Overview

• An international advisory from the UK’s NCSC, the NSA, FBI and partners in more than a dozen countries names Sichuan Juxinhe, Beijing Huanyu Tianqiong and Sichuan Zhixin Ruijie as enabling the Salt Typhoon operations.
• FBI Assistant Director Brett Leatherman said the campaign compromised at least 200 U.S. organizations and victims in 80 countries, expanding well beyond previously disclosed telecom targets.
• Agencies report the actors favored widely known, fixable vulnerabilities on routers and other edge devices, citing flaws in Ivanti Connect Secure, Palo Alto PAN‑OS GlobalProtect, Cisco IOS XE and Cisco Smart Install.
• Separately, Google’s Threat Intelligence Group detailed a March operation by UNC6384 using captive‑portal hijacks to push a signed downloader (STATICPLUGIN) that deployed an in‑memory PlugX variant (SOGU.SEC) against diplomats.
• Google blocked malicious domains and hashes, issued government‑backed attacker alerts to affected Gmail and Workspace users, and released IoCs and YARA rules, advising caution with certificates issued to Chengdu Nuoxin Times.