Chinese Hackers Exploit Citrix Flaw to Breach European Telecom

"Salt Typhoon exploits Citrix vulnerability in European telecom, using advanced malware techniques to bypass traditional detection methods."

By Content Team

Oct 20, 2025

ON THIS PAGE

Chinese cyber group Salt Typhoon exploited a Citrix NetScaler Gateway vulnerability to infiltrate a European telecommunications company in July 2025. The hackers used advanced techniques including DLL sideloading and deployed SNAPPYBEE backdoor malware, hiding malicious code within legitimate antivirus software from Norton and other vendors.

Salt Typhoon, active since 2019, has targeted critical infrastructure across 80+ countries including telecommunications, energy, and government systems. The group used SoftEther VPN to mask their location and established communication with command-and-control servers.

Darktrace researchers identified the attack through behavioral anomalies, emphasizing that traditional signature-based detection isn't enough against sophisticated state-sponsored groups that blend into normal network operations.

Source: Infosecurity Magazine

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?