bill giving NTIA 18 months to write voluntary telecom security practices, with an optional third-party certification. Adopting them stays each carrier's choice, nearly a year after the mandatory post-breach rules were scrapped.
Perspective Coverage
3 publishers
- Builder
- Builder 18%
- Operator
- Operator 57%
- Investor
- Investor 25%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap0
- Incentives30
- Confidence68
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
Perspective Coverage
5 publishers
- Builder
- Builder 22%
- Operator
- Operator 68%
- Investor
- Investor 10%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence68
Asus clears the approval queue that now gates new foreign-made routers in the US
Asus is the biggest name so far through the Conditional Approval process that the Defense and Homeland Security departments run. Applicants hand over a component-level supply chain report and a time-bound plan to build the router in the US.
Reality
- Evidence60
- Adoption68
- Hype gap+28
- Incentives58
- Confidence55
Both banks Everest named in April traced the breach to a third-party vendor
Intel 471's 18-month sweep of the underground counted 340 financial-sector extortion victims across 74 countries, 159 firms with access for sale and 562 claimed DDoS attacks. The dated intrusions came in through vendors and help-desk calls.
Reality
- Evidence40
- Adoption55
- Hype gap+22
- Incentives78
- Confidence47
Cisco patches multiple IOS XR flaws, including critical bugs, via targeted SMUs
Two of the seven flaws score 9.8, but the operational weight sits in the remediation path, which asks operators to upgrade a device first and then apply as many as 16 targeted patches. No clean fixed release exists yet.
Reality
- Evidence62
- Adoption20
- Hype gap−12
- Incentives55
- Confidence55
One packet reboots your Cisco VPN box, and Cisco will not say who is firing it
CVE-2026-20349 lets an unauthenticated attacker crash any ASA or FTD running Remote Access SSL VPN. There is no workaround, exploitation is confirmed, and attribution is a blank page.
Publishers:eclypsium.com
Reality
- Evidence61
- Adoption58
- Hype gap+9
- Incentives62
- Confidence63