Salt Typhoon’s JumbledPath shows legacy protocols still enable NHI abuse

At a glance

What this is: This analysis explains how Salt Typhoon’s JumbledPath malware used stolen credentials, legacy protocols, and edge networking devices to move into telecom environments and keep access alive.

Why it matters: It matters because identity teams cannot treat device access, protocol hardening, and credential governance as separate problems when adversaries can chain them together across the same access path.

Context

Legacy network access often still depends on usernames, passwords, and trust in internal routing, even when the surrounding environment has modern security controls. In this article, the primary issue is NHI abuse through legacy protocols and edge devices, not a novel exploit of the applications themselves.

Salt Typhoon’s JumbledPath campaign illustrates how a stolen credential can become far more dangerous when the target environment still accepts older authentication patterns and permits trusted-internal pivots. That makes the incident a governance problem as much as a technical one, because the access path is only as strong as the weakest protocol and device in it.

Key questions

Q: What breaks when stolen credentials are still accepted by legacy network devices?

A: The control that breaks is the assumption that a password only grants limited, reviewable access. On legacy devices, a stolen login can become full administrative reach, protocol visibility, and a persistence foothold. That is why password-based access on network infrastructure should be treated as a standing risk, not just an account issue.

Q: Why do legacy protocols like TACACS, RADIUS, and SNMP increase telecom breach risk?

A: They increase risk because they often sit on trusted management paths and can expose configuration, authentication, or administrative data if they are weakly protected. When an attacker reaches those channels, the problem is no longer just login theft. It becomes control-plane abuse, credential harvesting, and repeat access across devices.

Q: How can security teams tell whether edge devices are failing as identity controls?

A: Look for administrative access that bypasses federation, repeated use of the same credentials across devices, and management traffic that is trusted because it is internal rather than because it is strongly authenticated. Those signals show the device is acting like an unmanaged identity boundary instead of a governed control point.

Q: Should organisations prioritise federation or protocol hardening first for network devices?

A: If devices still accept passwords on exposed management paths, protocol hardening and phishing-resistant authentication should be tackled together. Federation helps with auditability, but it does not fix a control plane that still trusts old protocols. The right priority is to remove the easiest login path while shrinking the management surface at the same time.

Technical breakdown

How stolen credentials turn into authorised access on legacy devices

Salt Typhoon’s initial access path is straightforward: valid credentials are used where weak or reusable authentication still exists. In NHI terms, the problem is not compromise of an application session, but abuse of an identity that was already accepted by the target environment. When devices and remote access systems still rely on passwords, federation gaps and poor credential assurance let attackers log in rather than break in. Once authenticated, the attacker inherits the device’s trust relationships, logging blind spots, and administrative reach. That is why “user access” and “device access” cannot be governed as separate silos when the same credential can open both. Practical implication: treat legacy device logins as governed identities, not just operational access.

Practical implication: inventory every remote-access and network-device credential path, then remove password-based access where federation or phishing-resistant authentication is possible.

Why jump-host routing and protocol trust expand the blast radius

JumbledPath used a jump-host to make requests appear to originate from a trusted internal system. That matters because many monitoring and access policies still infer trust from source location or internal adjacency instead of from session assurance. The campaign also targeted SNMP, TACACS, and RADIUS, which sit in the control plane for network administration and authentication. Once those channels are reachable, attackers can move from a single login to packet capture, configuration inspection, and credential harvesting. This is a classic trust-stack failure: the environment trusted the network location, the device, and the protocol simultaneously. Practical implication: constrain administrative paths so that internal routing alone does not create implicit trust.

Practical implication: reduce implicit trust by segmenting administrative access, monitoring control-plane protocols, and requiring strong auth for every management hop.

How edge-device compromise turns access into persistence

The article describes Salt Typhoon switching between networking devices and reusing already compromised edge devices to maintain access. Edge devices are attractive persistence points because they often sit outside ordinary endpoint coverage, have long-lived configurations, and expose administrative protocols that are hard to continuously inspect. In practice, that means the attacker can retain footholds even when one route is blocked, then return through another device with similar trust and credential exposure. This is not merely lateral movement in the workstation sense. It is persistence through infrastructure that was not designed for high-frequency identity review. Practical implication: elevate edge networking devices into the same governance model used for privileged NHI and administrative accounts.

