CISA Advisory AA25-239A: Salt Typhoon, GuestShell Risk, and How to Verify with Forward Networks
The CISA advisory AA25‑239A details a sophisticated espionage campaign attributed to Chinese state-sponsored actors, collectively referred to as Salt Typhoon. Why Does Salt Typhoon Matter?These actors are targeting vulnerable network infrastructure — including routers and switches — to gain initial access, persist in the environment, move laterally, and exfiltrate sensitive data. In an earlier post we described how to counter initial access from Salt Typhoon actors. In this post we will look closer at one of key tactics in this campaign, which involves abuse of the GuestShell feature available on certain Cisco platforms. What is GuestShell?GuestShell is a containerized Linux environment embedded within certain Cisco devices (e.g., IOS XE). It allows administrators — or, in the wrong hands, attackers — to run Linux commands and applications directly on the device. Since the activity within a virtual container is monitored less closely than native operations on switches and routers, cu