Practical implication: bring edge networking devices into privileged-access monitoring, configuration review, and access recertification cycles.

Threat narrative

Attacker objective: The objective is durable access to telecom infrastructure that can be reused for surveillance, credential harvesting, and long-term network control.

1. Entry begins with stolen credentials being accepted by legacy remote-access and network-device authentication paths.
2. Credential access follows as the actor targets device configurations and authentication traffic through SNMP, TACACS, and RADIUS.
3. Escalation occurs when jump-host routing and compromised edge devices provide trusted internal positioning for broader access.
4. Impact is persistent telecom intrusion with the ability to harvest more credentials and maintain repeat access across devices.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy protocol trust is the real attack surface here: Salt Typhoon succeeded because older authentication and management paths still accepted credentials that should not have been enough on their own. SNMP, TACACS, RADIUS, and jump-host patterns created a trust chain that converted one login into broader administrative reach. The implication is that NHI governance must extend beyond credential strength into protocol trust and device trust.

Credential compromise becomes infrastructure compromise when edge devices are under-governed: Edge networking devices are not just assets, they are identity enforcement points with their own access paths and control-plane exposure. When those devices are not governed like privileged identities, they become durable footholds for persistence and repeat access. Practitioners should treat edge devices as part of the identity perimeter, not merely as network plumbing.

Phishing-resistant authentication only solves the first layer of the problem: The article’s mitigation list is useful, but the deeper lesson is that password replacement does not automatically neutralise legacy protocol exposure. If the access path still trusts old management interfaces or allows internal pivots, a stronger login simply shifts the burden downstream. The implication is that authentication, protocol hardening, and device governance must be designed as one control plane.

JumbledPath sharpens a useful concept: identity blast radius: A single stolen credential can now propagate across devices, protocols, and administrative trust zones when the environment still allows legacy management flows. That blast radius is what practitioners should measure, not just the number of protected logins. The practical conclusion is to govern where one accepted credential can travel and what it can touch next.

Telecom intrusions are a reminder that infrastructure identity is a board-level resilience issue: When telecom providers are breached through credential reuse and trusted management paths, the impact extends beyond a single tenant or device. This sits at the intersection of NHI governance, critical infrastructure resilience, and privileged access control. Practitioners should align edge-device identity governance with critical-service risk, not just technical hygiene.

What this signals

Identity blast radius is the better lens for campaigns like JumbledPath: the key question is not only whether an attacker can log in, but how far one accepted credential can travel across devices, protocols, and administrative trust zones. For practitioners, that means modelling the next hop after authentication, not just the authentication event itself.

Telecom and other critical infrastructure environments should treat edge networking devices as privileged identity surfaces. When those devices retain password-based access or weakly governed management protocols, they become persistence points that evade ordinary endpoint-centric control assumptions.

For practitioners

• Replace password-based remote access with phishing-resistant authentication Use device-bound passkeys or equivalent phishing-resistant methods for network-device and remote-access accounts so a stolen password cannot open administrative paths.
• Federate device administration where vendors support it Move administrative access for networking gear into SSO-backed federation so audit trails, policy enforcement, and account lifecycle controls sit in one identity plane.
• Restrict management access to known administrative paths Segment and allow-list access to network devices so jump-hosts, source IPs, and control-plane ports are explicitly governed rather than implicitly trusted.
• Elevate edge devices into privileged access governance Include routers, switches, and similar edge systems in recertification, logging review, and configuration attestation because they can become long-lived persistence points.
• Rotate credentials aggressively on legacy equipment Where devices cannot support stronger authentication, shorten password lifetime and reduce reuse so stolen credentials have less time to remain operational.

Key takeaways

• Salt Typhoon’s JumbledPath campaign shows that stolen credentials and legacy management protocols can still defeat weakly governed network-access controls.
• The article ties the campaign to multiple telecom breaches and to credential harvesting through SNMP, TACACS, and RADIUS, which expands the practical blast radius.
• Practitioners need to govern edge devices, management paths, and authentication strength as one access-control problem rather than as separate hygiene tasks.

Key terms

• Jump Host: A jump host is a hardened intermediate server used to broker access between a user and a protected destination system. It creates a controlled checkpoint for identity verification and session filtering before a connection reaches sensitive assets. This reduces direct exposure of internal servers to unmanaged or internet facing access paths.
• Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.